Signing iOS apps

How to set up iOS code signing in codemagic.yaml

All iOS applications have to be digitally signed before they can be installed on real devices or made available to the public.

Managing and uploading files

Team owner permissions are required to upload and edit files under the Code signing identities section. However, all team members can view the file info for any of the uploaded files.

Creating the App Store Connect API key

Signing iOS applications requires Apple Developer Program membership.

It is recommended to create a dedicated App Store Connect API key for Codemagic in App Store Connect. To do so:

1. Log in to App Store Connect and navigate to Users and Access > Keys.
2. Click on the + sign to generate a new API key.
3. Enter the name for the key and select an access level. We recommend choosing App Manager access rights, read more about Apple Developer Program role permissions here.
4. Click Generate.
5. As soon as the key is generated, you can see it added to the list of active keys. Click Download API Key to save the private key for later. Note that the key can only be downloaded once.

Adding the App Store Connect API key to Codemagic

1. Open your Codemagic Team settings, go to Team integrations > Developer Portal > Manage keys.
2. Click the Add key button.
3. Enter the App Store Connect API key name. This is a human readable name for the key that will be used to refer to the key later in application settings.
4. Enter the Issuer ID and Key ID values.
5. Click on Choose a .p8 file or drag the file to upload the App Store Connect API key downloaded earlier.
6. Click Save.

Adding the Code signing certificate

Codemagic lets you upload code signing certificates as PKCS#12 archives containing both the certificate and the private key which is needed to use it. When uploading, Codemagic will ask you to provide the certificate password (if the certificate is password-protected) along with a unique Reference name, which can then be used in the codemagic.yaml configuration to fetch the specific file.

• Upload certificate
• Generate new certificate
• Fetch from Developer Portal

There is a problem with the request entity - You already have a current Distribution certificate or a pending certificate request.

Adding the provisioning profile

Codemagic allows you to upload a provisioning profile to be used for the application or to fetch a profile from the Apple Developer Portal.

The profile’s type, team, bundle id, and expiration date are displayed for each profile added to Code signing identities. Furthermore, Codemagic will let you know whether a matching code signing certificate is available in Code signing identities (a green checkmark in the Certificate field) or not.

• Upload a profile
• Fetch from Developer Portal

Referencing certificates and profiles in codemagic.yaml

Codemagic provides two means of fetching the required certificates and provisioning profiles during the build with the use of codemagic.yaml. Fetching can either be configured by specifying the distribution type and bundle identifier, or for more advanced use-cases, individual files can be fetched by their reference names.

Fetching files by distribution type and bundle identifier

To fetch all uploaded signing files matching a specific distribution type and bundle identifier during the build, define the distribution_type and bundle_identifier fields in your codemagic.yaml configuration. Note that it is necessary to configure both of the fields.

workflows:
  ios-workflow:
    name: iOS Workflow 
    # ....
    environment:
      ios_signing:
        distribution_type: app_store # or: ad_hoc | development | enterprise
        bundle_identifier: com.example.id

Note that when using the fields distribution_type and bundle_identifier, it is not allowed to configure provisioning_profiles and certificates fields.

When defining the bundle identifier com.example.id, Codemagic will fetch any uploaded certificates and profiles matching the extensions as well (e.g. com.example.id.NotificationService).

Fetching specific files by reference names

For a more advanced configuration, it is possible to pick out specific uploaded profiles and certificates for Codemagic to fetch during the build. To do so, list the references of the uploaded files under the provisioning_profiles and certificates fields, respectively. Note than when fetching individual files, the fields distribution_type and bundle_identifier are not allowed.

Steps Initialize keychain & Add certificates to keychain scripts are not required as those are automatically fetched during the build process.

workflows:
  ios-workflow:
    name: iOS Workflow
    
    # ....
    
    environment:
      ios_signing:
        provisioning_profiles:
          - profile_reference
          # - ...
        certificates:
          - certificate_reference
          # - ...

Codemagic saves the files to the following locations on the build machine:

• Profiles: ~/Library/MobileDevice/Provisioning Profiles
• Certificates: ~/Library/MobileDevice/Certificates

It is additionally possible to include names for environment variables that will point to the file paths on the build machine.

workflows:
  ios-workflow:
    name: iOS Workflow
    
    # ....
    
    environment:
      ios_signing:
        provisioning_profiles:
          - profile: profile_reference
            environment_variable: THIS_PROFILE_PATH_ON_DISK
          # - ...
        certificates:
          - certificate: certificate_reference
            environment_variable: THIS_CERTIFICATE_PATH_ON_DISK
          # - ...

Using provisioning profiles

To apply the profiles to your project during the build, add the following script before your build scripts:

  scripts:
    # ... your dependencies installation
    
    - name: Set up code signing settings on Xcode project
      script: xcode-project use-profiles
    
    # ... your build commands