Skip to content

fix: use manual code signing for iOS release archives #6042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ashleeradka merged 1 commit into from
Feb 20, 2026
Merged

fix: use manual code signing for iOS release archives #6042

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions clients/ios/build.sh
View file
Open in desktop
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration Bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 exportOptions.plist signingStyle still set to 'automatic' after switching archive to manual signing

The archive step was switched to CODE_SIGN_STYLE=Manual (line 132), but the dynamically generated exportOptions.plist at line 172 still specifies <key>signingStyle</key><string>automatic</string>. This mismatch means xcodebuild -exportArchive will attempt automatic signing during the export phase, which contradicts the manual signing used during archiving.

Root Cause and Impact

When signingStyle is automatic in the export options, xcodebuild -exportArchive tries to automatically resolve signing identities and provisioning profiles. Since the archive was built with manual signing using a specific PROVISIONING_PROFILE_SPECIFIER="Vellum Assistant iOS Distribution", the export step should also use manual signing with matching provisioningProfiles dictionary.

The exportOptions.plist should be updated to:

<key>signingStyle</key>
<string>manual</string>
<key>provisioningProfiles</key>
<dict>
    <key>BUNDLE_ID_HERE</key>
    <string>Vellum Assistant iOS Distribution</string>
</dict>

Without this, the export may fail with a signing error, or it may re-sign with a different (wrong) profile, defeating the purpose of the manual signing change.

(Refers to line 172)

Prompt for agents 
In clients/ios/build.sh, the exportOptions.plist generated at lines 162-181 needs to be updated to match the manual signing style used in the archive step. Specifically:

1. Change line 172 from `<string>automatic</string>` to `<string>manual</string>`
2. Add a `provisioningProfiles` dictionary that maps the app's bundle identifier to the provisioning profile name "Vellum Assistant iOS Distribution". The bundle identifier needs to be determined from the project (check the .xcodeproj or project.yml for the actual bundle ID). The resulting plist should include something like:

    <key>signingStyle</key>
    <string>manual</string>
    <key>signingCertificate</key>
    <string>Apple Distribution</string>
    <key>provisioningProfiles</key>
    <dict>
        <key>com.vellum.vellum-assistant-ios</key>
        <string>Vellum Assistant iOS Distribution</string>
    </dict>

Replace `com.vellum.vellum-assistant-ios` with the actual bundle identifier from the project configuration.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Original file line number Diff line number Diff line change
Expand Up @@ -128,9 +128,10 @@ xcodebuild archive \
-destination 'generic/platform=iOS' \
-archivePath "$ARCHIVE_PATH" \
-configuration Release \
-allowProvisioningUpdates \
DEVELOPMENT_TEAM="$DEVELOPMENT_TEAM" \
CODE_SIGN_STYLE=Automatic \
CODE_SIGN_STYLE=Manual \
CODE_SIGN_IDENTITY="Apple Distribution" \
PROVISIONING_PROFILE_SPECIFIER="Vellum Assistant iOS Distribution" \
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Parameterize provisioning profile for release signing

The archive step now hardcodes PROVISIONING_PROFILE_SPECIFIER="Vellum Assistant iOS Distribution", but release signing is otherwise parameterized by DEVELOPMENT_TEAM for different dev/CI environments. In any environment where the installed distribution profile has a different name (or only a UUID is available), xcodebuild archive will fail to resolve a matching profile and block release builds; this regression is triggered as soon as a non-matching team/profile setup runs ./build.sh release.

Useful? React with 👍 / 👎.

MARKETING_VERSION="$DISPLAY_VERSION" \
CURRENT_PROJECT_VERSION="$BUILD_VERSION"

Expand Down