App Ops Desk · Issue #8

Signing and provisioning chaos

Most mysterious archive failures are identity problems wearing a code-signing costume. Solo founders thrash when certificates, profiles, bundle IDs, and team IDs drift out of sync.

Read time: 7 min Signing Before archive Pairs with Issues #0 and #1

One action this week: Print your current signing identity into the release log once: team ID, bundle ID, certificate name, provisioning profile name/expiry, and whether automatic or manual signing is on.

The four identities that must agree

Apple team — the Team ID that owns the app
Bundle ID — exact App ID string in Connect and Xcode
Certificate — Apple Distribution (or Development for debug-only work)
Profile — provisioning profile matching team + bundle + cert + entitlements

If any one is wrong, Xcode will still sometimes almost work until archive or upload.

Common solo failure modes

Personal Team leftover on a shipping target
Automatic signing quietly switched teams after a login change
Expired distribution cert with a still-valid development cert
Profile missing a newly added capability (Push, Associated Domains, etc.)
CI using a different cert than the laptop that worked yesterday
Wildcard profile used where an explicit App ID is required

Pre-archive signing gate

Confirm the target’s Team matches the Connect app’s team
Confirm bundle ID matches the App Store Connect record exactly
For Release: Distribution certificate present and not expiring this week
Profile includes current entitlements
If manual signing: profile selected for Release, not Debug leftover
If automatic: no red capability errors in Signing & Capabilities

When to regenerate vs debug

Regenerate profiles when you added a capability or rotated certs. Debug first when the binary already archived last week and “nothing changed” — something did (team login, Xcode update, keychain, CI secret).

Release log snippet:
Team ID:
Bundle ID:
Signing: Automatic / Manual
Dist cert name / expiry:
Profile name / expiry:
Entitlements added since last good:

Ignore list

Deleting all certificates “to start clean” mid-release week
Switching between automatic and manual signing as a superstition fix
Uploading five more builds before recording team + bundle + profile

Bottom line

Signing failures are identity mismatches. Log team, bundle, cert, and profile before the archive. Fix the mismatch once; don’t thrash the binary.

Resources hub → Reading order and jump-by-symptom links. Join the App Ops Desk waitlist Weekly release ops for people who ship alone.