2

I'm trying to set up an Azure DevOps pipeline to build a macOS app. I think I have all the necessary steps in place, and it runs as far as I expect it to for now.

However, I now have reached the step where, in order to sign the product, the build machine device must be included in our provisioning profiles, which means we have to add its UUID to the list of devices in Apple Developer.

Two errors dictating that the profile doesn't include the device

How do I get this pipeline to use this profile? I imagine a solution might involve one of these:

  • There's a way to find the UUIDs of every Mac which might run the pipeline
  • There's a way to restrict that pipeline to always use the same Mac with the same UUID
  • There's a way to specify/spoof the UUID of the build machine
  • There's an API or something to register the build machine with Apple Developer at build time
  • Azure DevOps has a special way to circumvent this part of the build process while still allowing signing
  • Apple has some special way I don't know about to allow an arbitrary build machine to sign without knowing its UUID beforehand

I've looked around for all these and can't find definitive info for any of them. Does anyone know the best practice for signing an Xcode project pipeline in Azure DevOps using a specific set of provisioning profiles?


Our certs and profiles are stored in Azure's "Secure files" section:

Two <code>p12</code> and four <code>provisionprofile</code> files in Azure's "Secure files" section

And referenced in the pipeline's build steps:

Several Xcode steps in Azure. The selected one is "Install provisioning profile" where one of the above-shown provisioning profiles is installed to the build machine.

1 Answer 1

1

These steps in the Azure DevOps docs may be helpful: Sign Your Mobile App.

Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building. No UUID should be needed for the agent. Here's a guide that may be useful (it's targeting iOS, not macOS but the concept is the same).

The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: Deploy Documentation.

5
  • This is very nice to know, but I don't see where it shows how to get past the problem I'm having
    – Ky -
    Commented Sep 23, 2019 at 21:30
  • Sorry about that! I updated the answer to hopefully clarify why those links should be more useful to answering your question. Commented Sep 24, 2019 at 2:16
  • Thank you very much for your continued assistance. I've already done that, which is why the output in my screenshot names and shames the profiles instead of saying they're missing. The problem is that, AFAIK, when building for macOS, the certificates need to include the UUID of the machine which is using them to do the signing
    – Ky -
    Commented Sep 24, 2019 at 14:21
  • When you install the p12 key and the profile on the mac build agent it should have what it needs to sign it's UUID into the provisioning profile. Do you have the P12 key in addition to the profile? Commented Sep 24, 2019 at 14:28
  • Our provisioning profile is generated on Apple's servers. AFAIK, it's cryptographically bound to its contents so it can't be modified on-the-fly; I'd have to update it on Apple's servers and re-download it every time I want to provision a new machine. So, I can't add the build machine's UUID to the profile at build time if I understand this correctly. I've put both development and distribution p12 and provisionprofile files in Azure (I've added screenshots to my question to confirm). Thank you so much for continuing to try to resolve my confusion
    – Ky -
    Commented Sep 24, 2019 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.