Re-sign IPA (iPhone)
Solution 1
Finally got this working!
Tested with a IPA signed with cert1 for app store submission with no devices added in the provisioning profile. Results in a new IPA signed with a enterprise account and a mobile provisioning profile for in house deployment (the mobile provisioning profile gets embedded to the IPA).
Solution:
Unzip the IPA
unzip Application.ipa
Remove old CodeSignature
rm -r "Payload/Application.app/_CodeSignature" "Payload/Application.app/CodeResources" 2> /dev/null | true
Replace embedded mobile provisioning profile
cp "MyEnterprise.mobileprovision" "Payload/Application.app/embedded.mobileprovision"
Re-sign
/usr/bin/codesign -f -s "iPhone Distribution: Certificate Name" --resource-rules "Payload/Application.app/ResourceRules.plist" "Payload/Application.app"
Re-package
zip -qr "Application.resigned.ipa" Payload
Edit: Removed the Entitlement part (see alleys comment, thanks)
Solution 2
The answers to this question are a little out of date and missing potentially key steps, so this is an updated guide for installing an app from an external developer.
----- How to Resign an iOS App -----
Let's say you receive an app (e.g. MyApp.ipa) from another developer, and you want to be able to install and run it on your devices (by using ideviceinstaller, for example).
Prepare New Signing Assets
The first step is to attain a Provisioning Profile which includes all of the devices you wish to install and run on. Ensure that the profile contains a certificate that you have installed in your Keychain Access (e.g. iPhone Developer: Some Body (XXXXXXXXXX) ). Download the profile (MyProfile.mobileprovision) so you can replace the profile embedded in the app.
Next, we are going to prepare an entitlements file to include in the signing. Open up your terminal and run the following.
$ security cms -D -i path/to/MyProfile.mobileprovision > provision.plist
This will create an xml file describing your Provisioning Profile. Next, we want to extract the entitlements into a file.
$ /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' provision.plist > entitlements.plist
Replace The Provisioning Profile and Resign App
If you are working with a .ipa file, first, unzip the app (if you have a .app instead, you can skip this step).
$ unzip MyApp.ipa
Your working directory will now contain Payload/
and Payload/MyApp.app/
. Next, remove the old code signature files.
$ rm -rf Payload/MyApp.app/_CodeSignature
Replace the existing provisioning profile (i.e. embedded.mobileprovision) with your own.
$ cp path/to/MyProfile.mobileprovision Payload/MyApp.app/embedded.mobileprovision
IMPORTANT: You must also resign all frameworks included in the app. You will find these in Payload/MyApp.app/Frameworks
. If the app is written in Swift or if it includes any additional frameworks these must be resigned or the app will install but not run.
$ /usr/bin/codesign -f -s "iPhone Developer: Some Body (XXXXXXXXXX)" --entitlements entitlements.plist Payload/MyApp.app/Frameworks/*
Now sign the app with the certificate included in your provisioning profile and the entitlements.plist that you created earlier.
$ /usr/bin/codesign -f -s "iPhone Developer: Some Body (XXXXXXXXXX)" --entitlements entitlements.plist Payload/MyApp.app
You can now rezip the app.
$ zip -qr MyApp-resigned.ipa Payload
Done
You may now remove the Payload
directory since you have your original app (MyApp.ipa) and your resigned version (MyApp-resigned.ipa). You can now install MyApp-resigned.ipa on any device included in your provisioning profile.
Solution 3
I think the easiest is to use Fastlane:
sudo gem install fastlane -NV
hash -r # for bash
rehash # for zsh
fastlane sigh resign ./path/app.ipa --signing_identity "Apple Distribution: Company Name" -p "my.mobileprovision"
Solution 4
I successfully followed this answer, but since entitlements have changed, I simply removed the --entitlements "Payload/Application.app/Entitlements.plist"
part of the second to last statement, and it worked like a charm.
Solution 5
Checked with Mac OS High Sierra and Xcode 10
You can simply implement the same using the application iResign.
Give path of 1).ipa
2) New provision profile
3) Entitlement file (Optional, add only if you have entitlement)
4) Bundle id
5) Distribution Certificate
You can see output .ipa file saved after re-sign
Simple and powerful tool
Erik
Updated on June 09, 2021Comments
-
Erik about 3 years
I currently build all my applications with hudson using xcodebuild followed by a xcrun without any problems
I've received a couple of IPA files from different people that I would like to re-sign with a enterprise account instead of the corporate account (for the app store, or sometimes ad-hoc distributed).
My problem is that when I try to resign the app, it won't install on my device (and it should since it's a Enterprise build). The error message is on the device (not in iTunes) and it tells me simply that it couldn't install the app. No more information is given.
I've found some information, ( http://www.ketzler.de/2011/01/resign-an-iphone-app-insert-new-bundle-id-and-send-to-xcode-organizer-for-upload/ )
And this might be possible. The problem I'm facing is that it doesn't seem to embed the mobile provisioning profile as I do with my normal builds (using xcrun) is this possible to control with the codesign tool, or is it possible to re-sign with xcrun?
With my resign script i currently do
- unzip app.ipa
- appname=$(ls Payload)
- xcrun -sdk iphoneos PackageApplication -s "$provisioning_profile" "$project_dir/Payload/$appname" -o "$project_dir/app-resigned.ipa" --sign "$provisioning_profile" --embed "$mobileprovision"
I've looked in the resulting ipa file and it seems to be very similar to the original app. What files should really change here? I initially thought the the _CodeSignature/CodeResources would change, but the content looks pretty much exactly the same.
Pointers are much appreciated.
-
tjg184 almost 13 yearsI could not get this to work if the original bundle id was different than the new one. I tried the -i on the code-sign but it lead to keychain errors when the app ran. I also tried to modify Info.plist and then sign it with no luck. It almost appears the binary contains the bundle id.
-
tjg184 almost 13 yearsOne thing that caused us issues was the Entitlements file, if you have one, must match the app id provided by Apple. Since we were changing the bundle id, the entitlements did not match. The app would run, but the keychain would clear after each run.
-
SlowTree almost 13 yearsCan you describe a little bit better the way to get it work changing the bundle id? I'm trying to change the bundle id since for our in-house we need to use a different one. Many thx.
-
tjg184 almost 13 yearsYou can modify the Info.plist manually. This would inclue the bundle id. So, modify it before signing. One issue we ran into was that the entitlements.plist file contained $(AppIdentifierPrefix)$(CFBundleIdentifier) which did not resolve to the new app id after we signed. Let me know if that helps.
-
Michael Baltaks over 12 yearsAccording to oleb.net/blog/2011/06/code-signing-changes-in-xcode-4 the app ID is built into the binary, so you can only resign using the same app ID. I know I was not able to resign with a different app ID.
-
zekel over 12 yearsFYI, you can use the Apple's (built-in)
/usr/libexec/PlistBuddy
command to change values in a plist. -
Besi over 12 yearsThis made my day. I had to create an Entitlements.plist first.
Xcode > New file > Entitlement.plist > Can be debugged = 'NO'
-
madoke over 12 yearsI was able to submit a distribution ipa following the steps above. Just had to remove the Entitlements part, as our application had none. Thanks for the help !
-
Bruno Bronosky about 12 yearsI'll 2nd the previous comment. Remove the entitlements to make this work with the modern toolkit.
-
user431791 almost 12 yearsCan i follow the same procedure for the individual developer account. Because now client is looking to submit app on his account can i just reassign the app to his account?
-
Kevin Gaudin almost 12 yearsThanks a lot for this procedure. Just one thing: I had to specify the correct platform for codesign_allocate before running codesign: "$ export CODESIGN_ALLOCATE=/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/codesign_allocate" otherwise codesign stops with an "codesign_allocate: object: /Users/.../MyApp.app/MyApp malformed object (unknown load command 9)" error
-
Felipe Sabino over 11 yearsHi @Erik, I created a gem pretty much based on this solution to facilitate the process of .ipa files re-sign... may be you can check it out, cheers github.com/felipesabino/provise
-
RandomBits over 11 yearsThe payload contains symbolic links so you need to include the -y flag when you zip it up: zip -yqr resigned.ipa Payload
-
Valerio Santinelli over 11 yearsI wonder if this way to resign an app works for distribution on the App Store. I tried following along but when uploading the resigned IPA through the Application Loader, the following error is reported: Application failed codesign verification. The signature was invalid, contains disallowed entitlements, or it was not signed with an iPhone Distribution Certificate. Of course there are no entitlements and the certificate is a distribution one.
-
Bulat about 11 yearsWithout entitlements my app actually started working weird, giving this in log:
SecItemCopyMatching: missing entitlement
. I don't have separate Entitlements.plist file, so to preserve entitlements I used @LordT's comment: first create an entitlements file:echo "<?xml version=\"1.0\" encoding=\"UTF-8\"?>/usr/bin/codesign -d --entitlements - temp/Payload/$APP_NAME | sed -E -e '1d'" > temp/newEntitlements
, then use it when signing:--entitlements temp/newEntitlements
. -
Peter about 11 years@ValerioSantinelli You'll need to carry over entitlements from the previous code signing. FWIW push notifications will not work without entitlements. After unzipping:
/usr/bin/codesign -d --entitlements :entitlements.plist /Payload/appname.app
Then during the resigning add--entitlements entitlements.plist
-
cesarislaw almost 11 yearsIf you're resigning in order to submit to the App Store you'll need to create and include an Entitlements file. Just a heads up. This answer solved a lot of problems for us and will enable us to submit on schedule. Thanks!
-
Erik over 10 yearsFelipe Sabino, great tool, just tried it for the first time. And thanks for the recognition.
-
Mutawe about 10 yearsive got the following error on this line " No such file or directory " : cp "MyEnterprise.mobileprovision" "Payload/Application.app/embedded.mobileprovision"
-
Chris Klingler over 9 yearsSo what exactly is happening during the resigning step?
-
Jibeex over 9 yearscodesign fails on Yosemite -- Warning: --resource-rules has been deprecated in Mac OS X >= 10.10! Payload/Aaa.app/ResourceRules.plist: cannot read resources
-
Sandro Machado over 9 yearsUsing this I get "no valid 'aps-environment' entitlement string found for application" when I try to register for receiving push notifications. I tried the @Peter tips but the app didnt install. Any idea?
-
Anonymous over 9 yearsThank you for posting this. This worked for me. I'd like to add a note about an extra step I needed. Within "Payload/Application.app/" there was a directory named "CACertChains" that contained a file named "cacert.pem". I had to remove the directory and the .pem to complete these steps. Thanks again!
-
Jon Cox over 9 yearsI'd recommend adding
--symlinks
to thezip
command, to fix the "...CodeResources file must be a symbolic link..." issue. See stackoverflow.com/a/7141055/404409 for details. -
Lion almost 9 yearsThanks, this works! And Entitlements should be included since iOS 8.1.3., so add
--entitlements entitlements.plist
back to resign command. I createdentitlements.plist
using Apple's How do I check the entitlements associated to my Provisioning Profile? -
d4Rk almost 9 yearsIt seems that it's important to add the
--entitlements entitlements.plist
part in the correct place, for me it was not working (No such file or directory
), when placed in the end of the command.. Putting it before the-s ...
switch, did the trick. -
d4Rk almost 9 yearsMake also sure, you profile is not expired. Took me quite a while to figure that out.. -.-
-
megha almost 9 yearsWarning: --resource-rules has been deprecated in Mac OS X >= 10.10! Payload/Application.app/ResourceRules.plist: cannot read resources. Getting this error?
-
Khant Thu Linn almost 9 yearsIs there anyone who try that on ios 9 ? I can install on ios 8 but on ios 9, i get this error. "The application could not be verified."
-
Chase Florell about 8 yearsWill this same approach apply to distribution profiles? IE: can I extract the entitlements and re-sign from my distro.mobileprovision?
-
LearneriOS almost 8 years@grez Will this work for distribution of IPAs as well ?
-
LearneriOS almost 8 yearsI mean distribution of 'enterprise' app IPAs as well @grez
-
Bryan Bryce over 7 years@LearneriOS This did not work for me for Enterprise IPA Distribution. I'm using Sierra, Xcode 8, iOS 10. The app installs via iTunes but then gets deleted immediately after installation.
-
InnisBrendan over 7 years@PhoenixFF I am not sure about installing with iTunes, but can you try to install from the command line like this: $ ideviceinstaller -i myapp.ipa
-
jugutier over 7 yearsYour link is broken... found this alternative by looking at the github of the author. github.com/fastlane/fastlane/blob/…
-
RPM over 7 yearsthis is an old answer and probably should be deleted since it no longer works but there is no way to delete it in StackOverflow
-
jugutier over 7 yearsThis worked for us, just need to update the link to this: github.com/fastlane/fastlane/blob/…
-
RPM over 7 yearsok good to know that it still works. Cant edit the original answer anymore so people will have to read the comments :)
-
green0range over 7 yearsUse
fastlane sigh resign YourApp.ipa --signing_identity "iPhone Distribution: YourCompanyOrDeveloperName" -p <path_to_provisioning_profile_for_app>.mobileprovision -p <path_to_provisioning_profile_for_watchkitextension>.mobileprovision
instead. -
allemattio over 7 yearsAs of now, March 9th 2017, iOS 10.2 and Xcode 8, this is the only working solution I've found. Thank you so much!
-
Rufus about 7 yearsthis answer helps me a lot!I forget to resign the frameworks and the app crashed during launching.
-
i 4322946 almost 7 yearsI am unable to resign the frameworks as I do not have Frameworks folder in Payload/MyApp.app. Can anyone help me out with this. Thanks in advance.
-
Jay almost 7 years@i4322946 If you do not have Frameworks folder, ignore that step. FYI, I just used the instruction provided by grez to re-sign an enterprise ios app via commandline and deployed it successfully.
-
Christopher Griffith over 6 yearsPer @KhantThuLinn's comment, I also get "application could not be verified". Is there a way around this?
-
dodgy_coder over 6 yearsThis is a genius solution that still works as of Xcode 9.2. In my case I just copied over the old .app file under the existing .xcarchive. I didn't change Info.plist and so the app version remained as the old version but was signed with the new enterprise certificate.
-
Omid Kia over 4 yearsI tried many ways but no luck. This solution worked for me thanks.
-
Anjaneyulu Battula about 3 yearsThis solution worked for me. @InnisBrendan answer also works but we have sign frameworks first then app other wise it will not install in device