Adobe Air SDK 29 is not accepted by Apple

[gameduchy]

IOS is blocking AIR, rejected for months,due to AIR has API using IOPSCopyPowerSourcesInfo

Our mobile game uses FLash, and AIR 29 to make it work on IOS devices,

However, we can't upgrade our game since half year ago, and Apple review team finally told us the reason:

REJECTED：

Thanks for your resubmission.

Guideline 2.5.1 - Performance - Software Requirements

Your app uses or references the following non-public APIs:

_IOPSCopyPowerSourcesInfo, _IOPSCopyPowerSourcesList, _IOPSGetPowerSourceDescription

The use of non-public APIs is not permitted on the App Store because it can lead to a poor user experience should these APIs change.

Continuing to use or conceal non-public APIs in future submissions of this app may result in the termination of your Apple Developer account, as well as removal of all associated apps from the App Store.

Next Steps

If you are using third-party libraries, please update to the most recent version of those libraries. If you do not have access to the libraries' source, you may be able to search the compiled binary using the "strings" or "otool" command line tools. The "strings" tool can output a list of the methods that the library calls and "otool -ov" will output the Objective-C class structures and their defined methods. These tools can help you narrow down where the problematic code resides. You could also use the "nm" tool to verify if any third-party libraries are calling these APIs.

Resources

For information on the "nm" tool, please review the "nm tool" Xcode manual page.

If there are no alternatives for providing the functionality your app requires, you can file an enhancement request.

Then we found it's in AIR sdk, even 29.

Then we replied:

The earlier letter said our app has the following non-public APIs:

"_IOPSCopyPowerSourcesInfo", "_IOPSCopyPowerSourcesList" and "_IOPSGetPowerSourceDescription".

We checked the ipa file with the tools you suggested.

"nm" and "oTool" found none.

The tool "strings" only found "IOPSCopyPowerSourcesInfo", "IOPSCopyPowerSourcesList" and "IOPSGetPowerSourceDescription" (non-underlined) referenced.

After searched the non-underlined version from the apple develop center, we thought they are public APIs.

However, we never called them.

These were found in the popular SDK Adobe AIR, and were alone there for years.

We haven't got any alternatives beyond Adobe AIR.

[SangHee]

I tested ipa built with a certificte and provisioning for development using air 29.0.0.122.

I tried to install ipa for development on the device - iPhone 6 Plus ( ios 10.2 ) and iPhone X ( ios 11.1.2 )

but failed to install.

The console log is the following.

Please help me!

I have a big issues in my game but am not updating it.

기본 21:02:41.615742 +0900 installd entitlement '<private>' has value not permitted by provisioning profile '<private>'

기본 21:02:41.615862 +0900 installd entitlement '<private>' has value not permitted by provisioning profile '<private>'

기본 21:02:41.616187 +0900 installd 0x16f10f000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 147: Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.n9JRdT/extracted/Payload/*****.app : 0xe8008016 (The executable was signed with invalid entitlements.)

기본 21:02:41.616274 +0900 installd 0x16f10f000 -[MIInstaller performInstallationWithError:]: Verification stage failed

기본 21:02:41.616749 +0900 assertiond Client relinquished <BKTerminationAssertion: 0x104300540; "FBSApplicationTerminationAssertion" (Unconditional); 49:(null) id:…2D89E200EBE2>

기본 21:02:41.616868 +0900 assertiond -[BKAssertion dealloc] - <0x104300540>

기본 21:02:41.661295 +0900 installd *****.*****.*****:7:5:2:0:Fail (End) : Install (New)

기본 21:02:41.661833 +0900 lsd (null):5:1:2:0:MobileInstallation returned nil for file:///var/mobile/Media/PublicStaging/*****.ipa/

기본 21:02:41.662326 +0900 mobile_installation_proxy (null):5:1:2:0:_LSInstallationManager install:withError finished

기본 21:02:41.662680 +0900 mobile_installation_proxy Connection invalidated to installationCallbackInterface

기본 21:02:41.662782 +0900 mobile_installation_proxy 0x16b2cb000 handle_install: Installation failed: Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.n9JRdT/extracted/Payload/*****.app : 0xe8008016 (The executable was signed with invalid entitlements.)" UserInfo={LibMISErrorNumber=-402620394, LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=147, FunctionName=+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:], NSLocalizedDescription=Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.n9JRdT/extracted/Payload/*****.app : 0xe8008016 (The executable was signed with invalid entitlements.)}

[JulianDMG]

I was able to workaround the Ad Hoc issue by resigning the IPA using codesign. Here's my solution but keep in mind that my app doesn't use any dynamic Frameworks, so the signing the app is very straight forward. I understand the process of signing is more complex when you have dynamic Frameworks but I don't know for sure.

Anyways, I simply used the commands below to resign the IPA on a MAC (sorry, no windows solution).

# Note: The command are executed in the directory where the IPA is stored. That's why there are no path references. Also, make sure

# you change references to MyApp.ipa, MyApp.app and "My iPhone Distribution Identity" to the correct values for you app.

# "My iPhone Distribution Identity" is usually something like "iPhone Distribution: My Company Name"

#Unzip the IPA Payload

unzip -q  MyApp.ipa

#Extract the current entitlements

codesign -d --entitlements :entitlements.plist "Payload/MyApp.app"

#Delete the unsupported beta-reports-active entitlement for Ad Hoc builds

/usr/libexec/PlistBuddy -c "Delete :beta-reports-active" entitlements.plist

#Remove the current signature

rm -rf "Payload/MyApp.app/_CodeSignature"

#Signs the app using the updated entitlements. Make sure that your distribution certificate is in your keychain

codesign -f -s "My iPhone Distribution Identity" --entitlements entitlements.plist Payload/MyApp.app

# Zips the resigned IPA. The new Ad Hoc app that you'll be able to install is MyApp-resigned.ipa

zip -qr MyApp-resigned.ipa Payload/

[Flipline]

Good to see that removing the "beta-reports-active" entitlement does indeed fix this issue.

Amrita Gangwani​ any idea when a new release of AIR will be ready that stops this bug of automatically adding the "beta-reports-active" entitlement to adhoc builds?  As others have mentioned, this was introduced in the the most recent release last Tuesday, and no previous version of AIR automatically added this to adhoc builds.

[dimonte]

Thanks @ everyone at Adobe. Our build just passed the review with the latest AIR SDK.

[rikl14421868]

Great work, thanks! Now if you could also look at the following issue we can prevent the next big wave of app rejections and/or apps being labeled as unsafe/breaking privacy law and ruining their search rankings, thanks!

Prevent network call on app start to https://airdownload2.adobe.com (violates GDPR law)

I've also created a bug tracker here: Tracker

[dmitrybez]

I think we are having the same problem with ad-hoc ipa. I can't install it on the test devices.

Also the store ipa don't want to install. We have two developer programs, one for inhouse Enterprise and one normal Apple developer program.

When I use branch with AIR 27 everything is ok. When I try to build with AIR 29.0.0.122 with adding Assets.car it is not showing icon and and is grey after installation. Tapping it gives me can't install or redownload error. I've tried to install it throw hockey app uploading builds. Also using iTunes or Xcode.

Maybe somebody had that problem? Is it related to AIR 29 SDK?

[dmitrybez]

The most informative error I've got is

The entitlements specified in your application’s Code Signing Entitlements file are invalid, not permitted, or do not match those specified in your provisioning profile. (0xE8008016).

According to this documentation the Entitlements should match the one that are turned on for app ID on developer.apple.com (they are embeded into provision.profiles)

https://developer.apple.com/library/content/technotes/tn2415/_index.html

Not sure how they are build into the app bundle. Will compare between AIR 27 and 29.

Checked the provision profiles. They are the same for AIR 27 and 29.

But the App itself is signed differently.

Using command for unpacked bundle

codesign -d --ent :- ~/Downloads/Bundle/App.app/

Found that in AIR 29.0.0122

App is singed with additional Entitelments

<key>beta-reports-active</key>

        <true/>

That's why I can't install them on all of my test devices. I'm using mac to build apps.

[JulianDMG]

I'm experiencing the exact same issue that prevents ad hoc builds created with AIR 29.0.0.122 to be installed  and as you correctly pointed out, it is caused by the beta-reports-active, which is not supported for ad hoc provisioning profiles.

[dmtkuyuk]

Hi Everyone,

I am developing an app using Adobe Animate CC 2018. But i can't upload my app on a ios 11 device. I uploaded other old ios devices, there is noı problem. But if i want to upload on a ios 11 device, it has an error.

What can i do?

Is this problem fixed?

[dmitrybez]

Hello,

We found that problem with development build was with developer certificate and provision profile.

But our Enterprise Inhouse builds still does not work.

Also the Appstore build with AIR 29 can't be installed on test devices. AIR 27 works.

We found one interesting error in console.

entitlement ‘<private>’ has value not permitted by provisioning profile ‘<private>’

Previously we were thinking it was related to the beta-reports-active

But this Entitlement beta-reports-active is in appstore distribution provision profile and should be in Appstore binary.

Does anyone have an idea what can it be? We can't submit our app even with the updated AIR 29 SDK.

Maybe @Adobe can backport that fix for IOPS into AIR 27 and yearly?

[dmitrybez]

Hello, sorry that I still writing to this thread, but I think that issue with adhoc is related to latest AIR 29 build

We were able to install builds to our devices with AIR 27 and AIR 28

I've submitted a bug ticket

Tracker

If somebody has a workaround will appreciate that.

[amritag9336052]

Hi,

Thanks for reporting the issue. The issue seems to be due to an unwanted tag in your Entitlements.plist. You may try following options:

1) Remove the existing provisioning and re-generate the provisioning from the iOS Provisioning portal and try packaging again

OR

2) If you've added the following tag in your application XML

     <key>keychain-access-groups</key>

        <array>

        <string>(your app id)</string>

        </array>

Try packaging the application after removing the tag. The tag is only needed to share keychain access across apps created by the same group.

[JulianDMG]

The solutions you suggested didn't work for me. I've made sure to generate a new ad hoc provisioning profile and directly inspected it to ensure that there are not unwanted entitlements. Also, in my application descriptor XML there are no <key>keychain-access-groups</key> tags.

After packaging the application, I keep getting the installation issue and the installation fails warning about an entitlements problem. When I use codesign to check the entitlements  in my application I found that the entitlement below was added:

<key>beta-reports-active</key>

<true />

Of course that entitlement is not in my provisioning profile with 100% certainty because as I stated above, I directly inspected the new provisioning profile I generated. This makes because Apple doesn't allow beta-reports-active for Ad Hoc or development provisioning profiles: Technical Q&A QA1830: The beta-reports-active Entitlement

beta-reports-active is being added by ADT when it packages and signs the Ad Hoc app. That is the issue you need to address. ADT is arbitrarily adding an entitlement without verifying what's in the provisioning profile.

[amritag9336052]

Hi,

The ad-hoc provisioning profile issue is known to us. We are working on it.

There should not be an issue with the developer provisioning profile.

Thanks.

[grkuhn]

Waiting the fix on SDK 29 to keep delivering Enterprise/Ad Hoc apps for 32bit devices.

[rewb0rn]

@grkuhn: You can use the latest Air 30 Beta SDK from May 17, Adobe reverted the change about 64 bits and now you can build universal (with 32 bits) apps again.

[grkuhn]

@rew0rn - thanks for the infos, I didn't know Air 30 is supporting 32 bits, anyway we fixed the Enteprise/Ad Hoc distribution on Air 29 removing the entitltement "beta-reports-active" from the plist, as decribed by some member here in the forum.

After the final version of Air 30 we can move ahead.

[grkuhn]

We still have problems to sign application using Enterprise/Ad Hoc distribution using Adobe Air SDK 30. Any chance to be fixed by Adobe, the problem was related with the entitlement "beta-reports-active" added to plist

[Marko Pelovic]

Hi all,

Using AIR SDK 30 (version 30.0.0.107) - the original AIR SDK without the new compiler,

we still have problems uploading builds on Apple Store (using Application Loader).

Please find attached image for error check:

It seems that now "Expired Certificate" issue is solved - but we have new issue which not allow to upload IPA on AppStore at all.

Thank you in advance for your support.

[Flipline]

Hmm we haven't been having any problems with submissions using AIR 30 (using adt on the command line for builds), are you using adt as well or was it built with Animate?  I did get a similar error a while back when I made a mistake generating a new p12 from a new distribution certificate, it might be worth a try regenerating your p12 file, and also double-checking that you're using a distribution certificate and not a development one.

[Marko Pelovic]

Yeah, of course I check the certificates, and all the setup was correct.

I create builds with Flash Builder - Export Release Build, so I don't use adt command line.

BTW - I solve the issue, and this thread help me a lot.

I basically had AIR 29 (build 112) before, and I was rejected on Apple Store because of "non-public APIs" (as mention on top of this thread)... but then I download latest AIR 29 (build 122) - (also mentioned in previous posts), and now the build is uploaded, and status is Waiting For Review.... so will see.

Note: Although with the latest AIR 29 (build 122) the "Expired Certificate" WARNING is still there when uploading IPA with Application Loader.

[chac_aqua]

I'm having the same issue.

I build against Air 29 as Adhoc and I can't install on a device. I build against Air 26 as Adhoc and everything is fine.

If I build against Air 29 as an AppStore build, will it be safe to submit?

[DannyKodicek]

Hi - we're trying to use the new Air29 build; it's compiling fine to a swf but we're getting the following error when we try to package it for iOS using our Developer profile:

ld: unsupported address encoding (D0) of personality function in CIE for architecture arm64

Compilation failed while executing : ld64

It's compiling fine with Air 28. As I understand it, this is a problem with getting Windows to talk to iOS - has anyone successfully used the SDK to make a build through Windows?

[peter_nicolai_123]

It looks like you guys released this on the main download site, this means we can consider this production-ready?

https://www.adobe.com/devnet/air/air-sdk-download.html

[Colin Holgate]

It seems to be the same build number and modified date as the build that has the Ad Hoc issue, but it's no doubt as good as what was there before, and you can at least submit apps to Apple with it.