Code Sign Error not finding team ID during Cordova

Question

After reading through all of the previous posts on code sign errors, I have reached a cul-de-sac. While building a cordova project (version 4.3.0) with ios platform (version 3.8.0) and using a Bamboo server to do the continuous integration. I cannot get my app to sign the iOS app for the release. This is the order of my build tasks:

1. unlock keychain (I've made sure that my iPhone Developer and Distribution certificates were valid and not expired. I've also made sure that there are no permission windows that pop up on the Bamboo server, e.g. asking permission to unlock keychain.)
2. cordova platform remove ios (to clean the directory and start fresh)
3. add plugins for ios
4. cordova platform add ios
5. cordova build ios --release --device (build release version for a device to eventually upload to app store)
6. xcrun to embed the mobileprovision

I then get this error when running #5 task above:

    === BUILD TARGET Abczyx OF PROJECT Abczyx WITH CONFIGURATION Release ===
    Check dependencies
    Code Sign error: No code signing identities found: No valid signing identities (i.e. certificate and private key pair) matching the team ID “(null)” were found.
    CodeSign error: code signing is required for product type 'Application' in SDK 'iOS 8.1'

    The following build commands failed:
    Check dependencies
    (1 failure)
    Error code 65 for command: xcodebuild with args: -xcconfig,/usr/local/Bamboo/Abczyx/platforms/ios/cordova/build-debug.xcconfig,-project,Abczyx.xcodeproj,ARCHS=armv7 armv7s arm64,-target,Abczyx,-configuration,Release,-sdk,iphoneos,build,VALID_ARCHS=armv7 armv7s arm64,CONFIGURATION_BUILD_DIR=/usr/local/Bamboo/Abczyx/platforms/ios/build/device,SHARED_PRECOMPS_DIR=/usr/local/Bamboo/Abczyx/platforms/ios/build/sharedpch

ERROR building one of the platforms: Error: /usr/local/Bamboo/Abczyx/platforms/ios/cordova/build: Command failed with exit code 2

Here is my build-release.xcconfig:

   #include "build.xcconfig"

   CODE_SIGN_IDENTITY = iPhone Distribution
   CODE_SIGN_IDENTITY[sdk=iphoneos*] = iPhone Distribution

   #include "build-extras.xcconfig"

Here is my build.xcconfig:

   // Type of signing identity used for codesigning, resolves to first match of given type.
   // "iPhone Developer": Development builds (default, local only; iOS Development certificate) or "iPhone Distribution": Distribution builds (Adhoc/In-House/AppStore; iOS Distribution certificate)
  CODE_SIGN_IDENTITY = iPhone Developer
  CODE_SIGN_IDENTITY[sdk=iphoneos*] = iPhone Developer

  // (CB-7872) Solution for XCode 6.1 signing errors related to resource envelope format deprecation 
  CODE_SIGN_RESOURCE_RULES_PATH = $(SDKROOT)/ResourceRules.plist

The Bamboo server is running Xcode 6.1.1 Build version 6A2008a on a OS X 10.9.4. And I clicked refresh for the xcode's preferences > Accounts > user > Signing identities and provisioning profiles screen.

I'm using Xcode 6.2, Build version 6C131e on a OS X 10.9.4 mac book pro for my local machine and I still get this same error. However, one of the strange things is that on my local machine, I sometimes run cordova build ios --device without the --release flag and I'm able to build an .ipa in my platforms/ios/build/device folder that is signed for debug, but this doesn't work on the remote Bamboo server (although it worked once many days ago).

I've studied the releasenotes for Cordova iOS v.3.8.0 here and found nothing helpful to try beyond CB-7872 CODE_SIGN_RESOURCE_RULES_PATH = $(SDKROOT)/ResourceRules.plist, which has already been fixed: https://github.com/apache/cordova-ios/blob/master/RELEASENOTES.md

I've verified that the Bamboo server contains the sdk iphoneos8.1 that it's checking.

I've verified that profile provisions are up to date and no one else has worked on my repo.

I've verified that my CODE_SIGN_IDENTITY is good with this post and script: Xcode fails with "Code Signing" Error

I've tried adding a delay after building but I'm failing the build step already before I can try this: Failed to generate release build of cordova ios app

I've tried to look at removing the auto-complete/manage schemes feature but not sure this is just another rabbit hole to fall in: xcodebuild says does not contain scheme

I've tried looking at the source here: https://github.com/apache/cordova-ios/blob/master/bin/templates/scripts/cordova/lib/build.js But I don't see anything obvious to confirm or test...

Two questions:

1. Why is there a "null" for teamID? How can I check where it's checking?

2. What else am I missing? What else can I check? Specifically in the source of cordova build ios script?

Answer 1

TL;DR

1. Why is there a "null" for teamID? How can I check where it's checking?

Most likely improper keychain setup for iPhone distribution. Check and make sure you have the cert with the nested key.

2. What else am I missing? What else can I check? Specifically in the source of cordova build ios script?

Ensure proper flags and options are set if you using command line tools. Otherwise, try different wrapper tools like Fastlane ruby gem.

Long version

We figured it out using a wrapper tool around Apple developer console and code signing and making sure the p12 file (cert+key) file was set correctly.

1. Install KrauseFx's Fastlane gem: https://github.com/KrauseFx/fastlane
2. Export the iPhone distribution p12 file from Keychain Access from our Bamboo build server to a local computer (for easier troubleshooting). The p12 file basically includes a cert with a nested key icon, which is necessary as Rich Tolley mentioned above in the comments.
3. Double-click on the p12 file to install it in the "login" keychain. Make sure you can see the nested cert-key structure.
4. Open Xcode>Preferences and ensure that iOS Distribution is added as part of the Signing Identities (both iOS Development and iOS Distribution is shown)
5. Clean your cordova/project directory by starting fresh (no platforms or plugins or using cordova platform rm ios etc.). Then add the plugins, then add the platforms.
6. We ran cordova build ios --device --release, which build our "Abczy.app".
7. Move into the correct cordova platforms directory since relative path may not work correctly: ~/.../platforms/ios/build/device (check that the .app file is there)
8. Run this command to convert the .app into an .ipa: xcrun -sdk iphoneos PackageApplication -v Abczyx.app -o /Users/myname/Desktop (I've moved the resulting .ipa onto my desktop to make it easier to manipulate).
9. Go to the folder containing your .ipa and ensure you have the mobileprovision file from apple developer included in the same directory.
10. Run: sigh resign ./Abczyx.ipa -p "Abczyx-dist.mobileprovision". Copy and paste the name of the cert/key you will use and then it will sign the app with the distribution mobileprovision. If you use a developer mobileprovision, it will get a fatal error but the app will be signed anyway.
11. Alternatively, you can type: sigh resign ./Abczyx.ipa -i "iPhone Developer: Joey Jojobuttafucco (123FTR12PAC)" -p "Abczyx-dist.mobileprovision"