Why won't manually built iPadOS .app install? - ios

Question

Rewriting and resubmitting this question after quite a bit of investigation and testing. I did not make the fact that we're trying to avoid Xcode prominent in the original question. I hope there is someone out there with knowledge of building iOS apps without Xcode.
I am only using Xcode to test. We build our one common app for MacOS (our pkg installs fine), Windows, Android, Linux etc with one simple build system. We have no need to break one build out just to use Xcode, unless there is absolutely no choice. We didn't need Xcode for our MacOS app/pkg.
I built, packaged and signed the iOS app with codesign manually using my developer account. I am able to drag and drop my saxzez-client.app onto a iPad Air 2 simulator and I see it installed there. I checked my physical iPad Air 2 and see that my provisioning profile is installed there. I connected my iPad Air 2 to my Mac Mini M1 and I dragged and dropped it onto the iPad Air 2. It fails to install.
Here is the error output I'm getting right now on the iPad Air 2 console:
default 22:55:00.406095-0500 installd com.saxzez.client:7:5:1:1:Start : Install (New)
default 22:55:00.435293-0500 SpringBoard termination assertion efficacy for com.saxzez.client (app not found) changed to 3
default 22:55:00.441904-0500 installd 0x16f553000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 77: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.YRAXDM/extracted/Saxzez-Client.app : 0xe8008015 (A valid provisioning profile for this executable was not found.)
and (grabbed this later)
default 23:03:39.060054-0500 securityd trustd[116]/1#11 LF=0 copy_parent_certificates Error Domain=NSOSStatusErrorDomain Code=-34018 "Client has neither application-identifier nor keychain-access-groups entitlements" UserInfo={numberOfErrorsDeep=0, NSDescription=Client has neither application-identifier nor keychain-access-groups entitlements}
default 23:03:39.060822-0500 securityd trustd[116]/1#11 LF=0 copy_parent_certificates Error Domain=NSOSStatusErrorDomain Code=-34018 "Client has neither application-identifier nor keychain-access-groups entitlements" UserInfo={numberOfErrorsDeep=0, NSDescription=Client has neither application-identifier nor keychain-access-groups entitlements}
default 23:03:39.062453-0500 trustd cert[0]: IssuerCommonName =(path)[]> 0
default 23:03:39.063467-0500 installd Trust evaluate failure: [leaf IssuerCommonName LeafMarkerOid SubjectCommonName]
Here is the codesign command usage:
codesign -f -s "Apple Development: Bob Smith (XXXXXXXXXX) " Saxzez-Client.app
My Info.plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDisplayName</key>
<string>Saxzez Client</string>
<key>CFBundleIdentifier</key>
<string>com.saxzez.client</string>
<key>CFBundleVersion</key>
<string>1.0.423</string>
<key>CFBundleShortVersionString</key>
<string>1.0.423</string>
<key>CFBundleExecutable</key>
<string>Saxzez-Client</string>
<key>CFBundleIconFiles</key>
<array>
<string>our-icon</string>
</array>
<key>LSRequiresIPhoneOS</key>
<false/>
<key>UIRequiredDeviceCapabilities</key>
<array>
<string>arm64</string>
<string>metal</string>
<string>wifi</string>
</array>
<key>UIRequiresPersistentWiFi</key>
<true/>
<key>UILaunchImageFile</key>
<string>our-icon</string>
<key>CFBundleName</key>
<string>Saxzez Client</string>
</dict>
</plist>
My Saxzez-Client.app directory contains the following:
ls -R
Saxzez-Client Info.plist _CodeSignature our-icon.png embedded.mobileprovision en.lproj
./_CodeSignature:
CodeResources
./en.lproj:
InfoPlist.strings

Answer 1

Well, I used this tool to sign the app I built: https://dantheman827.github.io/ios-app-signer/ and my app installed perfectly! So, it has to be something to do with the codesign cert I'm using or something related. The great news is I didn't need to use Xcode :). It's late, so I'll post the actual fix uncovered by ios-app-signer tomorrow.
btw, I am building and packaging on my new Mac M1, just not using Xcode. Once I have a template for the basic .app structure, I hope to only use Xcode to testing on simulators and pushing to my iPad Air 2. Same for MacOS and Android (no Android Studio for building/packaging).
Update:
It was the entitlements.plist file that is needed by codesign. Once I got the generated entitlements.plist file from the ios-app-signer tool, I can sign from the command line, zip it up into a .ipa file and it installs perfectly on the physical iPad Air 2.