On our CI (GitHub Actions) we are signing our .ipa with codesign and after that uploads the resulting .ipa with altool to TestFligt. The problem is that the entitlements added by codesign no longer appear when we view the build on TestFlight. The app requires entitlements for push notification and for associated domains. codesign -s Distribution prod.entitlements prod.ipa Immediately after we do a codesign --verbose --display --entitlements - and the entitlements show fine. Next command is xcrun altool --upload-app --type ios -f prod.ipa --apiKey $api_key_id --apiIssuer $appstore_api_key_issuer To us it seems like altool strips the entitlements from the .ipa. What are we doing wrong?

We have an iOS project that is configured with automatically managed signing. We cannot get automatic signing to work on our CI (GitHub Actions). To even get xcodebuild to archive we have to force it to not sign at all: xcrun xcodebuild \ -workspace app.xcworkspace \ -scheme prod \ -configuration 'Release' \ -destination generic/platform=iOS \ -archivePath ./build/prod.xcarchive \ CODE_SIGN_IDENTITY="" \ CODE_SIGNING_REQUIRED=NO \ CODE_SIGNING_ALLOWED=NO \ clean archive All our attempts to make xcodebuild archive do manual signing have failed. In order to have the app properly signed with the right entitlements we then call codesign: codesign -f \ -s Distribution \ --entitlements prod.entitlements \ ./build/prod.xcarchive/Products/Applications/prod.app Then we export the ipa: xcrun xcodebuild \ -exportArchive \ -archivePath ./build \ -exportOptionsPlist exportOptions.plist \ -exportPath ./build This seems to work so my question is: Is it supported to do manual signing this way? Is there a better way? If we omit the codesign step, the app will still be signed - by exportArchive we assume, but then the entitlements are missing.