2

I'm trying to set up an Azure DevOps pipeline to build a macOS app. I think I have all the necessary steps in place, and it runs as far as I expect it to for now.

However, I now have reached the step where, in order to sign the product, the build machine device must be included in our provisioning profiles, which means we have to add its UUID to the list of devices in Apple Developer.

Two errors dictating that the profile doesn't include the device

How do I get this pipeline to use this profile? I imagine a solution might involve one of these:

  • There's a way to find the UUIDs of every Mac which might run the pipeline
  • There's a way to restrict that pipeline to always use the same Mac with the same UUID
  • There's a way to specify/spoof the UUID of the build machine
  • There's an API or something to register the build machine with Apple Developer at build time
  • Azure DevOps has a special way to circumvent this part of the build process while still allowing signing
  • Apple has some special way I don't know about to allow an arbitrary build machine to sign without knowing its UUID beforehand

I've looked around for all these and can't find definitive info for any of them. Does anyone know the best practice for signing an Xcode project pipeline in Azure DevOps using a specific set of provisioning profiles?


Our certs and profiles are stored in Azure's "Secure files" section:

Two <code>p12</code> and four <code>provisionprofile</code> files in Azure's "Secure files" section

And referenced in the pipeline's build steps:

Several Xcode steps in Azure. The selected one is "Install provisioning profile" where one of the above-shown provisioning profiles is installed to the build machine.

1

These steps in the Azure DevOps docs may be helpful: Sign Your Mobile App.

Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building. No UUID should be needed for the agent. Here's a guide that may be useful (it's targeting iOS, not macOS but the concept is the same).

The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: Deploy Documentation.

| improve this answer | |
  • This is very nice to know, but I don't see where it shows how to get past the problem I'm having – Ben Leggiero Sep 23 '19 at 21:30
  • Sorry about that! I updated the answer to hopefully clarify why those links should be more useful to answering your question. – Wesley Rolnick Sep 24 '19 at 2:16
  • Thank you very much for your continued assistance. I've already done that, which is why the output in my screenshot names and shames the profiles instead of saying they're missing. The problem is that, AFAIK, when building for macOS, the certificates need to include the UUID of the machine which is using them to do the signing – Ben Leggiero Sep 24 '19 at 14:21
  • When you install the p12 key and the profile on the mac build agent it should have what it needs to sign it's UUID into the provisioning profile. Do you have the P12 key in addition to the profile? – Wesley Rolnick Sep 24 '19 at 14:28
  • Our provisioning profile is generated on Apple's servers. AFAIK, it's cryptographically bound to its contents so it can't be modified on-the-fly; I'd have to update it on Apple's servers and re-download it every time I want to provision a new machine. So, I can't add the build machine's UUID to the profile at build time if I understand this correctly. I've put both development and distribution p12 and provisionprofile files in Azure (I've added screenshots to my question to confirm). Thank you so much for continuing to try to resolve my confusion – Ben Leggiero Sep 24 '19 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.