Xcode 8 “the aps-environment entitlement is missing from the app's signature” on submit

Question

I've got an app that we've submitted dozends of versions to in the last 6 months and we do use APNS. I got the following email from Apple after upgrading to Xcode 8

Dear developer,

We have discovered one or more issues with your recent delivery for APP_NAME. Your delivery was successful, but you may wish to correct the following issues in your next delivery:

Missing Push Notification Entitlement - Your app includes an API for Apple's Push Notification service, but the aps-environment entitlement is missing from the app's signature. To resolve this, make sure your App ID is enabled for push notification in the Provisioning Portal. Then, sign your app with a distribution provisioning profile that includes the aps-environment entitlement. This will create the correct signature, and you can resubmit your app. See "Provisioning and Development" in the Local and Push Notification Programming Guide for more information. If your app does not use the Apple Push Notification service, no action is required. You may remove the API from future submissions to stop this warning. If you use a third-party framework, you may need to contact the developer for information on removing the API.

After you’ve corrected the issues, you can use Xcode or Application Loader to upload a new binary to iTunes Connect.

Regards,

The App Store team

What is weird is I went to developer.apple.com -> Certificates, Identifiers & Profiles and my AppId does have Push Notifications enabled still. I'm not doing anything different then I've ever done on it so am curious if the Xcode 8 update broke something. Any ideas?

BTW: The link they put for the Push Notification Programming Guide was broken in the email, so that's not a good sign.

Answer 1

Very easy actually. For some reason it got disabled on Xcode 8 but go to Targets -> Capabilities and verify Push Notifications is all correct on that view. For me it had a "Fix Me" I had to click, and voila.

Answer 2

I also have the same problem, and I'm sure Push notification is off by default in Xcode8. I didn't notice it. Be careful about it.

Answer 3

There was a change in Xcode 8, where your entitlements no longer come from the App Identifiers, but from the capabilities selected in your app target. So, like Unome (the OP) said, you have to verify that Push Notifications is switched on.

For me, it wasn't a "Fix Me" button, but I had two entitlement files (one for development and one for distribution). Toggling the Push Notifications capability would add the aps-environment key - with the value development - to the development entitlements file, but it wouldn't add it to the distribution entitlements file. Copying the same key over to distribution worked to get rid of the warning email when uploading to iTunes Connect.

For most projects, it should be sufficient to toggle on Push Notifications, or if it's already on but the key isn't in the entitlements, try toggling it off and on again.

It's also worth noting that entitlements automatically get updated during archive. ie the entitlements generated for release builds can be different from entitlements generated for development builds. See here

During the app distribution process through the Xcode Organizer > Archives tab, entitlements are set onto the app by way of the provisioning profile used for code signing. It is important to be aware that the re-application of entitlements at this phase creates the opportunity for unintended entitlement differences between any prior development builds you may have tested. The primary purpose of this document is to verify that your entitlements are correct for your distribution builds for beta testing and App Store submission.

Answer 4

From the Xcode release notes:

Xcode 8 does not automatically copy the aps-environment entitlement from provisioning profiles at build time. This behavior is intentional. To use this entitlement, either enable Push Notifications in the project editor’s Capabilities pane, or manually add the entitlement to your entitlements file. (28076333)

This is a great change as it was always quite odd that the aps-environment entitlement didn't require the plist, but many others did.

For those of you that do not want to just blindly press "Fix Me" and do not currently have an entitlements file, it is just a plist file which is referenced in your project's Build Settings under "Code Signing Entitlements"

Answer 5

After a day of struggle with Xcode 8 we could not figure out why the aps-environment development was NOT added to our debug builds. It was missing from the entitlements section in the built app for debug testing... even though we had ENABLED the new Capability and the entitlements file existed. The issue is that the entitlements file needs to be set for ANY SDK in the Xcode Build Settings for Debug Entitlements.

Answer 6

I got the same email from Apple using XCode 7.3.1. What I did to solve the problem was:

1. Under Capabilities > Set PUSH notification ON as stated in @Bruce Tsai answer.
2. Under Build-Settings > Code Signing > Code Signing Identity set the developer cert for debug and the distribution cert for release, as is shown in the image:

Answer 7

Automatically manage signing was off for me, i checked and working fine for me.

Answer 8

If you're using Firebase frameworks and aren't using push notifications there are two solutions 1. just put up with the 'issue' message that gets sent to your whole team every time uploading a binary. The app will still be accepted as a submission as long as you're not actually using notifications you can ignore the warning. or 2. do this: https://stackoverflow.com/a/46802075/7529450 . This will remove the annoying email notification and also get accepted as a submission.

Answer 9

Using Xcode 9 push Notifications was enabled.

I tried disabling/re-enabling Push Notification capabilities. (didn't work)

I tried disabling/re-enabling Automatically manage signing. (didn't work)

Turns out I had to delete and re-add my provisioning profiles. (see here how to do it) You might have to disable/re-enable Automatically manage signing after wards.

Answer 10

For me the problem was because there were two entitlements files: Entitlements-Debug.plist and Entitlements-Release.plist. And only one of them (Debug) has needed settings in it.

Changing multiple value of Build Settings > Signing > Code Signing Entitlements to a single MyAppName/MyAppName.entitlements and then reenabling Capabilities > Push Notifications switcher did the trick for me.

Hope it helps.

Answer 11

One more option that worked: copy-pasting the source of AppName/Entitlements-Debug.plist into AppName/Entitlements-Release.plist.