How to resign a third-party .ipa file to run it on a real iOS device

Preparation

Obtain the provisioning profile which includes the devices you want to run the application on.

Provisioning profiles on a Mac OS machine are located at

~/Library/MobileDevice/Provisioning Profiles

To install a provisioning profile on a device and add the device to the provisioning profile

1. Connect the device via USB

2. In XCode open Devices (Window > Devices and Simulators)

3. Right click your device in the side bar and choose Show Provisioning Profiles.

4. In the opened dialog click + button and choose your provisioning profile. It should be added to the list.

Resign Method 1: using fastlane utility

Step 1

Install fastlane if not already installed.

brew install fastlane

It may take a while (hours in some cases as it will be downloading and compiling components).

Step 2

Create a `fastlane` directory and a text file `Fastfile` inside it. Put the following contents inside the file.

lane :resignipa do
  resign(
    ipa: "path-to-your-ipa-file.ipa",
    signing_identity: "iPhone Developer: <Name>",
    provisioning_profile: "path-to-you-provision-file.mobileprovision",
  )
end

All paths must be relative to the directory containing the `fastlane` directory.

Step 3

In the directory containing the `fastlane` directory run

fastlane resignipa

This command must replace the signature in your .ipa file.

Here is the example of the output:

Resign Method 2: manual

Let's assume we downloaded calculator.ipa from

https://github.com/bitbar/test-samples/blob/master/apps/ios/calculator.ipa

Step 1

Unzip it with command.

unzip calculator.ipa -d calculator

Step 2

Remove old signatures. In general case signatures must be removed from all Framework and Plugin items.

codesign --remove-signature calculator/Payload/calculator.app  
codesign --remove-signature calculator/Payload/calculator.app/Frameworks/IDEBundleInjection.framework  
codesign --remove-signature calculator/Payload/calculator.app/Frameworks/XCTest.framework
codesign --remove-signature calculator/Payload/calculator.app/Frameworks/*.dylib

Step 3

Obtain entitlements file to use it during signing process.

security cms -D -i path/to/MyProfile.mobileprovision > provision.plist

This command will create an XML export of your provisioning profile. Then let's extract entitlements.

/usr/libexec/PlistBuddy -x -c 'Print :Entitlements' provision.plist > entitlements.plist

It will result in creation of entitlements.plist file.

Step 4

Replace the existing provisioning profile (i.e. embedded.mobileprovision) with your own.

cp path/to/MyProfile.mobileprovision calculator/Payload/calculator.app/embedded.mobileprovision

Step 5

Sign the application with your development certificate (included into the provisioning profile) and the entitlements.plist. Note that you need to sign the app and all included frameworks and plugins.

codesign -f -s "iPhone Developer: <Name>" --entitlements entitlements.plist calculator/Payload/calculator.app  
codesign -f -s "iPhone Developer: <Name>" --entitlements entitlements.plist calculator/Payload/calculator.app/Frameworks/IDEBundleInjection.framework
codesign -f -s "iPhone Developer: <Name>" --entitlements entitlements.plist calculator/Payload/calculator.app/Frameworks/XCTest.framework
codesign -f -s "iPhone Developer: <Name>" --entitlements entitlements.plist calculator/Payload/calculator.app/Frameworks/*.dylib

The development certificate must be installed in the keychain and trusted.

Step 6

Zip the application back.

cd calculator && zip -r ../calculator-resigned.ipa *