-allowProvisioningUpdates doesn't work

Question

We are using Jenkins for Continiuous Integration. Everything we need to do in order to compile our app is done via commandline (bash script), because we have several machines where the build has be done without any human access to the devices.

As you can imagine I was very happy to see the new xcodebuild feature flag -allowProvisioningUpdates in XCode9.

I understand, that I need to add the credentials of our Apple ID into the XCode settings.

The credentials are adde to the XCode account tab in Preferences, but when I try to compile using "xcodebuild ... -allowProvisioningUpdates" the following error message appears:

 2017-09-19 09:47:59.692 xcodebuild[74979:3824315]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/DVTFrameworks/DVTFrameworks-13231/DVTFoundation/Portal/DVTDeveloperAccountCredentialsManager.m:38  
Details:  Unable to find default keychain.  
Object:   <DVTDeveloperAccountCredentialsManager>  
Method:   +defaultAccountCredentialsManager  
Thread:   <NSThread: 0x7fe17860aa40>{number = 4, name = (null)}  
Please file a bug at http:/  
2017-09-19 09:47:59.792 xcodebuild[74979:3824308] [MT] IDEDistribution: Step failed: <IDEDistributionSigningAssetsStep: 0x7fe17d45cf20>: Error Domain=IDEDistributionSigningAssetStepErrorDomain Code=0 "Locating signing assets failed." UserInfo={NSLocalizedDescription=Locating signing assets failed., IDEDistributionSigningAssetStepUnderlyingErrors=(  
    "Error Domain=DVTServicesSessionErrorDomain Code=0 \"Unable to log in with account '[e-mail]'.\" UserInfo={NSLocalizedFailureReason=Unable to log in with account '[e-mail]'., NSLocalizedRecoverySuggestion=The login details for account '[e-mail]' were rejected., DVTDeveloperAccountErrorAccount=<DVTAppleIDBasedDeveloperAccount 0x7fe179b016c0: username: [e-mail]>, NSUnderlyingError=0x7fe179e8ee60 {Error Domain=DVTDeveloperAccountErrorDomain Code=4 \"[e-mail] could not sign in.\" UserInfo={NSLocalizedRecoverySuggestion=Cannot sign in to this account. Try signing into it again in the Accounts preference pane., NSLocalizedDescription=[e-mail] could not sign in., DVTDeveloperAccountErrorAccount=<DVTAppleIDBasedDeveloperAccount 0x7fe179b016c0: username: [e-mail]>}}}",  
    "Error Domain=IDEProfileLocatorErrorDomain Code=1 \"No profiles for 'com.yyy.CITestProject' were found\" UserInfo={NSLocalizedDescription=No profiles for 'com.yyy.CITestProject' were found, NSLocalizedRecoverySuggestion=Xcode couldn't find any iOS App Store provisioning profiles matching 'com.yyy.CITestProject'.}"  
)}  
error: exportArchive: The operation couldn’t be completed. Unable to log in with account '[e-mail]'.

Does someone know how to fix this problem?

update: We use this plugin to start ssh sessions to our Jenkins slaves in order to do the buildjob: https://wiki.jenkins.io/display/JENKINS/SSH+Slaves+plugin

Answer 1

This -allowProvisioningUpdates worked for me in Xcode 9 final release.

Verify You Can Build an auto-signing Xcode Project Using Xcode IDE

• 1) Open an Xcode project configured for automatically sign
  • Select target from Targets > General > Signing
  • [x] Automatically manage signing
  • Enter your team account credentials
• 2) Build the project and verify build succeeds

Close Xcode and Build project using xcodebuild with options -allowProvisioningUpdates

• 1) Add option "xcodebuild ... -allowProvisioningUpdates
• 2) When prompted, "xcode wants to access key "xcode apple id access" in your keychain"
  • Enter credentials and press button Always Allow

Now Jenkins command line builds should work.

Answer 2

When you're dealing with Xcode errors over SSH, it's usually best to try out the same commands using the GUI. It will often show you which keychain entries it's trying to access.

In my case, it prompted me to allow xcodebuild access to Xcode-AlternateDSID and Xcode-Token in my keychain. I granted it access with "Always Allow". You could also edit those entries in Keychain Access and allow all applications to access them, if you're not too worried about security.

I was already running security unlock-keychain -p mypassword /Users/myuser/Library/Keychains/login.keychain-db before running xcodebuild, so that's probably also necessary.

After doing that, the export worked.

Answer 3

Xcode saves the credentials in the default keychain. In order for it to access it over ssh, you first need to unlock that keychain:

/usr/bin/security unlock-keychain /Users/xxx/Library/Keychains/login.keychain-db

When using jenkins, you need to unlock the keychain either inside your build jobs or when starting the agent. You could for example add it to /Library/Application Support/Jenkins/jenkins-slave-runner.sh.

The answer from "Ed of the Montain" only works, because xcodebuild checks the /Library/MobileDevice/ProvisioningProfiles (and other) directories for valid profiles, if it finds one, then the -allowProvisioningUpdates option simply uses this profile and doesn't need the login.

Answer 4

I have the same problem. I reported the bug to Apple, to no avail. To move forward with Xcode 9, I switched to manual signing for Jenkins only. (Developers still use automatic signing.)

/usr/bin/xcodebuild -exportArchive \
    DEVELOPMENT_TEAM=*your-dev-team-id* \
    CODE_SIGN_STYLE=Manual \
    CODE_SIGN_IDENTITY="iPhone Distribution: *your cert*" \
    PROVISION_PROFILE="*your*.mobileprovision" \
    *rest of your parameters*

Answer 5

I used to have the same issue after recent update from XCode 7.x to 9.3 version.

The solution for me was an parameter -allowProvisioningDeviceRegistration in addition to -allowProvisioningUpdates for xcodebuilder:

/usr/bin/xcodebuild -exportArchive \
-allowProvisioningUpdates -allowProvisioningDeviceRegistration \
...

Works perfectly with Jenkins.