Resurrecting an old thread, as this doesn't seem to be how it works, at least not nowadays.
% unzip MyApp.ipa
% codesign -d --entitlements :- Payload/MyApp.app
...
<key>get-task-allow</key>
<false/>
...
If I save the entitlements to a file:
% unzip MyApp.ipa
% codesign -d --entitlements entitlements.plist Payload/MyApp.app
and just flip the value of the get-task-allow flag and then resign:
% codesign --entitlements entitlements.plist -s "iPhone Distribution" -f Payload/MyApp.app
Payload/MyApp.app: replacing existing signature
and then install the app I get:
WARNING: could not locate iTunesMetadata.plist in archive!
WARNING: could not locate Payload/Tester.app/SC_Info/Tester.sinf in archive!
Copying 'MyApp.ipa' to device... DONE.
Installing 'com.....'
Install: CreatingStagingDirectory (5%)
Install: ExtractingPackage (15%)
Install: InspectingPackage (20%)
Install: TakingInstallLock (20%)
Install: PreflightingApplication (30%)
Install: InstallingEmbeddedProfile (30%)
Install: VerifyingApplication (40%)ERROR: Install failed. Got error "ApplicationVerificationFailed" with code 0xe8008016: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.AmySH8/extracted/Payload/MyApp.app : 0xe8008016 (The executable was signed with invalid entitlements.)
If I don't change anything in entitlements.plist but just resign with the same entitlements then the app installs ok, but can not be started via USB. So, it's not possible to flip the flag and resign. My understanding is that somehow the get-task-allow entitlement must be present in the provisioning profile, but I have not found out any way to actually make this happen.
Any ideas for what I can do?