Cannot install ios chromium app: valid provisioning profile not found

[Isaac Dempsey]

Hi all,

I'm having issues installing the ios chromium app I've built.
Codesign says it’s valid:

$ codesign --verify --verbose=4 Chromium.app
Chromium.app: valid on disk
Chromium.app: satisfies its Designated Requirement

However, it fails to install:

$ ios-deploy --id $did --bundle Chromium.app
2022-11-04 13:15:57.614 ios-deploy[96334:17540917] [ !! ] Error 0xe8008015: A valid provisioning profile for this executable was not found. AMDeviceSecureInstallApplication(0, device, url, options, install_callback, 0)
Error message: "A valid provisioning profile for this executable was not found."

------

I built the app using the following args:

target_os = "ios"
is_debug = false
enable_dsyms = true
enable_stripping = true
is_official_build = true
is_chrome_branded = false
target_cpu = "arm64"
target_environment = "device"
target_os = "ios"
enable_remoting = false

I also specified the code-signing identity and bundle prefix here: build/config/ios/ios_sdk.gni

Build command:

autoninja -C out/Official-iphoneos chrome

------

With regards provisioning profiles, I created the following iOS App Development provisioning profiles:

% pwd
/Users/app/Library/MobileDevice/Provisioning Profiles
% for mobileprovision in *.mobileprovision; do security cms -D -i $mobileprovision | grep -A1 application-identifier | grep -v application-identifier; done
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.ContentTodayExtension</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.CredentialProviderExtension</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.IntentsExtension</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.SearchTodayExtension</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.ShareExtension</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.TodayExtension</string>
<string>8RA8L783G3.myprefix.chromium.ios-web-view-shell</string>
<string>8RA8L783G3.myprefix.chromium.chrome.ios.dev.WidgetKitExtension</string>

For each of these provisioning profiles I granted the App Groups capability, and gave them access to the chrome and common groups as mentioned in the documentation. I also granted the AutoFill Credential Provider capability. No code-signing errors appeared during the build process.

When examining the chromium app I can see the following:

- Chromium.app/embedded.mobileprovision -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev
- Chromium.app/Plugins/content_widget_extension.appex -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev.ContentTodayExtension
- Chromium.app/Plugins/credential_provider_extension.appex -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev.CredentialProviderExtension
- Chromium.app/Plugins/search_widget_extension.appex -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev.TodayExtension
- Chromium.app/Plugins/share_extension.appex -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev.ShareExtension
- Chromium.app/Plugins/widget_kit_extension.appex -> 8RA8L783G3.myprefix.chromium.chrome.ios.dev.WidgetKitExtension

Note:
- Not all the provisioning profiles are being used in the build - unless they are somewhere I can't find them in the app. Is this ok?
- The search_widget_extension is using the TodayExtension bundle id - is that correct?

-------

With regards to entitlements, I have compared the entitlements required by the app according to codesign, and those included in the embedded.mobileprovision file:

# Entitlements required by app
codesign -d --entitlements :- Chromium.app | xmllint --format -

# Entitlements in provisioning profile
security cms -D -i Chromium.app/embedded.mobileprovision

They seem to match, unless I'm missing something.

-------

This error is pretty vague and when looking online it covers a bunch of other possibilities also:
1. Certificate expired. - have checked and it's not.
2. Device not registered. - have checked and it is registered and present in the .mobileprovision file.
3. Various xcode related issues. - have not used xcode for this build.
4. Build system should be the “legacy build system”. - not sure about this one

Please let me know if there is anything I've missed here or if there's any way to debug further.

Many thanks,

Isaac

[Isaac Dempsey]

Resolved this issue by manually resigning both the app plugins and the entire app using the corresponding provisioning profiles. 

[Isaac Dempsey]

Hi Steven,

You will need to generate the required provisioning profiles via the Apple developer portal (developer.apple.com). You will need multiple provisioning profiles - one for each of the plugins/extensions which are contained inside the Chromium.app directory, and one for the Chromium.app directory itself. Each provisioning profile needs to have the App Group entitlement.

For more information, please refer to the following section of the documentation: https://chromium.googlesource.com/chromium/src/+/main/docs/ios/build_instructions.md#mobile-provisioning-profiles

You can resign the plugins and Chromium itself using the codesign command. Refer to this guide for an example: https://medium.com/@hello_73586/how-to-re-sign-app-including-frameworks-5407e9e9246a

Best,

Isaac

On Mon, 31 Jul 2023 at 18:11, Steven NG <steven...@gmail.com> wrote:

Hi Isaac,

I have experienced same issue as you had. 

Could you please help me out how to resolve it? I do not know what plugins and how to manually resigning those.

Thanks.

[Steven NG]

Hi Isaac,

I have experienced same issue as you had. 

Could you please help me out how to resolve it? I do not know what plugins and how to manually resigning those.

Thanks.

On Tuesday, November 15, 2022 at 8:40:14 PM UTC+7 Isaac Dempsey wrote: