Apple App Store publish: ERROR ITMS-90161

[rebz]

Please, provide the details below:

Did you verify whether this issue has already been reported here?

Yes

Tell us about the problem

I saw a similar thread where this same topic was discussed. However, I am unable to move past it.

I've recreated my signing request, certs, and provision multiple times over.

Which platform(s) does the issue occur on?

iOS MacOS

Provide the following version numbers that the issue occurs with:

• NativeScript Sidekick: 1.16.2-v.2019.3.13.12
• NativeScript CLI: 5.4.0
• CLI extension nativescript-cloud: 1.17.4
• CLI extension nativescript-starter-kits: 0.3.5

Tell us how to recreate the issue in as much detail as possible

1. Start Sidekick, Select Project, Click Publish
2. Click config icon on App Store Deployment
3. Set Provisioning Profile and Certificate
4. Choose Local Build, Clean

Does this issue happen every time?

Yes

Send the client logs

https://gist.github.com/rebz/6f42559a2d5cdf2249273b3d1059cf8d

I noticed this line, below, near the start showing certs/provisions that do not exist on my machine. I'm wondering if it is attempting to send the incorrect certs/provision when building.

[19-05-24 22:09:54.230] (Info) ab.codeSigning.shell.codeSigningChanged - {"ios":{"all":{"certificate":"/Users/username/Desktop/apple dev account/2019-05-24-distribution.p12","provision":"/Users/username/Desktop/apple dev account/Living_Moments.mobileprovision"},"f1a92085bced1da534163dfb597f5596c1adb216":{"certificate":"/Users/username/Desktop/apple dev account/development.p12","provision":"/Users/username/Desktop/apple dev account/DevelopmentNFC.mobileprovision"},"stores":{"certificate":"/Users/username/Desktop/apple dev account/distribution/2019-05-24-ios_distribution.p12","provision":"/Users/username/Desktop/apple dev account/distribution/Living_Moments.mobileprovision"}},"android":{"all":{"certificate":"/Users/username/Code/_certificates/MacMiniSidekick.p12"}}}

[rebz]

Today I performed the following:

• Removed all local certs/keys/provision files from machine and keychain.
• Revoked/deleted all instances of certs/ids/provisions/etc from my Apple Developer Account
• Confirmed via Xcode Manage Certs screen they were all removed.
• Removed my Apple Dev Account from Xcode
• Uninstalled NativeScript Sidekick and all config files using an App Cleaner
• Restart Mac Mini
• Re-confirm that certs/keys/provisions are not on local machine
• Download and Install NativeScript Sidekick
• Log into Apple Developer Account on Xcode, showing no certs/provisions.
• Generate Certs/Provisions with Sidekick and Apple Developer Account for Publishing to the Apple App Store
• Confirm that app is created in AppStoreConnect before attempting to publish with Sidekick
• Open project in Sidekick, click Publish
• Set Cert/Provision in App Store build config
• Select clean, local build.
• Build is successful
• Log into developer account
• Confirm 2 Factor Auth
• Confirm app-specific password

[19-05-25 12:24:55.466] Spawn failed.
[Transporter Error Output]: Sign in with the app-specific password you generated. If you forgot the app-specific password or need to create a new one, go to appleid.apple.com (-22938)
[Transporter Error Output]: ERROR ITMS-90161: "Invalid Provisioning Profile. The provisioning profile included in the bundle io.rebz.nfc [Payload/nfc.app] is invalid. [Missing code-signing certificate]. A Distribution Provisioning profile should be used when submitting apps to the App Store. For more information, visit the iOS Developer Portal.", Error: Spawn failed.
[Transporter Error Output]: Sign in with the app-specific password you generated. If you forgot the app-specific password or need to create a new one, go to appleid.apple.com (-22938)
[Transporter Error Output]: ERROR ITMS-90161: "Invalid Provisioning Profile. The provisioning profile included in the bundle io.rebz.nfc [Payload/nfc.app] is invalid. [Missing code-signing certificate]. A Distribution Provisioning profile should be used when submitting apps to the App Store. For more information, visit the iOS Developer Portal."
    at CloudPublishService.getiOSError (/Users/christopherjohnson/.local/share/.nativescript-cli/extensions/node_modules/nativescript-cloud/lib/services/cloud-publish-service.js:79:21)
    at CloudPublishService.<anonymous> (/Users/christopherjohnson/.local/share/.nativescript-cli/extensions/node_modules/nativescript-cloud/lib/services/cloud-publish-service.js:96:29)
    at Generator.next (<anonymous>)
    at fulfilled (/Users/christopherjohnson/.local/share/.nativescript-cli/extensions/node_modules/nativescript-cloud/lib/services/cloud-publish-service.js:4:58)

The error persists. I'm stumped.

[rebz]

When generating the app-specific password, does the name I create have to match my app or bundle id? Can I give it whatever name I want? Does it even matter?

[rebz]

Another route, same error:

Cleared all certs/provisions/etc. Generated a new Distribution Certificate using Xcode. Downloaded provision profiles to machine with Xcode. Exported certificate from Xcode. Added certificate to machine.

Relaunch Sidekick. Open project. Select build. Apple App Store build, clean, local. Launched Application Loader from Xcode and loaded the newly built .ipa file.

Application Loader eventually gives the following error:

ERROR ITMS-90161: "Invalid Provisioning Profile. The provisioning profile included in the bundle io.rebz.livingmoments [Payload/nfc.app] is invalid. [Missing code-signing certificate]. A Distribution Provisioning profile should be used when submitting apps to the App Store. For more information, visit the iOS Developer Portal."

[rebz]

I notice that every time I try to build with Sidekick, it is creating a Developer Certificate for me... The Team ID on that certificate does not match the Team ID I am part of in my Apple Developer account. I do not understand how or why this is being created.

Image from Xcode when viewing your account and clicking "Manage Certificates". I did not create the Development one.

Image from my Apple Developer Account, I did not create the Development one.

Even looking at my Keychain you can see the first couple of character for the Team ID do not match.

Here is the first 2 characters of the Team ID under the Membership tab on my Apple Developer Account.

I'm wondering if Sidekick is somehow creating these on my behalf and then using that instead of what I defined or already had loaded on my machine? But why? How?

[rebz]

Additional info: running tns run ios --provision

[rebz]

Successfully submitted to my AppStoreConnect account.

1. Removed platforms
2. Removed duplicative Provisioning Profile
3. Ran tns prepare ios --provision to get the UUID for my distribution provision
4. Copied the UUID
5. Ran tns prepare ios --release --bundle --provision {UUID}
6. Opened /platforms/ios/{project}.workspace in Xcode. Clicked on {project} name in the left pane
7. Clicked on the General tab at the top of the middle pane
8. Confirmed that the Signing (Release) had the correct provision profile selected
9. Clicked Product > Archive from the Main Menu
10. Project Successfully Built, clicked Distribute... followed steps.

I would like to note that in the past I tried Product > Archive with no success as it kept failing to build with a SocketIO error each time. This time it went through.

I never was able to get it built using Sidekick. Even now I still do not understand why each time I built with Sidekick, selecting my distribution cert/provision, it would continue to create a new Developer cert/provision and use that instead.

This could be considered closed for me... but there may be a bug with Sidekick.

[tsvetie]

Hey @rebz ,

Тhere is one thing in Sidekick UI that is a little misleading. The Settings dialog, which lets you specify provision and certificate for the iOS build is applicable only for cloud builds. For local builds, these settings are ignored and xCode manages which provision and certificate are used.

Currently, in case you want to specify the provision for the local iOS build, you have two options:

1. Use NS CLI and the --provision flag
2. Edit the build.xcconfig file and specify the CODE_SIGN_IDENTITY

[rebz]

Thanks @tsvetie , appreciate the insight.

Interesting bit about the CODE_SIGN_IDENTITY. I had already specified that, but only because a package I'm using required it for NFC access. Once I used the --provision flag in step 5 it went through.

Question Are you saying I should specify CODE_SIGN_IDENTITY within app/App_Resources/iOS/build.xconfig? Or should I add it to platforms/ios/{appname}/build.xcconfig?

Now that I understand the provision profiles a bit better it's made things seem easier. I do believe I'm experiencing a one-off issue with my provisions as Xcode is assigning the wrong Team ID to my developer profiles.

I'll have to read more of the documentation.

[rebz]

Would like to add some clarity if others visit this thread.

Regarding the Incorrect Team ID for Development

When generating a new Development Provision Profile, whether through Sidekick or Xcode, it would always generate a profile with an incorrect Team ID.

Turns out, the Team ID for development does not matter. I am currently using an Incorrect Team ID assigned to my development profile and still building to my device.

[kryptus36]

I am encountering this error and have tried every tip I can find.

@rebz I tried your xcode workaround above but get stopped short on step 9 as the archive option in the xcode menu is greyed out. Xcode seems to have no issues with my distribution profile. I've been trying to use "tns publish ios <Apple id> <password> <provision id>" but I can't figure out what the proper value for <Code Sign Identity> is or where to get it.

[alereisan]

After a long struggle the only solution was: Open xcworkspace Project in xcode. Set to automatically manage Signing. Delete the certificate mentioned in the XCode Error message from your Mac keychain. Successfully build and distribute your Nativescript App from within XCode.