Carthage: Code sign issue with Xcode 11

[gregorpichler]

• carthage install method: [ ] .pkg, [x] homebrew, [ ] source
• which carthage: /usr/local/bin/carthage
• carthage version: 0.33.0
• xcodebuild -version: Xcode 11.0 Build version 11A419c
• Are you using --no-build? NO
• Are you using --no-use-binaries? YES
• Are you using --use-submodules? NO
• Are you using --cache-builds? NO
• Are you using --new-resolver? NO

Cartfile

github "mixpanel/mixpanel-swift"
github "onevcat/Kingfisher" ~> 5.0
github "Moya/Moya" ~> 14.0.0-beta.1
github "BranchMetrics/ios-branch-deep-linking"
binary "https://raw.githubusercontent.com/smooch/smooch-ios/master/Smooch.json"
github "Butleroy/JTAppleCalendar" "custom-7.1.7"
github "bugsnag/bugsnag-cocoa"
github "swiftcsv/SwiftCSV"
github "airbnb/lottie-ios" "master"
github "Butleroy/JZCalendarWeekView" "master"

Carthage Output

*** Fetching Kingfisher
*** Fetching JTAppleCalendar
*** Fetching lottie-ios
*** Fetching JZCalendarWeekView
*** Downloading binary-only framework Smooch at "https://raw.githubusercontent.com/smooch/smooch-ios/master/Smooch.json"
*** Fetching SwiftCSV
*** Fetching bugsnag-cocoa
*** Fetching Moya
*** Fetching ios-branch-deep-linking
*** Fetching mixpanel-swift
*** Fetching ReactiveSwift
*** Fetching RxSwift
*** Checking out RxSwift at "5.0.1"
*** Checking out Kingfisher at "5.7.1"
*** Checking out Moya at "14.0.0-beta.2"
*** Checking out JZCalendarWeekView at "d9dbfb4b3049ea91374f11ceed92c7c9b8610a50"
*** Checking out ios-branch-deep-linking at "0.28.1"
*** Checking out Alamofire at "5.0.0-rc.2"
*** Checking out bugsnag-cocoa at "v5.22.5"
*** Checking out SwiftCSV at "0.5.5"
*** Checking out mixpanel-swift at "v2.6.5"
*** Checking out ReactiveSwift at "6.1.0"
*** Checking out lottie-ios at "1f9149acac1d349ed3e6b3a82cd63c9d9b2d85ae"
*** Checking out JTAppleCalendar at "9893a41ef50912a6dc788cbf8e64ff3579ac722a"
*** xcodebuild output can be found in /var/folders/yc/lt8j2py53jz67ghncgdg5h8w0000gn/T/carthage-xcodebuild.bPOfnv.log
*** Downloading binary-only framework Smooch at "https://raw.githubusercontent.com/smooch/smooch-ios/master/Smooch.json"
*** Building scheme "Alamofire iOS" in Alamofire.xcworkspace
*** Building scheme "Bugsnag" in iOS.xcworkspace
*** Building scheme "Branch iOS SDK Carthage" in TestBed-Swift.xcworkspace
*** Building scheme "JTAppleCalendar iOS" in JTAppleCalendar.xcworkspace
*** Building scheme "JZCalendarWeekView" in JZCalendarWeekView.xcodeproj
*** Building scheme "Kingfisher" in Kingfisher.xcworkspace
*** Building scheme "Lottie_iOS" in Lottie.xcodeproj
*** Building scheme "Mixpanel" in MixpanelDemo.xcworkspace
*** Building scheme "ReactiveSwift-iOS" in ReactiveSwift.xcworkspace
*** Building scheme "RxBlocking" in Rx.xcworkspace
*** Building scheme "RxRelay" in Rx.xcworkspace
*** Building scheme "RxCocoa" in Rx.xcworkspace
*** Building scheme "RxSwift" in Rx.xcworkspace
*** Building scheme "RxTest" in Rx.xcworkspace
*** Building scheme "Moya" in Moya.xcodeproj
*** Building scheme "ReactiveMoya" in Moya.xcodeproj
*** Building scheme "RxMoya" in Moya.xcodeproj
*** Building scheme "SwiftCSV-iOS" in SwiftCSV.xcodeproj

Additionally when using --verbose I can see that there is no "Code signing identity":

Build settings from command line:
    CARTHAGE = YES
    CLANG_ENABLE_CODE_COVERAGE = NO
    CODE_SIGN_IDENTITY = 
    CODE_SIGNING_REQUIRED = NO
    GCC_INSTRUMENT_PROGRAM_FLOW_ARCS = NO
    ONLY_ACTIVE_ARCH = NO
    SDKROOT = iphoneos13.0
    SKIP_INSTALL = YES
    STRIP_INSTALLED_PRODUCT = NO

Actual outcome
Everything worked as expected and Carthage built the necessary frameworks.

Expected outcome
However when trying to upload the app to App Store Connect I always get the error "Code signing Alamofire.framework failed". I assume that Alamofire is just the first framework and immediately throws this error. When using Cocoapods I don't have any signing issues with App Store Connect.

[tmspzz]

Code signing happens when copy-fameworks is called: https://github.com/Carthage/Carthage/blob/fc0166b4827736bac2c804fc928797f1a742c455/Source/carthage/CopyFrameworks.swift#L49

Do you have a copy-framework phase?

Alamofire for one, doesn't specify a code signing identity

[gregorpichler]

Thanks for your quick answer. Yes, I do have a copy-framework phase. It looks like that:

[tmspzz]

The code signing identity is taken from these env variables: https://github.com/Carthage/Carthage/blob/fc0166b4827736bac2c804fc928797f1a742c455/Source/carthage/CopyFrameworks.swift#L104

[gregorpichler]

When looking at the IDEDistributionPipeline.log file I see a message "code object is not signed at all"

2019-09-11 13:19:11 +0000  /var/folders/yc/lt8j2py53jz67ghncgdg5h8w0000gn/T/XcodeDistPipeline.~~~KbjFIy/Root/Payload/Butleroy.app/Frameworks/Alamofire.framework: replacing existing signature
2019-09-11 13:19:11 +0000  /var/folders/yc/lt8j2py53jz67ghncgdg5h8w0000gn/T/XcodeDistPipeline.~~~KbjFIy/Root/Payload/Butleroy.app/Frameworks/Alamofire.framework: code object is not signed at all
2019-09-11 13:19:11 +0000  /usr/bin/codesign exited with 1

As far as I understand it, it's correct that the framework is not code signed by the developer as it has to be signed by me (who is using the framework).

Maybe this issue is related to nested frameworks as Alamofire is actually a dependency of Moya?

[tmspzz]

You understand correctly.
It shouldn't be an issue with Alamofire being a transitive dependency.

Are the other frameworks signed?

[gregorpichler]

It seems like it immediately stops with the first framework, which is always Alamofire.

[gregorpichler]

I just integrated Moya with Swift Package Manager so this framework is working fine now. However all others are integrated with Carthage and it now stops with the same error for the next framework (in this case Bugsnag).

[tmspzz]

Do EXPANDED_CODE_SIGN_IDENTITY or CODE_SIGNING_ALLOWED in your build log have any value?

[gregorpichler]

This is what I can find when running carthage update --platform iOS --verbose

export EXPANDED_CODE_SIGN_IDENTITY=-
export CODE_SIGNING_ALLOWED=YES

[tmspzz]

so you don't have a codesigning identity set. That explains it.

try running

security find-identity -p codesigning

[gregorpichler]

Thanks for pointing that out. When running this command it get a list of a couple of valid identities. Do you want me to look for something specific? I can confirm that the "iPhone Distribution: Butleroy GmbH (XXX)" is there. That should be the certificate to sign for the App Store.

We also tried to run carthage on other machines and we had this issue on all of our development devices.

[tmspzz]

I don't think this is related to Carthage but rather to the Xcode11 beta you're using.

Do you see in the log from carthage-copy frameworks any other variable that carries the code signing identity?

[gregorpichler]

Yeah, I think you are right. Maybe carthage can't find the right code signing identity.

Sorry for the dumb question but where can I find the log from copy-frameworks? In the console output I get with --verbose I can't find any hint of the code signing identity.

[tmspzz]

copy-frameworks MUST be run as part of a build phase. You can find the log by looking at the build phase's log.

[gregorpichler]

Does code signing happen during "carthage update" or later when building the project? I'm still not sure what you exactly mean with "build phase's log" and where I can find them.

The copy-frameworks script is inside the Xcode project as a run script phase.

Where does carthage get the EXPANDED_CODE_SIGN_IDENTITY from?

[tmspzz]

the code signing happens later when building the project.

The copy-frameworks script is inside the Xcode project as a run script phase

check the log for that phase

[gregorpichler]

Thanks for your screenshots, I could finally find the log files :)

export EXPANDED_CODE_SIGN_IDENTITY=427DA09935DC6D9A85119470A7BFB6EXXXXXXXX
export EXPANDED_CODE_SIGN_IDENTITY_NAME="Apple Development: NAME (TEAMID)"

I'm not sure if "Apple Development" is correct? Shouldn't it be "Apple Distribution"?

[tmspzz]

I'm assuming you're uploading to the store, so I'm guessing yes.

[gregorpichler]

That's correct, I'm trying to upload to the App Store. I also have "automatically sign" on.

[tmspzz]

Seems to be it should be "Apple Distribution"

[gregorpichler]

Is there any way I can change that for carthage copy-frameworks?

[tmspzz]

That is taken from your project’s setting. You have automatically sign and it’s probably not working. Carthage doesn’t have anything to do with that.

[gregorpichler]

Thanks for your patience and your helpful hints. I now switched to manual code signing and the properties are now correct. They are:

export EXPANDED_CODE_SIGN_IDENTITY_NAME="Apple Distribution: Company Name (TEAMID)"
export CODE_SIGN_IDENTITY="iPhone Distribution"

The error still occurs and the weird thing is that I only have that problem when integrating these dependencies via carthage (cocoapods and SPM work fine)

[tmspzz]

Both SPM and Cocoapods modify your project file. Carthage doesn't.

[Dave-Casey]

@gregorpichler did you ever resolve this issue? I'm having the exact same issue.

[gregorpichler]

@Dave-Casey We had to switch back to Cocoapods. As we are also using "Catalyst" to run the iPad app on macOS we had to move away from Carthage.

[thejeff77]

Under Target-> [AppName] -> General -> "Frameworks, Libraries and Embedded Content"

Select "Do Not Embed" for the option next to the problematic framework.

And make sure it is in the copy frameworks phase.

This works for me.

[GuoJing]

Under Target-> [AppName] -> General -> "Frameworks, Libraries and Embedded Content"

Select "Do Not Embed" for the option next to the problematic framework.

And make sure it is in the copy frameworks phase.

This works for me.

This is the solution. Thanks!

[helloandrewpark]

I ran into the same problem with Xcode 12.1 (12A7403) and had valid values for EXPANDED_CODE_SIGN_IDENTITY_NAME and CODE_SIGNING_ALLOWED. Also did the Xcode 12 workaround but still had no luck. What ended up working for me was removing/deleting the framework and all references to it (Navigator, Build Phase - Run Script, Input files, output files) and then re-adding it.

[ARGAMX]

Under Target-> [AppName] -> General -> "Frameworks, Libraries and Embedded Content"

Select "Do Not Embed" for the option next to the problematic framework.

And make sure it is in the copy frameworks phase.

This works for me.

This solution work for me only after I listed all frameworks in "Input Files" (was not obvious from text)

https://i.stack.imgur.com/xMW8X.png