(Self answering my question) So, for the first question, I've done number of experiments and found out that empty-signed archive can be exported, but cannot be deployed to the device. To correctly deploy the ipa(exported) file, the archived one should be signed using codesign command. And to do so, they should contain entitlements and codesign identity. codesign -s {IDENTITY} --entitlements {PATH_TO_ENTITLEMENTS_FILE} ... {PROJECT_PATH}/~~~/{NAME}.app For the second question, I couldn't find the answer, but using the strategy like empty-signing-archive -> codesign -> export can be the alternative.