Xcode 8 "the aps-environment entitlement is missing from the app's signature" on submit

Question

I've got an app that we've submitted dozends of versions to in the last 6 months and we do use APNS. I got the following email from Apple after upgrading to Xcode 8

Dear developer,

We have discovered one or more issues with your recent delivery for APP_NAME. Your delivery was successful, but you may wish to correct the following issues in your next delivery:

Missing Push Notification Entitlement - Your app includes an API for Apple's Push Notification service, but the aps-environment entitlement is missing from the app's signature. To resolve this, make sure your App ID is enabled for push notification in the Provisioning Portal. Then, sign your app with a distribution provisioning profile that includes the aps-environment entitlement. This will create the correct signature, and you can resubmit your app. See "Provisioning and Development" in the Local and Push Notification Programming Guide for more information. If your app does not use the Apple Push Notification service, no action is required. You may remove the API from future submissions to stop this warning. If you use a third-party framework, you may need to contact the developer for information on removing the API.

After you’ve corrected the issues, you can use Xcode or Application Loader to upload a new binary to iTunes Connect.

Regards,

The App Store team

What is weird is I went to developer.apple.com -> Certificates, Identifiers & Profiles and my AppId does have Push Notifications enabled still. I'm not doing anything different then I've ever done on it so am curious if the Xcode 8 update broke something. Any ideas?

BTW: The link they put for the Push Notification Programming Guide was broken in the email, so that's not a good sign.

Solution 1

Very easy actually. For some reason it got disabled on Xcode 8 but go to Targets -> Capabilities and verify Push Notifications is all correct on that view. For me it had a "Fix Me" I had to click, and voila.

Solution 2

I also have the same problem, and I'm sure Push notification is off by default in Xcode8. I didn't notice it. Be careful about it.

Solution 3

There was a change in Xcode 8, where your entitlements no longer come from the App Identifiers, but from the capabilities selected in your app target. So, like Unome (the OP) said, you have to verify that Push Notifications is switched on.

For me, it wasn't a "Fix Me" button, but I had two entitlement files (one for development and one for distribution). Toggling the Push Notifications capability would add the aps-environment key - with the value development - to the development entitlements file, but it wouldn't add it to the distribution entitlements file. Copying the same key over to distribution worked to get rid of the warning email when uploading to iTunes Connect.

For most projects, it should be sufficient to toggle on Push Notifications, or if it's already on but the key isn't in the entitlements, try toggling it off and on again.

It's also worth noting that entitlements automatically get updated during archive. ie the entitlements generated for release builds can be different from entitlements generated for development builds. See here

During the app distribution process through the Xcode Organizer > Archives tab, entitlements are set onto the app by way of the provisioning profile used for code signing. It is important to be aware that the re-application of entitlements at this phase creates the opportunity for unintended entitlement differences between any prior development builds you may have tested. The primary purpose of this document is to verify that your entitlements are correct for your distribution builds for beta testing and App Store submission.

Solution 4

From the Xcode release notes:

Xcode 8 does not automatically copy the aps-environment entitlement from provisioning profiles at build time. This behavior is intentional. To use this entitlement, either enable Push Notifications in the project editor’s Capabilities pane, or manually add the entitlement to your entitlements file. (28076333)

This is a great change as it was always quite odd that the aps-environment entitlement didn't require the plist, but many others did.

For those of you that do not want to just blindly press "Fix Me" and do not currently have an entitlements file, it is just a plist file which is referenced in your project's Build Settings under "Code Signing Entitlements"

Solution 5

After a day of struggle with Xcode 8 we could not figure out why the aps-environment development was NOT added to our debug builds. It was missing from the entitlements section in the built app for debug testing... even though we had ENABLED the new Capability and the entitlements file existed. The issue is that the entitlements file needs to be set for ANY SDK in the Xcode Build Settings for Debug Entitlements.

View more solutions

Comments

[villapossu]

For me, this "Fix Me" added an explicit entitlements file (something I hadn't used in years), and once I remove it, the Push Notifications capability goes disabled again. Did anyone figure out how to enable it without having to add the entitlements file?

[Kay_N]

Apple document here: developer.apple.com/library/content/releasenotes/DeveloperTo‌​ols/… suggests "To use this entitlement, either enable Push Notifications in the project editor’s Capabilities pane, or manually add the entitlement to your entitlements file".

[Albert Bori]

This is the boat I'm in, except that no matter what I specify in my .entitlements file for the current config/scheme, it always uses production as the aps-environment.

[timgcarlson]

@AlbertBori Weird, I could only get it to show development, which was fine because when it archived, it appeared as production.

[Unome]

The strange thing about this problem wasn't the solution, it was the fact that on Xcode 7 this was enabled and after upgrade it got disabled.

[Bek]

I also had to go into the entitlements file and change the APS Environment value to 'production' because it was set to 'development' by default when created.

[Kamil Rykowski]

Finally! That's ridiculous it's been so hard to make it work. I've been removing & recreating the certs/profiles for almost 5 hours. The good thing is that I can say that I fully understand what are these certs/profiles/identifiers now :) Thank you for this hint.

[meteors]

I did get a file with <product-name>.entitlements but it has value development for aps-environment. Where do I need to copy for distribution?

[timgcarlson]

@meteors It is should be okay if the value is development. It will be changed in the ipa when the project is archived.

[Montdidier]

@bek note that you should probably leave it as development. It gets changed to production automatically upon upload to iTunes Connect.

[Iulian Onofrei]

I don't think there is any difference between setting a value for the Debug key and setting it for the Debug > Any SDK one, as the latter is used to override the value for a particular SDK.

[Iulian Onofrei]

I couldn't find that quote in the linked notes!

[Himanth]

This is the solution for me

[Mark Leonard]

@timgcarlson This actually doesn't happen during archiving. It happens during submission or when exported. Also some useful info to check it is being set correctly here: developer.apple.com/library/content/qa/qa1798/_index.html

[Dave S]

After struggling with this all morning, this was the problem I was having as well. Toggling Capabilities, generating provisioning profiles, none of it worked. This did.

[Iulian Onofrei]

I don't know who upvoted my comment and what was wrong, but I can find it too now.

[Dino Alves]

Does anyone know how to remove this warning? I never use Push Notifications and never have in my app but for some reason when I submit the app I get that e-mail from Apple. Why is this happening and how do I remove this issue?

[dan]

this is still a valid solution in some cases on Xcode 8.3.3

[Anuj]

Hi , In Capabilities I am not getting Capabilities > Set PUSH notification

[Anuj]

Can you tell me that why I don't have push notification section in my account ?

[Robert Bentley]

I wish I could up vote this a million times. I've been struggling for a week, and this was the solution. Just typing the file path into the Code Signing Entitlements at the top wasn't enough, had to be done in the "Any SDK" part as well. This was the key to solving it for me.

[Ruben]

@Anuj, I added a screenshoot where it should be in your Xcode.

[mfaani]

@MarkLeonard great find. I just loaded that into the question, because comments may not get read or they can deleted...