From 8e24ea9ed77eade0fcbbbca74b3f4370e5949ed4 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Mon, 29 Jun 2026 12:12:08 +0200 Subject: [PATCH] fix(ci): archive Apple release builds with Automatic signing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The in-app OSS license screens (7591425) added a `resources:` array to the PunktfunkKit SwiftPM target, which makes SwiftPM emit a resource-bundle target (PunktfunkKit_PunktfunkKit). A resource bundle is a product type that cannot carry a provisioning profile, so the explicit PROVISIONING_PROFILE_SPECIFIER each release.yml archive step set — global on macOS, sdk-scoped on iOS/tvOS — now lands on it and fails the archive ("does not support provisioning profiles") on all three platforms. (Before that commit there was no resource bundle, so the profile was harmless.) Switch all three archive steps to CODE_SIGN_STYLE=Automatic (development): Automatic signing assigns a profile only to the app target and leaves the resource bundle (and the macOS-host SwiftPM macro plugins) alone, and bakes the sandbox entitlements in. No -allowProvisioningUpdates, so it stays offline and never cloud-signs (the App-Manager ASC key can't). DISTRIBUTION signing is unchanged — still manual, in the -exportArchive step (which maps the profile to io.unom.punktfunk only). Drops the now-unneeded manual signing xcconfigs. Requires the runner to have a development provisioning profile for io.unom.punktfunk on each platform (now installed for macOS/iOS/tvOS). Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/release.yml | 88 ++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 48 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 0ce1b23..5793fe1 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -207,10 +207,20 @@ jobs: # (Config/Punktfunk-macOS.entitlements) — mandatory for the Mac App Store. continue-on-error: true run: | - # Separate archive from the Developer ID one above: App Store needs a profile-signed - # archive (manual signing), not the unsigned-then-codesign DMG path. Same App-Manager - # ASC-key constraint as iOS/tvOS — MANUAL signing, NOT -allowProvisioningUpdates - # (cloud signing the key can't do). Quit Xcode so it can't prune the dropped profile. + # Separate archive from the Developer ID one above: App Store needs a signed, entitled + # archive that -exportArchive can re-sign for distribution, not the unsigned-then-codesign + # DMG path. Archive with AUTOMATIC signing (development). Why not a manually-specified + # profile (as this step used to do): the in-app license screens added a SwiftPM resource + # bundle (PunktfunkKit_PunktfunkKit), and a resource bundle is a product type that cannot + # carry a provisioning profile — a global PROVISIONING_PROFILE_SPECIFIER (here) or an + # sdk-scoped one (iOS/tvOS) lands on it and fails the archive ("does not support + # provisioning profiles"). Automatic signing assigns a profile only to the app and leaves + # the resource bundle (and the macOS-host macro plugins) alone, and bakes the sandbox + # entitlements in. No -allowProvisioningUpdates → it stays OFFLINE and never cloud-signs + # (the App-Manager ASC key can't), so the runner must have a macOS *development* profile + # for io.unom.punktfunk installed. DISTRIBUTION signing happens in the export step below + # (manual, via the plist). Quit Xcode so it can't prune the manually-installed App Store + # distribution profile that export needs. osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk macOS App Store Distribution" @@ -218,11 +228,10 @@ jobs: -project "$PROJECT" -scheme Punktfunk \ -destination 'generic/platform=macOS' \ -archivePath "$RUNNER_TEMP/Punktfunk-macos-appstore.xcarchive" \ + -skipMacroValidation -skipPackagePluginValidation \ MARKETING_VERSION="$VERSION" CURRENT_PROJECT_VERSION="$BUILD_NUM" \ - CODE_SIGN_STYLE=Manual \ - CODE_SIGN_IDENTITY="Apple Distribution" \ - DEVELOPMENT_TEAM="$TEAM_ID" \ - PROVISIONING_PROFILE_SPECIFIER="$PROFILE" + CODE_SIGN_STYLE=Automatic \ + DEVELOPMENT_TEAM="$TEAM_ID" cat > "$RUNNER_TEMP/export-macos-appstore.plist" < @@ -252,35 +261,27 @@ jobs: # Best-effort until the App Store Connect app record for io.unom.punktfunk exists. continue-on-error: true run: | - # MANUAL App Store signing: the local (valid) Apple Distribution identity + the App - # Store provisioning profile. NOT -allowProvisioningUpdates — with an App-Manager-role - # ASC key that forces Xcode's CLOUD-managed signing, which the role can't do ("Cloud - # signing permission error"). The profile must be installed on the runner under - # ~/Library/Developer/Xcode/UserData/Provisioning Profiles/ (install it once with - # Xcode.app quit, or it prunes the manually-dropped distribution profile). - # A running Xcode.app prunes unrecognized profiles from that dir — quit it so the App - # Store profile survives this build; headless xcodebuild doesn't need the GUI app. + # Archive with AUTOMATIC signing (development) — see the macOS App Store step for the full + # rationale. The SwiftPM resource bundle (PunktfunkKit_PunktfunkKit, added with the in-app + # license screens) builds for iphoneos, so even the sdk-scoped PROVISIONING_PROFILE_SPECIFIER + # this step used to set matched it and failed the archive ("does not support provisioning + # profiles"). Automatic signing profiles only the app and leaves the resource bundle (and + # the macOS-host macro plugins) alone. No -allowProvisioningUpdates → OFFLINE, never + # cloud-signs (the App-Manager ASC key can't), so the runner needs an iOS *development* + # profile for io.unom.punktfunk installed. DISTRIBUTION signing is the export step below + # (manual, via the plist). A running Xcode.app prunes unrecognized profiles — quit it so the + # manually-installed App Store distribution profile survives for export. osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk iOS App Store Distribution" - # Scope signing to the iOS device SDK via an xcconfig — see the tvOS step below for the - # full rationale. A global (CLI) profile specifier would also be forced onto the shared - # macOS-host SwiftPM macro plugins, which reject it and fail the archive; [sdk=iphoneos*] - # in an xcconfig lands it on the app/framework slices only. - SIGN_XCCONFIG="$RUNNER_TEMP/sign-ios.xcconfig" - cat > "$SIGN_XCCONFIG" < "$RUNNER_TEMP/export-appstore.plist" < @@ -312,33 +313,24 @@ jobs: # on the runner (xcodebuild -downloadPlatform tvOS). continue-on-error: true run: | - # Same manual App Store signing as iOS (the App-Manager ASC key can't cloud-sign). + # Archive with AUTOMATIC signing (development) — see the macOS App Store step. The SwiftPM + # resource bundle (PunktfunkKit_PunktfunkKit) builds for appletvos and rejected the + # sdk-scoped profile this step used to set; Automatic signing profiles only the app and + # leaves the resource bundle + the macOS-host macro plugins (OnceMacro/SwizzlingMacro/ + # AssociationMacro) alone. No -allowProvisioningUpdates → OFFLINE, never cloud-signs (the + # App-Manager ASC key can't), so the runner needs a tvOS *development* profile for + # io.unom.punktfunk installed. DISTRIBUTION signing is the export step below (manual, plist). osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk tvOS App Store Distribution" - # Scope signing to the tvOS device SDK via an xcconfig. A global (CLI) profile specifier - # hits EVERY target, including the shared SwiftPM macro plugins (OnceMacro/SwizzlingMacro/ - # AssociationMacro) which build for the macOS host and reject a provisioning profile - # (" does not support provisioning profiles"), failing the archive. Conditionals - # work only in an xcconfig (xcodebuild mis-parses a CLI "SETTING[sdk=..]=val"), and a - # command-line -xcconfig outranks target settings, so [sdk=appletvos*] puts the profile on - # the app/framework slices only — the macosx-host macros get nothing. (The macOS archive - # above is immune: its host-SDK macros are CODE_SIGNING_ALLOWED=NO, so a global specifier - # is ignored there.) - SIGN_XCCONFIG="$RUNNER_TEMP/sign-tvos.xcconfig" - cat > "$SIGN_XCCONFIG" < "$RUNNER_TEMP/export-tvos.plist" <