ITMS-91065: Missing signature

[lancefu-eventbase]

Short description of the issue:

Our app submission got hit by the issue ITMS-91065: Missing signature when uploading a build to App Store Connect.

Expected outcome:

App with RxSwift as dependency should go through upload and submission checks successfully.

What actually happens:

When we uploaded a build of our new app to App Store Connect to distribute it on TestFlight for testing purpose, we received an email with the following errors:

Our current build pipeline uses Carthage as the main dependency manager. It produces xcframeworks that aren't signed. I did try to drop in the pre-built xcframeworks included in the release, which has validation failed status in Xcode:

I am going to switch to Swift Package Manager for testing purpose. I will report back shortly.

Meanwhile, is there plan to provide properly signed xcframeworks?

Self contained code example that reproduces the issue:

Not applicable

RxSwift/RxCocoa/RxBlocking/RxTest version/commit

6.7.1

Platform/Environment

• iOS
• macOS
• tvOS
• watchOS
• playgrounds

How easy is to reproduce? (chances of successful reproduce after running the self contained code)

• easy, 100% repro
• sometimes, 10%-100%
• hard, 2% - 10%
• extremely hard, %0 - 2%

Xcode version:

15.0.1

⚠️ Fields below are optional for general issues or in case those questions aren't related to your issue, but filling them out will increase the chances of getting your issue resolved. ⚠️

Installation method:

• CocoaPods
• Carthage
• Git submodules

I have multiple versions of Xcode installed:
(so we can know if this is a potential cause of your issue)

• yes (which ones)
• no

Level of RxSwift knowledge:
(this is so we can understand your level of knowledge
and formulate the response in an appropriate manner)

• just starting
• I have a small code base
• I have a significant code base

[lancefu-eventbase]

I have tried to switch to Swift Package Manager from Carthage, but I encountered the issue described here: #2424. The issue was closed without a resolution because the OP somehow couldn't reproduce it anymore. I attempted a few things including trying different build configurations without success. I created a new framework project and confirmed that the same issue was observed there too. The generated dynamic version of xcframeworks do not have the necessary binaries.

I was able to overcome this through a build script that runs after building dependencies and before library linking. I noticed that even though my project only included RxSwift-Dynamic, RxCocoa-Dynamic, RxRelay-Dynamic, both RxSwift.xcframework and RxRelay.xcframework would get generated in addition to RxSwift-dynamic.xcframework and RxRelay.xcframework in derived data's PackageFrameworks folder. However, RxSwift.xcframework and RxRelay.xcframework both had binaries, but their dynamic counterparts would not. After confirming that the binaries for RxSwift.xcframework and RxRelay.xcframework are indeed dynamic and not static, I wrote script to copy them to the right place at build time. That resolved the issue. However, when I ran the app project in simulator, the app will crash soon after launch with error messages that led me to another issue: #1972. The strange thing though is if I export this build, it will run on a real device successfully. This tells me something isn't correct with the framework for simulator. I wonder if everyone just uses static frameworks instead, so this issue is not noticeable.

After getting nowhere with this, I decided to change my approach and sign the xcframework using our own Apple Developer certificate. So far, Apple seems to be happy with the app submission and no issues are raised.

[CAMOBAP]

I have faced the same issue on Xcode 15.4 and 16.0

Flag --no-use-binaries which force local build of dependency, resolve the issue

[palusik86]

I've encountered the same problem, but only with RxRelay. I use --no-use-binaries flag, Xcode 15.4.

ITMS-91065: Missing signature - Your app includes “Frameworks/RxRelay.framework/RxRelay”, which includes RxRelay, an SDK that was identified in the documentation as a privacy-impacting third-party SDK. If a new app includes a privacy-impacting SDK, or an app update adds a new privacy-impacting SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.

Issue fixed by adding RxSwift dependencies via SPM