PBXProj Unsigned Release

ID

swift.pbxproj_unsigned_release

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Swift

Tags

build-config, reliability

Description

Reports an Xcode project whose Release configuration leaves CODE_SIGN_IDENTITY empty or sets it to the literal "Don’t Code Sign". Shipping an unsigned binary defeats every downstream integrity check Apple’s distribution chain relies on — provisioning validation, notarisation, App Store ingestion, and on-device code-signature verification at launch.

// project.pbxproj
... /* Release */ = {
    isa = XCBuildConfiguration;
    buildSettings = {
        CODE_SIGN_IDENTITY = "";                   // FLAW (empty)
        CODE_SIGN_IDENTITY = "Don't Code Sign";    // FLAW (explicit)
        CODE_SIGN_IDENTITY = "Apple Distribution"; // OK
    };
    name = Release;
};

Rationale

The Xcode UI hides this setting under "Signing & Capabilities". A developer who selects "Don’t Code Sign" while debugging a provisioning issue can accidentally commit that as the Release default. The bug only surfaces at distribution time; in CI it surfaces when a build pipeline skips signing because the certificate is missing in the runner.

Every Release-named configuration in the file is inspected — projects that rename Release to something else (e.g. AppStore) are not covered.

Remediation

Set CODE_SIGN_IDENTITY to the appropriate signing identity for the target (typically "Apple Distribution" for App Store and ad-hoc builds, "Apple Development" only for Debug). Verify under Project → Target → Signing & Capabilities that the Release entry has a real team and certificate selected.

References