CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

apple signing: App Group association fails early under automatic signing too (API capability + newest profile, steps and deep link, exit before the archive); console plan/verify apple-app-group

Browse source
This commit is contained in:
CRTkafa 2026-10-25 22:34:14 +07:00
parent d978bb7a8b
commit 304407e523
20 changed files with 590 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

7
skills/build-and-sign/SKILL.md
View file

@ -19,7 +19,7 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
1. **Read.** `storebound apple signing status`: is the bundle id registered (else `storebound apple bundle`), which
capabilities it has vs `apple.signing.capabilities`, the distribution certificates of the team and whether this
Mac holds a private key for one (a key file in `.storebound/signing/` or an identity in the keychain), App Store
profiles per bundle id (the app and every extension / widget / watch app / App Clip found in the Xcode project, or `apple.signing.extensions`; `extraBundleIds` adds more) and whether Xcode has them installed. `signing ensure` registers the extensions' bundle ids, enables the capabilities their entitlements need and (manual style) makes their profiles; an App Group the profile lacks is reported with the developer portal link and steps (the API cannot assign a group; then `signing ensure --refresh-profile`, store-pitfalls 121).
profiles per bundle id (the app and every extension / widget / watch app / App Clip found in the Xcode project, or `apple.signing.extensions`; `extraBundleIds` adds more) and whether Xcode has them installed. `signing ensure` registers the extensions' bundle ids, enables the capabilities their entitlements need and (manual style) makes their profiles; an App Group not proven on the App ID (manual: the profile; automatic: the capability and the newest profile the API lists) is reported with the developer portal link and steps (the API cannot assign a group): `storebound console plan apple-app-group --bundle-id <id> --lookup`, drive it, then `signing ensure --refresh-profile` and `console verify apple-app-group` (store-pitfalls 121).
It also compares three places a capability must be and names what is missing where: the App ID, the config's
`apple.signing.capabilities` and the iOS project's `.entitlements` (`aps-environment` = PUSH_NOTIFICATIONS,
`com.apple.developer.game-center` = GAME_CENTER, associated domains, Sign in with Apple, iCloud, app groups, ...;
@ -61,8 +61,9 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
`apple build` stops first and names the fixes. `STOREBOUND_KEYCHAIN_PASSWORD=... storebound apple build
--keychain-unlock` unlocks the login keychain and sets its key partition list (the password is read from the
environment and never printed); `--keychain <path>` signs with a build keychain (`--keychain <path> --keychain-unlock`
unlocks that one; `signing ensure --keychain <path>` imports the key + certificate into it). With manual signing it
also stops when a target's App Group is missing from its installed profile (store-pitfalls 121).
unlocks that one; `signing ensure --keychain <path>` imports the key + certificate into it). It
also stops before the archive when a target's App Group is missing (manual: its installed profile; automatic: the profile
the API lists; store-pitfalls 121; `--allow-app-group-gap` overrides).
- Capacitor: the archive ships the web assets `npx cap sync` copied last. Set `build.prebuild` (e.g.
`"npm run build && npx cap sync"`; per store `apple.prebuild` / `play.prebuild`) and `apple build` / `play build`
run it first (once per `flow run`; `--no-prebuild` skips it). Then the copied `public/index.html` must be newer