Broken Developer Certificates and Profiles

Question

I am extremely worried about my certificates/profiles and need help fixing the issue. I have my app in the Apple app store for iPhone, iPad, and Mac and have sent out multiple updates. I just recently updated my Xcode to Xcode 12 and can no longer send my Mac Catalyst version of the app to Apple's notary service and get these errors:

Cannot create a Mac Catalyst Developer ID provisioning profile for "<profile>".
The App Groups capability is not available for Mac Catalyst Developer ID provisioning profiles. Disable this feature and try again.

Provisioning profile failed qualification
Profile doesn't include the selected signing certificate.

Provisioning profile failed qualification
Profile doesn't support App Groups.

Before this point, I had not generated a new Developer ID profile since February and have had App Groups in my app for many months and sent out multiple updates and notaries with it. After tons of research, I saw that it maybe has something to do with my Developer ID Profile so I looked into it on the Apple developer website and saw that the status said invalid. I made a new one, removed the invalid one, and tried the steps of archiving a new build and trying to send it to Apple's notary but ended up getting the same error.

I have done more research and stumble upon https://developer.apple.com/support/certificates/ and saw that removing a profile may cause me to not update my current apps in the app store. Did I remove my entire access to update my apps???

I still can not figure out the notary issue and am now extremely worried that I have messed up my chances of updating my app again. Can you please help me with both issues?

I have a Mac update I would like to send out to the App Store as soon as possible but want to know if it's safe before sending it to users.

Answer 1

The problem here is that the App Groups entitlement is not available for MacOS as you can see when clicking the i on the Certificates, Identifiers & Profiles portal of your Apple Developer account.

Obviously you still want to use this for your iOS version of the app but it's not needed for the MacOS version. (Although the MacOS version can still use your app group, it doesn't need the entitlement).

To fix this, you need to use a different .entitlements file for your MacOS build to your iOS build.

Firstly, duplicate your current .entitlements file. The easiest way is to hold the Alt key while dragging the .entitlements file slightly. It will make a copy. Rename it to something like Original Name-MacOS.entitlements.

The next step is to open your Build Settings and type entitlements into the search bar.

You'll see your original entitlements file showing for both Debug and Release builds. Select the Debug row, then click the + button. Click on Any SDK and change it to Any macOS SDK. Now change the name of the entitlements file to your MacOS variant.

Repeat the process for the Release build so it looks like below.

The final step is to remove the offending entitlement from your MacOS .entitlements file. This has to be done manually as the Signing & Capabilities tab will only show the entitlements from your original iOS file. So click you MacOS .entitlements file and delete the App Groups entry.

Clean your project, Build & Run, Export etc.. and you should be good to go.

Answer 2

some users able to fix this by turning the App Groups capability off and on on all of my app target's on the Signing & Capabilities tab on Xcode.