Xcode 8 "the aps-environment entitlement is missing from the app's signature" on submit

Question

I've got an app that we've submitted dozens of versions to in the last 6 months and we do use APNS. I got the following email from Apple after upgrading to Xcode 8

Dear developer,

We have discovered one or more issues with your recent delivery for APP_NAME. Your delivery was successful, but you may wish to correct the following issues in your next delivery:

Missing Push Notification Entitlement - Your app includes an API for Apple's Push Notification service, but the aps-environment entitlement is missing from the app's signature. To resolve this, make sure your App ID is enabled for push notification in the Provisioning Portal. Then, sign your app with a distribution provisioning profile that includes the aps-environment entitlement. This will create the correct signature, and you can resubmit your app. See "Provisioning and Development" in the Local and Push Notification Programming Guide for more information. If your app does not use the Apple Push Notification service, no action is required. You may remove the API from future submissions to stop this warning. If you use a third-party framework, you may need to contact the developer for information on removing the API.

After you’ve corrected the issues, you can use Xcode or Application Loader to upload a new binary to iTunes Connect.

Regards,

The App Store team

What is weird is I went to developer.apple.com -> Certificates, Identifiers & Profiles and my AppId does have Push Notifications enabled still. I'm not doing anything different then I've ever done on it so am curious if the Xcode 8 update broke something. Any ideas?

BTW: The link they put for the Push Notification Programming Guide was broken in the email, so that's not a good sign.

Paternal

Answer 1

Very easy actually. For some reason it got disabled on Xcode 8 but go to Targets -> Capabilities and verify Push Notifications is all correct on that view. For me it had a "Fix Me" I had to click, and voila.

Paternal

For me, this "Fix Me" added an explicit entitlements file (something I hadn't used in years), and once I remove it, the Push Notifications capability goes disabled again. Did anyone figure out how to enable it without having to add the entitlements file? – Hallam

Apple document here: developer.apple.com/library/content/releasenotes/DeveloperTools/… suggests "To use this entitlement, either enable Push Notifications in the project editor’s Capabilities pane, or manually add the entitlement to your entitlements file". – Heshum

The strange thing about this problem wasn't the solution, it was the fact that on Xcode 7 this was enabled and after upgrade it got disabled. – Paternal

I also had to go into the entitlements file and change the APS Environment value to 'production' because it was set to 'development' by default when created. – Bobbyebobbysocks

Finally! That's ridiculous it's been so hard to make it work. I've been removing & recreating the certs/profiles for almost 5 hours. The good thing is that I can say that I fully understand what are these certs/profiles/identifiers now :) Thank you for this hint. – Venessavenetia

@bek note that you should probably leave it as development. It gets changed to production automatically upon upload to iTunes Connect. – Birkner

Does anyone know how to remove this warning? I never use Push Notifications and never have in my app but for some reason when I submit the app I get that e-mail from Apple. Why is this happening and how do I remove this issue? – Carabineer

Answer 2

I also have the same problem, and I'm sure Push notification is off by default in Xcode8. I didn't notice it. Be careful about it.

Aggrade

Can you tell me that why I don't have push notification section in my account ? – Tympanites

Answer 3

There was a change in Xcode 8, where your entitlements no longer come from the App Identifiers, but from the capabilities selected in your app target. So, like Unome (the OP) said, you have to verify that Push Notifications is switched on.

For me, it wasn't a "Fix Me" button, but I had two entitlement files (one for development and one for distribution). Toggling the Push Notifications capability would add the aps-environment key - with the value development - to the development entitlements file, but it wouldn't add it to the distribution entitlements file. Copying the same key over to distribution worked to get rid of the warning email when uploading to iTunes Connect.

For most projects, it should be sufficient to toggle on Push Notifications, or if it's already on but the key isn't in the entitlements, try toggling it off and on again.

It's also worth noting that entitlements automatically get updated during archive. ie the entitlements generated for release builds can be different from entitlements generated for development builds. See here

During the app distribution process through the Xcode Organizer > Archives tab, entitlements are set onto the app by way of the provisioning profile used for code signing. It is important to be aware that the re-application of entitlements at this phase creates the opportunity for unintended entitlement differences between any prior development builds you may have tested. The primary purpose of this document is to verify that your entitlements are correct for your distribution builds for beta testing and App Store submission.

Brunhilda

This is the boat I'm in, except that no matter what I specify in my .entitlements file for the current config/scheme, it always uses production as the aps-environment. – Barbarize

@AlbertBori Weird, I could only get it to show development, which was fine because when it archived, it appeared as production. – Brunhilda

I did get a file with <product-name>.entitlements but it has value development for aps-environment. Where do I need to copy for distribution? – Fanniefannin

@Fanniefannin It is should be okay if the value is development. It will be changed in the ipa when the project is archived. – Brunhilda

@Brunhilda This actually doesn't happen during archiving. It happens during submission or when exported. Also some useful info to check it is being set correctly here: developer.apple.com/library/content/qa/qa1798/_index.html – Gilda

@MarkLeonard great find. I just loaded that into the question, because comments may not get read or they can deleted... – Host

Answer 4

From the Xcode release notes:

Xcode 8 does not automatically copy the aps-environment entitlement from provisioning profiles at build time. This behavior is intentional. To use this entitlement, either enable Push Notifications in the project editor’s Capabilities pane, or manually add the entitlement to your entitlements file. (28076333)

This is a great change as it was always quite odd that the aps-environment entitlement didn't require the plist, but many others did.

For those of you that do not want to just blindly press "Fix Me" and do not currently have an entitlements file, it is just a plist file which is referenced in your project's Build Settings under "Code Signing Entitlements"

Arizona

I couldn't find that quote in the linked notes! – Baptistry

I don't know who upvoted my comment and what was wrong, but I can find it too now. – Baptistry

Answer 5

After a day of struggle with Xcode 8 we could not figure out why the aps-environment development was NOT added to our debug builds. It was missing from the entitlements section in the built app for debug testing... even though we had ENABLED the new Capability and the entitlements file existed. The issue is that the entitlements file needs to be set for ANY SDK in the Xcode Build Settings for Debug Entitlements.

Readability

I don't think there is any difference between setting a value for the Debug key and setting it for the Debug > Any SDK one, as the latter is used to override the value for a particular SDK. – Baptistry

This is the solution for me – Sylvan

After struggling with this all morning, this was the problem I was having as well. Toggling Capabilities, generating provisioning profiles, none of it worked. This did. – Seclusive

this is still a valid solution in some cases on Xcode 8.3.3 – Bourke

I wish I could up vote this a million times. I've been struggling for a week, and this was the solution. Just typing the file path into the Code Signing Entitlements at the top wasn't enough, had to be done in the "Any SDK" part as well. This was the key to solving it for me. – Lightness

Answer 6

I got the same email from Apple using XCode 7.3.1. What I did to solve the problem was:

1. Under Capabilities > Set PUSH notification ON as stated in @Bruce Tsai answer.
2. Under Build-Settings > Code Signing > Code Signing Identity set the developer cert for debug and the distribution cert for release, as is shown in the image:

Pedro

Hi , In Capabilities I am not getting Capabilities > Set PUSH notification – Tympanites

@Anuj, I added a screenshoot where it should be in your Xcode. – Pedro

Answer 7

Automatically manage signing was off for me, i checked and working fine for me.

Sulphide

Answer 8

If you're using Firebase frameworks and aren't using push notifications there are two solutions 1. just put up with the 'issue' message that gets sent to your whole team every time uploading a binary. The app will still be accepted as a submission as long as you're not actually using notifications you can ignore the warning. or 2. do this: https://mcmap.net/q/153395/-firebase-causes-issue-quot-missing-push-notification-entitlement-quot-after-delivery-to-itunes-connect . This will remove the annoying email notification and also get accepted as a submission.

Abbie

Answer 9

Using Xcode 9 push Notifications was enabled.

I tried disabling/re-enabling Push Notification capabilities. (didn't work)

I tried disabling/re-enabling Automatically manage signing. (didn't work)

Turns out I had to delete and re-add my provisioning profiles. (see here how to do it) You might have to disable/re-enable Automatically manage signing after wards.

Phenacaine

Answer 10

For me the problem was because there were two entitlements files: Entitlements-Debug.plist and Entitlements-Release.plist. And only one of them (Debug) has needed settings in it.

Changing multiple value of Build Settings > Signing > Code Signing Entitlements to a single MyAppName/MyAppName.entitlements and then reenabling Capabilities > Push Notifications switcher did the trick for me.

Hope it helps.

Rotz

Answer 11

One more option that worked: copy-pasting the source of AppName/Entitlements-Debug.plist into AppName/Entitlements-Release.plist.

Rotz