25.1 · Code signing, provisioning and what each file is for
Signing is the chain of trust that lets a device run your code. Most signing problems are not mysterious once you know the four pieces and which one a given error is complaining about.
Mental model. A device runs an app only if an Apple-issued identity signed it and a profile that Apple signed says that identity, that App ID and those entitlements are allowed.
The chain of trust
Certificates, App IDs, profiles, and keeping all of it working on CI.
- How does iOS code signing work: certificates, App IDs, provisioning profiles, signing identities, export methods and signing on CI?
Four things work together. A signing certificate (Apple Development or Apple Distribution) proves who you are; its private key lives in a keychain on the…
Three different files
Capabilities, entitlements and Info.plist keys.
- What is the difference between a capability, an entitlement and an Info.plist key, and what breaks when they disagree?
They look similar and are easy to confuse, but they are different layers. A capability is something you switch on for the app: in Xcode’s Signing &…
More in App Store & release engineering
- 25.2 · CI/CD tools, versioning and designing the pipeline
- 25.3 · TestFlight, phased release, App Review and rollback
- 25.4 · Feature flags, remote config and the release train
- 25.5 · Backward-compatible change, deployment targets and device requirements
- 25.6 · Reading profiles and signatures, signing order and API keys
- 25.7 · What a build leaves behind: archives, binaries, dependencies and tests
- 25.8 · Pipelines that lie, build numbers, hotfix branches and rollout statistics