Error reference
Apple signing errors, and how to actually fix them
One page per error message, written for the moment you have pasted the string into a search box and your build is broken. Each page opens with the verbatim message and the short answer, then explains the cause and the fix for both local machines and CI runners.
codesign wants to access key in your keychain
macOS is asking for permission before letting codesign use the private key. Harmless locally, fatal on CI, where nobody is there to click the button.
Xcode couldn't find any provisioning profiles matching
Xcode looked for a development provisioning profile covering your bundle ID and found nothing usable, so it stopped before building.
Command CodeSign failed with a nonzero exit code
A wrapper Xcode prints when the codesign step exits non-zero. The actual reason is printed above it, and that is the string you need.
Signing requires a development team
Some target in the build has no team ID set. On CI it means the setting only ever existed in the local project file, and on Xcode 14 and later it is often a Swift package resource bundle.
No signing certificate "iOS Distribution" found
Xcode searched every keychain for a distribution certificate belonging to your team that also has a usable private key, and came up empty.
Provisioning profile doesn't include signing certificate
A provisioning profile freezes the list of certificates it authorizes at the moment it is created. Yours was issued later, so the profile has never heard of it.
Provisioning profile has app ID which does not match the bundle ID
The provisioning profile being used covers a different App ID than the bundle identifier the target is building with. Usually a per-configuration suffix or a stale profile pinned in build settings.
Code signing is required for product type 'Application'
Xcode is building for a real device and the target has no team, no identity, and no profile. There is nothing to sign with, so the build stops.
resource fork, Finder information, or similar detritus not allowed
A file inside the bundle has an extended attribute, usually com.apple.FinderInfo or a resource fork, that codesign has refused to sign since macOS Sierra.
A valid provisioning profile for this executable was not found
The device read the profile embedded in the app and rejected it. The build succeeded, so the problem is in the profile itself: device list, expiry, or profile type.
errSecInternalComponent
A generic Security framework failure that in practice means one thing: codesign was refused access to the private key it needs.
No profiles for 'com.example.app' were found
xcodebuild is signing manually and cannot find an installed profile for the bundle ID and team in the message. On CI that usually means nothing installed it.
Your session has expired. Please log in.
The Apple ID web session fastlane was using is no longer valid. Almost always a CI job still authenticating with a username and password instead of an API key.
Missing private key for signing certificate
The certificate is in your keychain but the private key that pairs with it is not, so it can verify signatures and never create one.
The certificate used to sign your app has expired or been revoked
The signing certificate is no longer usable. Expiry and revocation produce the same message and need different responses, so check which one happened before doing anything.
The executable was signed with invalid entitlements
The entitlements baked into the signature are not a subset of what the provisioning profile authorizes, so the device refuses to install the build.
No such provisioning profile was found for that UUID
The project pins a profile by UUID, and no profile with that UUID is installed. Regenerating a profile changes its UUID, so this often appears right after a renewal.
Provisioning profile doesn't include the selected device
Development and Ad Hoc profiles carry a fixed list of device UDIDs. This device is not on it, either because it was never registered or because the profile predates the registration.
Failed to register bundle identifier
Apple refused to register the App ID because that bundle identifier is already claimed, either by another team or by an account you have forgotten about.
The code signature version is no longer supported
The app, or something embedded in it, carries a signature in a format modern iOS and macOS refuse. Re-signing on a current toolchain is the fix, not a new certificate.