What worked for me was adding the --entitlements argument into codesign command: codesign -vvv --options=runtime --entitlements <path_to_your_entitlements> --force --timestamp --deep [...]

After reaching to this answer on StackOverflow I could figure out what was happening. The problem was in xcodebuild -exportArchive command, where an exportPath is required. I was passing the whole package name to this argument, like this: xcodebuild -exportArchive [...] -exportPath mypackage.pkg That would create a folder named mypackage.pkg and then export the actual .pkg inside of it. So in the next command where I validate the app, I was actually validating the folder that contains the package, not the package itself. Finally, to solve the problem I replaced the command above by the following: xcodebuild -exportArchive [...] -exportPath .