Upgrade's application-identifier entitlement string does not match installed application -> rejecting upgrade

Question

I have an iOS app that is now around 3 years old. It is signed with an enterprise profile. We have released seven versions of the software, the last time being almost a year ago. Currently we are trying to do a new release but have found that due to the new security rules in iOS8 that iOS 8.1.3 devices and greater cannot upgrade and must delete and reinstall.

In researching I found similar issues for people who are signing the app with a different profile, but our app is being signed with the same profile. The error claims that our old application-identifier contained a wildcard, which I cannot figure out since we have never changed the bundle id(but, in the developer portal our general appId for all our apps is com.company.*).

I have found that if I build both version 1 and version 2 of the app with Xcode 6.4 I can upgrade successfully and if I build both versions of the app with Xcode 5.1 I can upgrade successfully, the problem is when trying to install a version of the app built with Xcode 6.4 over a version built with Xcode 5.1

The error we get when we attempt the upgrade is:

"Upgrade's application-identifier entitlement string (6Q39SSX4QT.com.company.appName) does not match installed application's application-identifier string (6Q39SSX4QT.com.company.*)"

I have seen some references to needing to include an entitlements.plist file in our app, we have a AppName.entitlements plist file, but none of our apps have a entitlements.plist file(and our other apps do not exhibit this problem though they have been upgraded multiple times since Xcode 5.1 released).

Anyone have any ideas?

Thanks!

Ankerite

Answer 1

1. Open Xcode - > Window -> Devices
2. Click on your device and remove the app you are trying to install from the installed apps list.
3. Try running now.

Thingumajig

Works great! Tip: if you store your application settings and/or state in UserDefaults.standard key-value pairs and you don't want to lose them, then on that Windows -> Devices screen, before removing the selected app by clicking on "-", first click on "..." and select "Download Container", then after the app is reinstalled, come back and invoke "Replace Container". – Tatar

Answer 2

I have just had this error - it was because I had changed the development team used to sign the app. Ie I used our company's distribution profile to sign the development version and the client's distribution profile to sign a release version.

Check that the team id in the entitlements is the correct team id (printed in the error message) -> then its the installed app that is wrong. Also check that you haven't specified an application-identifier in an entitlements file. I didn't have an entitlements file at all.

In this case simply delete the app on the device and reinstall it fresh.

Chris

Epithelium

Answer 3

After doing some further reading, I found this answer to be helpful. In my case, I am building via a grunt script so I can modify my archive/sign/package step to insert the entitlements during the codesign step.

If you follow the steps I linked, you will want to make sure your entitlements.plist file contains the wildcard as shown below:

<key>application-identifier</key>
<string>com.company.*</string>

If you are doing the app packaging manually, you may want to look at iResign. This will create the entitlements.plist file for you and inject it while signing your app.

I wish there was better documentation available from Apple on this. I cannot get the same effect in XCode no matter what I specify in my target's Code Entitlements settings.

Infliction

this should be the correct answer, new version of the Xcode no longer generates wildcards in the entitlements (located in the build folder's appname.app.xcent), the fastest way to make the installation works would be edit the xcent file directly after Xcode generate it, or codesign manually with --entitlements as the above answer – Horta

Answer 4

An Application Identifier consists of your Bundle ID, e.g. com.company.app as well as your TeamID as a prefix. Combined, the ApplicationID might be something like this: FEG63bFE.com.company.app. When transferring an app, your Bundle ID stays the same, however, your TeamID does change, resulting in a different Application Identifier. Therefore, the new version with the Application Identifier and the old version can not be matched.

To solve this problem, there are two steps to follow:

1. Add a previous-application-identifiers entitlement to a code signing entitlements file for your app.

2. Request a special provisioning profile from Developer Programs that will also contain the above entitlement. Make this request through the Developer Contact page > Membership > Enrollment and Account > Apple Developer Program Support form.

Please see the official Apple Developer Documentation on this topic.

Please see this official Apple Developer Tech Note for more information as well as a detailed step by step solution.

Metrist