Per configuration app group entitlement strings in Xcode?

Question

Is there an easy way to have per-configuration app group entitlement strings in Xcode projects?

We're trying to share settings between an iOS application and today extension using an "app group" entitlement in both the targets.

The problem we're having is that we build the application with different bundle and team ids depending on whether it's an enterprise or a release build.

When I use Xcode 6's Capabilities screen, the app groups show up in red lettering and I don't see a way to change the strings for each configuration individually.

I assume one of the following will work, but I don't know which I should try first:

1. .xcconfig files
2. Manually created entitlement files
3. Build script
4. Configuration-dependent plist entries

Suggestions?

Fidelis

Overriding the CODE_SIGN_ENTITLEMENTS from a .xcconfig file now works as of Xcode 8.2.1. This definitely wasn't working with 8.0 and possibly 8.1 (haven't checked), so it may be the case that the bug referenced in some of the answers/comments is now fixed. – Caudle

Answer 1

You can use a different entitlements file for each configuration. This can be specified in the Xcode "Build Settings" user interface, or done through build configuration files (.xcconfig).

Example xcconfig:

CODE_SIGN_ENTITLEMENTS = Debug.entitlements

Where the value for CODE_SIGN_ENTITLEMENTS points to the correct entitlements file for this configuration. You can create as many configurations as you want in Xcode. By default Xcode creates Debug and Release, you may add Enterprise and use a build configuration file which points CODE_SIGN_ENTITLEMENTS to the correct entitlements file for Enterprise builds.

The Xcode "Capabilities" user interface will create and manage an entitlements file that is named after your build product. You can edit this file directly if you desire.

1. Create an XCConfig build configuration file for each of your build configurations. For this example we will just use Debug and Release, it's simple to add your own build configurations such as Enterprise.
2. As described above, populate the xcconfig files with the appropriate CODE_SIGN_ENTITLEMENTS settings.
3. In the Project "Info" user interface, set the build configuration to use the appropriate XCConfig file:

4. You can confirm by looking at the Code Signing Entitlements build setting for your build product. You should see something like this:

If you see bold text there, highlight that build setting and hit delete. This will remove the Xcode build setting that is overriding your xcconfig setting.

Stereophotography

This seems to be completely broken in Xcode 8. I've tried setting custom entitlements files for each build configuration in the Build Settings directly and using separate xcconfig files. Xcode remembers the last app group it expected and fails subsequent builds because the provisioning profile app group doesn't match. I'm stumped. – Satchel

@AdamSwinden I have the same problem! This is unbelievable. Have you found a workaround for this? – Intransitive

@Intransitive Not really unfortunately. Although I have found that after having a build fail, if you delete and reset the custom entitlements build settings Xcode reloads which app group it expects. I've found you have to do this every time you change the build configuration. – Satchel

@AdamSwinden same thing here. :( – Disservice

How can we add multiple App Groups in different entitlements? as there is no option to choose AppGroup separately for Debug and Release schemes/entitlements? – Hofmann

Answer 2

You can setup this via the "Build Settings". Same way as setting up different bundle ids.

Steps:

1. Add a new "User-Defined Setting"
2. Specify the "APP_GROUP_ID" for each scheme/config
3. Test it out, create an IPA for your app and unzip it.
4. Check out the .app and right click then choose "Show Package Contents"
5. Look for entitlements file. (if incase you can't find the entitlements file look for .xcent file and change the extension to .entitlements
6. Validate if the app group value in the entitlements file is the correct app group id you specified on step 2.

Cheers!

Eudo

There's no documented reason why this would work. It's not "same way" as Bundle ID, since Bundle ID is an info.plist field that by default is filled in from the build settings. Entitlement fields aren't. There is no documentation from Apple at all about a build setting APP_GROUP_ID. If this was an undocumented Build Setting, the thing about undocumented settings they are removed without notice. – Vellum

APP_GROUP_ID is a "User-Defined Setting".. i just name my defined settings with _. I am very sure that there would be no documentation about APP_GROUP_ID since its user defined. Cheers! – Eudo

Answer 3

Xcode 8 seems to have a bug as the comments in this question indicate.

I think I have a very rough and dangerous, but working workaround.

The idea is to have just 1 entitlements file that Xcode 8 sees and have a script replace it with the correct file for the configuration you are trying to build.

This workaround has many steps and not all of them may be necessary. I will try to update this post as more information is obtained. If you dare to test something like this, please add comments.

Additionally old provisioning profiles probably need to be deleted before reopening Xcode 8.

Deleting derived data before opening Xcode 8 also seems to help.

WARNING! TEST THIS AT YOUR OWN RISK. THIS CAN DO IRREVOCABLE DAMAGE

• deletes all provisioning profiles
• deletes DerivedData

SETTING UP THIS HACK

• Save this script below to your project folder.
• Patch in your project name and target names where it reads MyProject*
• patch in your configuration names
• Check the per configuration entitlements file names this script tries to copy on top of MyProject.entitlements
• Configure MyProject.entitlements as entitlements file in all configurations
• Do the same for all targets (if you have eg. watchkit app)
• Before running the script:
  • Choose the correct Scheme in Xcode
  • Close Xcode

The script template:

    #!/bin/bash                                                                                                                                                                                                                       

    echo

    if [ ! -n "$BASH" ] ;then echo Please run this script $0 with bash; exit 1; fi

    if [ $# -ne 1 ];  then
        echo
        echo "ERROR: one of the following expected as parameter: release alpha debug"
        echo
        exit -2
    fi

    chosen=$1

    echo "You have chosen build configuration $chosen"
    echo
    echo "This script is a workaround for Xcode 8 bug in handling different build configs and app groups."
    echo "(This scenario is most likely not on Apples list of things that developers are expected to do.)"
    echo
    echo "See comments in this SO answer"
    echo "https://mcmap.net/q/563112/-per-configuration-app-group-entitlement-strings-in-xcode"
    echo
    echo "1) This script must be run with Xcode 8 shut down."
    echo "2) All old provisioning profiles will be deteled. Xcode 8 will recreate them with hopefully correct build config."
    echo
    echo
    echo "WARNING: This will delete ALL provisioning profiles for all apps!"
    echo "WARNING: This will delete ALL MyProject named DerivedData."
    echo

    read -n 1 -s -p "Press any key to continue or Ctrl-C to cancel"

    echo

    # NOTE ABOUT DELETING DERIVED DATA                                                                                                                                                                                                
    # Deleting derived data fixes 2 bugs:                                                                                                                                                                                             
    # 1) Xcode 8 stubbornly generating some distribution profiles for old entitlements files                                                                                                                                          
    # 2) Install from HockeyApp fails due to signing verification error                                                                                                                                                               

    echo "Deleting derived datas"
    rm -vrf /Users/pelam/Library/Developer/Xcode/DerivedData/MyProject-*
    echo

    echo "Deleting provisioning profiles"
    rm -v ~/Library/MobileDevice/Provisioning\ Profiles/*.mobileprovision

    echo

    echo "Replacing target entitlements files"
    echo
    cp -v "./MyProjectTarget/MyProjectTarget.$chosen.entitlements" "./MyProjectTarget/MyProjectTarget.entitlements" || exit -1
    cp -v "./MyProjectAnotherTarget/MyProjectAnotherTarget.$chosen.entitlements" "./MyProjectAnotherTarget/MyProjectAnotherTarget.entitlements" || exit -1
    echo ADD COPY COMMANDS FOR OTHER TARGETS HERE

    echo
    echo "SUCCESS! Now run Xcode and verify that correct profiles are created."
    echo
    echo "NOTE:"
    echo "Running following command after starting Xcode 8 and waiting a bit can show you what appgroup is selected in each profile."
    echo "There should only the one correct app group or the release group. No duplicates in one file or mixed."
    echo "If you are not using multiple app groups, you can view the provisioning profile files in text editor to see that they contain correct settings for the configuration you are trying to build"
    echo "grep -a appgroup ~/Library/MobileDevice/Provisioning\ Profiles/*.mobileprovision"
    echo
    echo

Lurlinelusa