3

We are testing a scenario and iPad seems to take the new provisioning profile all the time even if we install app that is signed with old provisioning profile.

We have a provisioning profile that expires end of this month. So, we renewed it and it is due to be pushed by MDM. We wanted to test it before we do that, so we tried to replicate the scenario. We generated an iPa that is signed to old PP, pushed via MDM and downloaded it. Now, if we change the date of the iPad to future date, it should crash as PP is not valid. But, it still works.

We tried installing the app with new renewed PP via crashlytics and it worked as per our expectation. Now, we trying to test it via MDM and it works all fine even if you change it to future date.

Our suspicion is somewhere iPad stores the new PP of our app, and it supersedes the old PP which results in app working all the time.

My question here is, Can we check the PP of a particular App installed in iPad? Does it not get deleted from the iPad if we delete the app? Can we delete the PP manually from iPad? If so, how?

Any help is much appreciated.

nOOb iOS
  • 1,384
  • 2
  • 19
  • 37

3 Answers3

5

To elaborate a bit on @battlemonstr's answer, the provisioning profile is bundled with the .ipa when you package (in an embedded.mobileprovision file) so that the iOS device can install the PP on the device when the app is installed. After installation from the .ipa, the embedded PP is irrelevant - it becomes just another PP installed on the device. When you first try to run the app, iOS will check if there is a valid PP on the device that would allow the app to run. It can be the one installed with the app, but there is no reason it has to be. In other words, the installed app does not have anything that requires it to use the PP that was bundled with it in the .ipa file.

When you delete the app, it does not touch the PPs installed on the device. So if you installed a version of the app previously, and it had an embedded PP that didn't expire until the end of the year, installing a new version of the app with a PP that is already expired will not prevent the app from running, since the device has a PP that is valid for the app that won't expire until the end of the year.

You can see the provisioning profile on the device in the Xcode devices window. Right-click on the device and select "Show Provisioning Profiles..." Note that iOS will try to clean up old provisioning profiles that have expired from time to time, so some old ones might be gone.

wottle
  • 13,095
  • 4
  • 27
  • 68
  • I have checked the list of a provisioning profiles installed on my device and I couldn't find a provisioning profiles corresponding to an apps downloaded from the AppStore. So, that means that the IPA which are downloaded from the AppStore comes without provisioning profile selected by the developer. It's interesting – Blazej SLEBODA Aug 29 '18 at 21:49
  • Yes, app distributed from the App store are re-signed by Apple when you publish them, as you wouldn't want normal users to have to trust the developer every time they download an app from the app store from a new developer. The provisioning profile is a mechanism for distributing development and ad hoc builds to a limited number of devices. It introduces enough friction to prevent people from using it to create their own app store with ad hoc signed apps. – wottle Aug 29 '18 at 21:56
  • So why to force a developer to create and select a distribution provisioning profile for AppStore when submitting an app to the AppStore. Wouldn't it be simpler to accept signed app without a provisioning profile ? – Blazej SLEBODA Aug 29 '18 at 22:00
  • Because in theory, if the developer protects their private key for their distribution certificate, it ensures that only the rightful developer can sign the app for submission. It's to protect Apple if their site gets hacked and someone steals the certificate stored on developer.apple.com. The hackers still wouldn't have the private key, so they wouldn't be able to submit a malicious version of the app to the store. – wottle Aug 30 '18 at 01:46
  • Also, the provisioning profile ensures that the developer has to deliberately select which entitlements the app is going to use. – wottle Aug 30 '18 at 01:47
1

A provisioning profile is a file that confirms a permission from Apple to run app X from an app developer developer Y on a device Z. X can also be a set of apps, but for production case usually it is just a single app ID. Z can also be a set of devices, and for production it is usually the case.

Think of a PP as of a kind of a certificate signed by Apple that anyone can verify.

Can we check the PP of a particular App installed in iPad?

I think that a copy of a PP is located inside the app bundle, so if you can make a backup of the device and somehow extract it, you might find it there. (see also How to find out what profile was used for building *.ipa file? )

Does it not get deleted from the iPad if we delete the app?

Probably not, at least not always. They are installed into some special system's location.

Can we delete the PP manually from iPad?

The Settings app has a section "General > Profiles and Device management" which normally has a list of installed profiles (see https://apple.stackexchange.com/questions/221052/ios-9-2-my-general-profiles-and-device-management-is-gone ). I don't know the exact rules about it, but on my 2 devices this "Profiles and Device management" section is hidden. Some people also mention that if you connect a device to a Mac with Xcode, then in the "Devices" tool/pane you can also get a list of installed profiles (see https://forums.developer.apple.com/thread/45086 ).

From your description it seems that both your old app and your new app version are working, because the system has found a valid PP for both of them (inside the new app), and saved it.

battlmonstr
  • 5,841
  • 1
  • 23
  • 33
0

You can see what PP's are installed for an app on an iOS device, and delete them as necessary, via "Windows/Device and Simulators"

Then right click on your device, and select "Show Provisioning Profiles..."

You can then add or delete as required from there.

Make sure to kill the app on the iOS device before launching (double click Home button and swipe up your app), otherwise it will just use the one in memory which will work as before your latest install.