-
Bug
-
Resolution: Not A Defect
-
Blocker
-
Jenkins on a Linux server
Build environment Mac Mini OS X Yosemite xCode 6.1
When providing data for code signing inside the xCode plugin the code generated for running the code signing command does not work anymore
Output of failed attempt:
-
-
- Codesigning '/Users/Jenkins/Library/MobileDevice/Provisioning Profiles/539ad1e3-561a-417a-a1da-8b71fdd6ad5e.mobileprovision' with 'iPhone Distribution: Siemens Enterprise Communications, Inc.'
+ /usr/bin/codesign --force --preserve-metadata=identifier,entitlements,resource-rules --sign iPhone Distribution: Siemens Enterprise Communications, Inc. --resource-rules=/var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app/ResourceRules.plist --entitlements /var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/entitlements_plistiUnWRfKz /var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app
Program /usr/bin/codesign returned 1 : [Warning: usage of --preserve-metadata with option "resource-rules" (deprecated in Mac OS X >= 10.10)!
Warning: --resource-rules has been deprecated in Mac OS X >= 10.10!
/var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app/ResourceRules.plist: cannot read resources
]
error: /usr/bin/codesign --force --preserve-metadata=identifier,entitlements,resource-rules --sign iPhone Distribution: Siemens Enterprise Communications, Inc. --resource-rules=/var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app/ResourceRules.plist --entitlements /var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/entitlements_plistiUnWRfKz /var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app failed with error 1. Output: Warning: usage of --preserve-metadata with option "resource-rules" (deprecated in Mac OS X >= 10.10)!
Warning: --resource-rules has been deprecated in Mac OS X >= 10.10!
/var/folders/x1/vl7zqkh90txfhkgwhm8stb640000gp/T/gHLl76ymfc/Payload/ansible.app/ResourceRules.plist: cannot read resources
- Codesigning '/Users/Jenkins/Library/MobileDevice/Provisioning Profiles/539ad1e3-561a-417a-a1da-8b71fdd6ad5e.mobileprovision' with 'iPhone Distribution: Siemens Enterprise Communications, Inc.'
-
Failed to build
Output when no data is given (luckily there is only one profile):
CodeSign /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/InstallationBuildProductsLocation/Applications/ansible.app
cd /Users/jenkins/Ansible/mobileclient/ios
export CODESIGN_ALLOCATE=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
export PATH="/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin:/Applications/Xcode.app/Contents/Developer/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/apache-maven/apache-maven-3.0.5/bin"
Signing Identity: "iPhone Distribution: Siemens Enterprise Communications, Inc."
Provisioning Profile: "OSMO Internal 2013"
(539ad1e3-561a-417a-a1da-8b71fdd6ad5e)
/usr/bin/codesign --force --sign F25A1E6F9A4774208A8C590C1953493BDEE6F005 --entitlements /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/IntermediateBuildFilesPath/ansible.build/Distribution-iphoneos/ansible.build/ansible.app.xcent /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/InstallationBuildProductsLocation/Applications/ansible.app
Validate /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/InstallationBuildProductsLocation/Applications/ansible.app
cd /Users/jenkins/Ansible/mobileclient/ios
export PATH="/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin:/Applications/Xcode.app/Contents/Developer/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/apache-maven/apache-maven-3.0.5/bin"
export PRODUCT_TYPE=com.apple.product-type.application
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/Validation /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/InstallationBuildProductsLocation/Applications/ansible.app
Touch /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/BuildProductsPath/Distribution-iphoneos/ansible.app.dSYM
cd /Users/jenkins/Ansible/mobileclient/ios
export PATH="/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/usr/bin:/Applications/Xcode.app/Contents/Developer/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/apache-maven/apache-maven-3.0.5/bin"
/usr/bin/touch -c /Users/jenkins/Library/Developer/Xcode/DerivedData/iEvo-enwhqohbbpcykjfzpnndatwaxwkd/ArchiveIntermediates/ansible/BuildProductsPath/Distribution-iphoneos/ansible.app.dSYM
-
- ARCHIVE SUCCEEDED **
[JENKINS-25433] Xcodebuild sigining fails
Matan Eine
added a comment - It's not related with jenkins plugin at all. Same error happens with xcrun -sdk iphoneos PackageApplication. Jenkins just calling this command line as a build step.
http://stackoverflow.com/questions/26464577/jenkins-vs-xcode-plugin-codesign-troubles
Matan Eine
added a comment - It's not related with jenkins plugin at all. Same error happens with xcrun -sdk iphoneos PackageApplication. Jenkins just calling this command line as a build step.
http://stackoverflow.com/questions/26464577/jenkins-vs-xcode-plugin-codesign-troubles 
Reinhard Karbas
added a comment - I do not agree to close this issue as not being a bug
Fact is that xcodesigning is called with a deprecated parameter and Apple listing in their TN that apps with a resource plist in them will be rejected
We worked our way around now by creating a separate configuration to pull in the correct signing certificate without having to enter it in the xcode plugin
However the plugin needs to be fixed to run codesigning without the resource rules
Reinhard Karbas
added a comment - I do not agree to close this issue as not being a bug
Fact is that xcodesigning is called with a deprecated parameter and Apple listing in their TN that apps with a resource plist in them will be rejected
We worked our way around now by creating a separate configuration to pull in the correct signing certificate without having to enter it in the xcode plugin
However the plugin needs to be fixed to run codesigning without the resource rules 
Michael Schiestl
added a comment - I can confirm the exact same problem that suddenly popped up without any changes to the build pipeline on our side. Maybe some MacOS update caused this, I don't know.
Please someone fix this issue! Maybe removing the "resource-rules" parameters solves it.
Does anyone have a workaround until this bug is fixed?
Michael Schiestl
added a comment - I can confirm the exact same problem that suddenly popped up without any changes to the build pipeline on our side. Maybe some MacOS update caused this, I don't know.
Please someone fix this issue! Maybe removing the "resource-rules" parameters solves it.
Does anyone have a workaround until this bug is fixed? Same issue on OS X Yosemite (v10.10.1). As Michael said, it is a matter of removing --resource-rules parameter. This works when invoked on the command line, but fails including the resource-rules parts:
/usr/bin/codesign --force --preserve-metadata=identifier,entitlements --sign "..." --entitlements /var/... /var/.../Demo.app
I can also verify the suggested fix worked for me: http://stackoverflow.com/questions/26464577/jenkins-vs-xcode-plugin-codesign-troubles
Matt Cudmore
added a comment - - edited Same issue on OS X Yosemite (v10.10.1). As Michael said, it is a matter of removing --resource-rules parameter. This works when invoked on the command line, but fails including the resource-rules parts:
/usr/bin/codesign --force --preserve-metadata=identifier,entitlements --sign "..." --entitlements /var/... /var/.../Demo.app
I can also verify the suggested fix worked for me: http://stackoverflow.com/questions/26464577/jenkins-vs-xcode-plugin-codesign-troubles 
lacostej
added a comment - Hello everyone. As explained by Matan, jenkins kust calls the xcrun command and never invokes the xcodesign command directly.
If the xcrun command is obsolete or needs adjustement for Yosemite, I would love to get some insight into what is required to run the command properly. I don't have a Yosemite running server with xcode 6.1 yet in place.
lacostej
added a comment - Hello everyone. As explained by Matan, jenkins kust calls the xcrun command and never invokes the xcodesign command directly.
If the xcrun command is obsolete or needs adjustement for Yosemite, I would love to get some insight into what is required to run the command properly. I don't have a Yosemite running server with xcode 6.1 yet in place. lacostej
added a comment - I managed to reproduce it, without yosemite.
It's a xcrun bug. The proper workaround right now is to add
"CODE_SIGN_RESOURCE_RULES_PATH=$(SDKROOT)/ResourceRules.plist"
to your custom build arguments.
See http://stackoverflow.com/questions/26516442/how-do-we-manually-fix-resourcerules-plist-cannot-read-resources-error-after for details
Some more background info: http://stackoverflow.com/questions/26497863/xcode-6-1-error-while-building-ipa-using-testflight-app/26499526#26499526
lacostej
added a comment - I managed to reproduce it, without yosemite.
It's a xcrun bug. The proper workaround right now is to add
"CODE_SIGN_RESOURCE_RULES_PATH=$(SDKROOT)/ResourceRules.plist"
to your custom build arguments.
See http://stackoverflow.com/questions/26516442/how-do-we-manually-fix-resourcerules-plist-cannot-read-resources-error-after for details
Some more background info: http://stackoverflow.com/questions/26497863/xcode-6-1-error-while-building-ipa-using-testflight-app/26499526#26499526 Reinhard Karbas
added a comment - Actually the only proper fix would be the third reply in the last link:
http://stackoverflow.com/questions/26497863/xcode-6-1-error-while-building-ipa-using-testflight-app/26499526#26499526
Officially the resource rules are deprecated and I have seen another post where Apple has rejected a submission because of the included resource rules
Reinhard Karbas
added a comment - Actually the only proper fix would be the third reply in the last link:
http://stackoverflow.com/questions/26497863/xcode-6-1-error-while-building-ipa-using-testflight-app/26499526#26499526
Officially the resource rules are deprecated and I have seen another post where Apple has rejected a submission because of the included resource rules lacostej
added a comment - @Reinhard, you're right...
WRT rejection, I've found: "Do not use the --resource-rules flag or ResourceRules.plist. They have been obsoleted and will be rejected." under https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205
That's bad. I reported Apple bug #19384243
lacostej
added a comment - @Reinhard, you're right...
WRT rejection, I've found: "Do not use the --resource-rules flag or ResourceRules.plist. They have been obsoleted and will be rejected." under https://developer.apple.com/library/mac/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG205
That's bad. I reported Apple bug #19384243 lacostej
added a comment - Not a bug in jenkins, but in xcrun. We could detect from the output that xcode is buggy, and add a jenkins specific warning message. Any other idea ?
lacostej
added a comment - Not a bug in jenkins, but in xcrun. We could detect from the output that xcode is buggy, and add a jenkins specific warning message. Any other idea ? 
It's not related with jenkins plugin at all. Same error happens with xcrun -sdk iphoneos PackageApplication. Jenkins just calling this command line as a build step.
http://stackoverflow.com/questions/26464577/jenkins-vs-xcode-plugin-codesign-troubles