Repository navigation
Conversation
… request assignApplicationGroupToAppId replaces the App ID's groups with the ones in the request, and DeveloperServicesAssignAppGroupsOperation sent one request per group, concurrently. An app whose entitlements name two groups therefore ended with one group in its profile (whichever request Apple handled last), and the device refused to install it (ApplicationVerificationFailed). The operation now creates any missing groups as before, then sends a single request carrying every group ID, and returns the group IDs in the order the entitlements listed them, so the rewritten entitlement is stable between builds. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UKzxgxaLwK7Ap5LMwj9MxH
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Multi-group assignment request Sources/XKit/DeveloperServices/App Groups/DeveloperServicesAssignAppGroupRequest.swift |
The request accepts an array of app-group IDs and documents that each assignment replaces the App ID’s existing groups. |
Ordered upsert and assignment Sources/XKit/DeveloperServices/App Groups/DeveloperServicesAssignAppGroupsOperation.swift |
The operation upserts groups, restores input order, sends one assignment request when the result is nonempty, and returns the IDs in that order. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Suggested reviewers: kabiroberai
Merge Risk: 
49b17
-
No actionable merge-blocking issue was established. The change is ready for normal merge checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the primary change: assigning all of an app's groups to its App ID in one request. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
DeveloperServicesAssignAppGroupsOperationsends oneassignApplicationGroupToAppIdrequest per app group, concurrently. That endpoint replaces the App ID's groups with the ones in the request, so an app whose entitlements list two or more groups ends up with only one of them on the App ID: whichever request Apple handles last. The provisioning profile then carries one group while the signed binary claims two, and the device refuses the install withApplicationVerificationFailed.Setting the groups by hand in the developer portal does not help, because the next
xtool dev build --signsends the per-group requests again.The fix
DeveloperServicesAssignAppGroupRequesttakesgroupIDs: [DeveloperServicesAppGroup.ID]and sendsapplicationGroupsas an array. The endpoint accepts an array; it was being given a single string before.DeveloperServicesAssignAppGroupsOperation.perform()still finds or creates each group concurrently, then sends a single assign request carrying every group ID, and returns the group IDs in the order the entitlements listed them, so the rewritten entitlement is stable between builds.The only caller,
DeveloperServicesAddAppOperation, is unchanged.Related
#324 would report the resulting mismatch between the entitlements and the profile as a clear error at signing time; this change removes the cause, so an app with several groups gets a profile that grants all of them.
Checked
Built on Linux with the Swift 6.4 toolchain and used to sign an iOS app whose main target has two app groups and a Share extension. The app's
embedded.mobileprovisionnow carries both groups and the device installs the app. The same app signed with the unpatched build got one group in the profile andApplicationVerificationFailedon install.🤖 Generated with Claude Code
https://claude.ai/code/session_01UKzxgxaLwK7Ap5LMwj9MxH