This document discusses provisioning profiles and how they are used in iOS development. It begins with an overview of what provisioning profiles are and how they are used for different app and extension types. It then covers important values contained within provisioning profiles like identifiers, entitlements, and developer certificates. The document provides tips for installing, viewing, and managing provisioning profiles using the terminal, Xcode, and automation scripts. It advocates for a convention over configuration approach by naming profiles consistently and using a script to automatically configure Xcode projects.

1. Provisioning Profile Stockholm Syndrome
This presentation contains confidential information intended only for the recipient(s) named above. Any other distribution, re-transmission,
copying or disclosure of this message is strictly prohibited. If you have received this transmission in error, please notify me immediately by
telephone or return email, and delete this presentation from your system.

2. Jay Graves - CTO POSSIBLE Mobile
@skabber

3. Provisioning Profiles Are Everywhere
• App
• Today Widget
• Watch App
• Watch Extension
• Shared Library
• Share Extension

4. I want you to LOVE Provisioning Profiles

5. What is a Provisioning Profile?

6. What is a Provisioning Profile?
SMIME / PKCS#7

7. Thank you!
Jay Graves - CTO POSSIBLE Mobile
@skabber

8. What is a Provisioning Profile?
SMIME / PKCS#7

9. Provisioning Profile in vi

10. Read a Profile
COMMAND LINE
security cms -D -i my.mobileprovision

12. Important Values
APPLICATION IDENTIFIER
<key>application-identifier</key>
<string>ABCDEFGHIJK.com.your.bundleid</string>

13. Important Values
ENTITLEMENTS
<key>Entitlements</key>
<dict>
...
<key>com.apple.developer.ubiquity-container-
identifiers</key>
...
<key>com.apple.developer.ubiquity-kvstore-
identifier</key>
...
<key>get-task-allow</key>
...
</dict>

14. Important Values
PROVISIONED DEVICES
<key>ProvisionedDevices</key>
<array>
<string>7af8ee3af8e4e13193bd834bab50e1d...</string>
<string>a9f0d0477a6d3e8dad0ff984f7ba77e...</string>
</array>

15. Important Values
UUID
<key>UUID</key>
<string>E0EF8ACE-E83A-475C-9DA7-C67A147659FD</
string>

16. Important Values
DEVELOPER CERTIFICATES
<key>DeveloperCertificates</key>
<array>
<data>
MIIFnDCCBISgAwIBAgIIEIdrqpJlb9MwDQYJKoZIhvcNAQEFBQAwgZYxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQKDApBcHBsZSBJbmMuMSwwKgYDVQQLDCNBcHBs
ZSBXb3JsZHdpZGUgRGV2ZWxvcGVyIFJlbGF0aW9uczFEMEIGA1UEAww7QXBw
bGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMgQ2VydGlmaWNhdGlv
...

17. Important Values
DEVELOPER CERTIFICATES
-----BEGIN CERTIFICATE-----
MIIFnDCCBISgAwIBAgIIEIdrqpJlb9MwDQYJKoZIhvcNAQEFBQAwgZYxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQKDApBcHBsZSBJbmMuMSwwKgYDVQQLDCNBcHBs
ZSBXb3JsZHdpZGUgRGV2ZWxvcGVyIFJlbGF0aW9uczFEMEIGA1UEAww7QXBw
bGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMgQ2VydGlmaWNhdGlv
...
-----END CERTIFICATE-----
openssl x509 -text -in cert.pem

18. Important Values
DEVELOPER CERTIFICATES
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
10:87:6b:aa:92:65:6f:d3
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=Apple Inc., OU=Apple Worldwide Developer Relations, CN=Apple Worldwide
Developer Relations Certification Authority
Validity
Not Before: Nov 3 21:38:10 2012 GMT
Not After : Nov 3 21:38:10 2013 GMT
Subject: UID=9K9F9LCV74, CN=iPhone Distribution: Massively Overrated, OU=9K9F9LCV74,
O=Massively Overrated, C=US
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:c8:57:f9:cf:af:c2:4d:7a:8a:16:62:47:4b:c2:

19. Install a Provisioning Profile
DON’T DOUBLE CLICK THEM!
Not human readable.

20. Install a Provisioning Profile
DRAG THEM INTO THE FINDER
~/Library/MobileDevice/Provisioning Profiles

21. Install a Provisioning Profile
DRAG THEM INTO THE FINDER

22. Install a Provisioning Profile
DRAG THEM INTO THE FINDER
Much better.

23. Tools for using Provisioning Profiles
TERMINAL.APP

24. Tools for using Provisioning Profiles
TERMINAL.APP + SHELL ALIAS
alias prov=‘security cms -D -i‘

25. Tools for using Provisioning Profiles
QUICK LOOK PLUGIN

26. Tools for using Provisioning Profiles
AUTOMATOR SERVICE

27. Tools for using Provisioning Profiles
AUTOMATOR SERVICE
http://d.pr/13uj9

28. Tools for using Provisioning Profiles
AUTOMATOR SERVICE

29. Xcode

30. Xcode
HOW DOES IT SEE PROFILES?
CODE_SIGN_IDENTITY = "iPhone Developer";
PROVISIONING_PROFILE = "";

31. Xcode
HOW DOES IT SEE PROFILES?
CODE_SIGN_IDENTITY = "iPhone Developer: Jay Graves (E6L876QFM6)";
PROVISIONING_PROFILE = "0FEB5831-22D3-4B1D-A973-59ED243E8103";

32. Build Error

33. Project Diff

34. What does all this mean?
•Automatic Profiles
•Good if you don’t have multiple projects.
•It can select the wrong profile.
•Rules on automatic selection are not defined.
•Specific Profiles
•Much more control over which profile is selected.
•Can be a pain to update the project file every time a profile is updated.

35. Nick Arnott
IS A FUNNY GUY

36. Can this be better?
Yes!

37. Convention over Configuration

38. Convention over Configuration
• An Xcode Project can have multiple targets
• Every target can have multiple configurations
• Every target/configuration combination “should” have a provisioning profile
Name your profiles accordingly.
PROJECT-TARGET-CONFIGURATION.mobileprovision

39. Convention over Configuration
USE A SCRIPT
Run this script to set all the profiles properly.
set_project_profiles.sh -b -p Your.xcodeproj
http://bit.ly/ProjectProfiles

40. Thank You!
Jay Graves - CTO POSSIBLE Mobile
@skabber

41. Convention over Configuration
HOW DOES IT WORK?
Magic scripts are great but how does it work?
• Create a folder at the root of every project called “CodeSign”.
• Put every profile in that directory.
• Script copies those profiles into ~/Library/MobileDevice/Provisioning Profiles
• Script inspects Xcode project for a list of Targets,
• Script gets a list of Configurations for each Target.

42. Convention over Configuration
HOW DOES IT WORK?
• Script checks for any installed profile that follows the naming convention.
• Script queries the UUID for that profile.
• Script modifies the Xcode project with the appropriate UUID per Target/
Configuration.

43. Modifying an Xcode Project!
OMGWTFBBQ!
It’s
Just
A
PLIST

44. PlistBuddy Demo

45. Modifying and Xcode Project
IS NO BIG DEAL
Except…
PlistBuddy only outputs XML.

46. Tips:
• Project Specific Keychains
• Runtime asserts for missing entitlements
• Don’t click “Fix Issue”
• Read the Xcode errors
• Don’t go nuclear!

47. Thank you!
Jay Graves - CTO POSSIBLE Mobile
@skabber