Code sign failures submitting iOS Air App

Question

Hi folks,
I wondering if any of you might be able to point me in the right direction on this. I'm likewise having issues trying to submit an ipa file to iTunes Connect via Application Loader, and got as far as zipping the .app file and submitting. I get an error in Application Loader that: "Unable to run the lipo command: ... Can't map input file ..." and "Application failed codesign verification. The signature was invalid, contains disallowed entitlements, or was not signed with an iPhone Distribution Certificate.", and "Unable to extract codesigning entitlements from your application. Please make sure ... is a valid Mach executable that's properly codesigned".
Now, before posting here, I have done the following to no avail:
a) I've regenerated all certs and mobile provisions from the top, completely on the Mac once, and completely on Windows as well using openSSL. Both times, I started at the top, from the csr request.
b) I'm able to install and run my ipa file just fine on the test iPhones using the distribution.p12 file and the associated ad_hoc distribution mobile provision. It's always only when I compile for 'app store release', using the distribution.p12 file and the app_store mobile provision that this happens.
c) I'm using Adobe Flash Pro CS6 on Windows 7 64, with Adobe Air 3.3 SDK, and I am submitting on a real Macbook Air with OS X Mountain Lion.
d) I've also gone as far as trying both sets of cert/provisions (generated on mac and windows), by publishing the ipa from within Flash Pro CS6, and also using the adt command line, but still same.. works fine as ad_hoc on the test iPhones, but will not submit through Application Loader. Same codesign verification errors.
e) My app uses native extensions, but these compile and run perfectly fine on the ad_hoc builds.
I'm pulling out my hair at this point as to what I could possibly be missing or doing wrong, or if there is a bona fide bug with the combination of technologies I'm using? I would appreciate any tips/hints/suggestions from anyone who know what I am describing here.
If there is anyone at Adobe that can look at my ipa file build for the app_store submission, that would be wonderful as well.
with kind regards,
Alex

Answer 1

@Marius,
Here's a step by step (verbose) of what I do from the top when I setup for a new client (which I did just 3 days ago). If there's anything here that's different, I recommend you remove everything you have from before and start from scratch, as there are times when some ridiculously unforeseen item left over can affect your setup:
(a) On a Mac, open Keychain Access tool. Go to 'Keychain Access' in the main menu, then 'Certificate Assistant' --> 'Request a Certificate from a Certificate Authority'. On the Certificate information form, enter the email address you used for your iOS Developer Program account, for Common Name, use the name you have associated to your iOS Developer account (i.e. mine was a personal account, so it's just 'Alex Yamane'), leave CA email address blank, and choose 'Saved to disk', and save the .certSigningRequest file generated somewhere handy.
(b) Log into http://developer.apple.com/ with your iOS Developer account. Click on 'Member Center' at the top. Log in. Click 'iOS Provisioning Portal'.
(c) First of all, make sure you remove everything before you start this process. You need to go backwards when you remove everything, so make sure first, you go to the 'Provisioning' section, and remove all Provisioning profiles first (both Development and Distribution). Devices, you can leave alone. Go to the 'Certificate' section and remove all Development and Distribution certificates.
(d) Go to App ID, and create yourself a new AppID for your app, just to make sure so you're using everything fresh from the start.
(e) Now go to 'Certificates', and use the .certSigningRequest file. Also create one for Development using the same .certSigningRequest file. Re-click the tabs for each and they should refresh with your new certs there. Download each one. After you do, I recommend you rename them so you know these are the newest ones you just generated (it usually has a default ios_development.cer and ios_distribution.cer file name. If you haven't yet, make sure you also download the WWDR intermediate certificate if you haven't already.
(f) Go to 'Provisioning' section, and now create a new profile for 'Development'. Then go to the 'Distribution' tab and create one for the app_store and adhoc distributions. Save all 3 provisioning profiles.
(g) On your Mac, open Keychain Access tool. First if you haven't already, go to 'File'->'Import item' and choose the WWDR intermediate cert. Then, do the same for your Distribution Certificate (not Development certificate), I've had tons of trouble in the past when I first was starting out, because Adobe's website keeps talking about the Development cert, but you only need the Distribution Certificate installed (and just use the adhoc provisioning profile to development/test and the appstore provisioning profile for iTunes submission).
(h) Once you've imported your Distribution certificate, there should be an item under the 'login' section of the Keychains column on the left that looks like "iPhone Distribution: Marius Versteegen". Click the arrow next to that and expand it. When you do, you should see a little key icon and your name again. Right mouse on that, and choose "Export 'Marius Versteegen'". Choose file format .p12, and save this file somewhere.
(i ) Now take all of those certs and provision files over to your Windows machine. Fire up Flash Pro. Open your project, and use the new .p12 file for your certificate, and use the new appstore Distribution certificate and compile. You should now have a .ipa file that's ready for iTunes submission.
(j) For me, from this point on, I've described earlier in the thread how I get my .ipa file over to my Macbook Air and upload to iTunes.
Hope this helps,
Alex