Open Radar

 
15-Jun-2012 08:52 AM Roman Busyghin:
Summary:
PackageApplication doesn't update application prefix identifier while resigning application from regular App Store account to Enterprise. 

Steps to Reproduce:
1. Create an app with shared keychain access feature enabled (or any other feature that relies on application prefix identifier).
2. Build it for App Store.
3. Check entitlements by running "codesign --display --entitlements - YourApp.app". Note that "keychain-access-groups" array has strings that begin with application prefix identifier XXXXXX.
3. Run "xcrun -sdk iphoneos -run PackageApplication --sign 'Your Enterprise Distribution Identity' --embed '/Full/Path/To/Enterprise.mobileprovision' '/Full/Path/To/Your.app' -o '/Desired/Full/Path/To/YourApp.ipa'" in order to resign it.
4. Unpack IPA file and check app entitlements. Note that entitlements remain the same (from App Store mobile provisioning profile) but they mismatch embedded provisioning profile (which is from Enterprise).

Expected Results:
Application identifier prefix should match provisioning profile from Enterprise account. I don’t know whether entitlements should match entirely or not.

Actual Results:
Application identifier prefix matches App Store mobile provision file.

Regression:
It looks like the bug persists from day one of iOS SDK.

Notes:
The bug prevents app from accessing shared keychain or any other feature that relies on application prefix identifier. 

In our company we have two iPhone Developer programs: Regular and Enterprise. We use regular one to publish out apps into App Store. Enterprise program is for testing the same application inside our company. We need to resign out apps before submitting to App Store in order to test it properly.

This bug happens because of PackageApplication script doesn’t handle this case. I’ve attached modified version of PackageApplication script that works for me.

15-Jun-2012 08:52 AM Roman Busyghin:
'PackageApplication' was successfully uploaded