Unsupported Entitlement in Your Provisioning Profile

Jan 6, 2019 | 2 min read | Xamarin, iOS

My previously awesome Book Scanner app, written using Xamarin, currently has an embarrassing error on iOS 12: the app will not prompt the user for camera permissions, thus rendering the app useless.

Luckily, the fix is easy. Just add the following to the info.plist file and the user is prompted for permission when the app is run for the first time.

<key>NSCameraUsageDescription</key>
<string>Used to scan book barcodes</string>

So I made the change and thought it only reasonable to test it on my own device first. Unfortunately, the output from the Deploying to Device tab in Visual Studio crushed my dreams:

VerifyingApplication - PercentComplete: 40%

ApplicationVerificationFailed: Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.TCrsU1/extracted/BookScanneriOS.app : 0xe8008016 (The executable was signed with invalid entitlements.)

error MT1006: Could not install the application ‘/Users/sankra/projects/BookScanner/BookScanner.iOS/bin/iPhone/Release/BookScanneriOS.app’ on the device ‘iPhone XS’: Your code signing/provisioning profiles are not correctly configured. Probably you have an entitlement not supported by your current provisioning profile, or your device is not part of the current provisioning profile. Please check the iOS Device Log for details (error: 0xe8008016).

Application could not be uploaded to the device.

The app could not be uploaded to the device because of invalid entitlements. Strange, as the app has only a few entitlements and none that should be affected by the aforementioned small change.

Apart from the default entitlements that all apps share, Book Scanner uses an App Group to communicate with its today widget and it’s specified in the Entitlements.plist file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.application-groups</key>
	<array>
		<string>***</string>
	</array>
</dict>
</plist>

The today widget has its own App ID and on https://developer.apple.com the App Group entitlement was in the Configurable state, not Enabled as it should be.

The following guide from Xamarin reminded me how explicitly set the App Group ID to use, thus enabling the entitlement. After the change, all Provisioning Profiles using this App Id needed to be recreated.

Summary

To summarise, if you ever encounter a similar error, do the following:

1. Check that all entitlements listed in Entitlements.plist are present and Enabled for your specific App ID.
2. Recreate your Provisioning Profiles after making the necessary changes.