App Over-The-Air Installation with HTTPS not working - ipad

I know that in general installation via HTTPS is working but somehow it doesn't in my Environment.
The itms-service link is HTTP as far as I understood:
itms-services://?action=download-manifest&url=http://' . $_SERVER['SERVER_NAME'] . $downloadLink
The links in the .plist are then HTTPS
<key>assets</key>
<array>
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>https://app.ipa</string>
</dict>
<dict>
<key>kind</key>
<string>full-size-image</string>
<key>needs-shine</key>
<true/>
<key>url</key>
<string>https://image_512x512.png</string>
</dict>
<dict>
<key>kind</key>
<string>display-image</string>
<key>needs-shine</key>
<true/>
<key>url</key>
<string>https://image_57x57.png</string>
</dict>
</array>
But the app won't install. I always get the message "App could not be loaded"
All URL's are reachable with HTTP & HTTPS.
XCode shows the app log
unknown securityd[2331] : CFReadStream domain: 12 error: 8
What am I doing wrong here?
Thx

There's not a huge amount of information about how you've tried to solve this, so rather than actual answers I just have questions. If the answer to any of the questions is 'no' then should point you at the area your problem is in.
Is https://app.ipa the actual URL you're using in the .plist? If so I'd try with the full hostname & path in there.
Does the https site have a proper signed valid certificate that Safari on iOS accepts without any interaction with the user? If not try a proper certificate.
Do you see the .ipa file get downloaded from the server, if you check the server log file?
Have you tried installing the .ipa file using iTunes, does it get accepted?

The problem is that the Certificate Authority needs to be known by the iPad.
If you distribute Apps with HTTPS and the CA Server is your own, you need to install the certificate on the iPad. Otherwise iOS will try to download it.
You can install it sending it via email to your iPad or create a .pem File from the Keychain Access program and host it on your server for installation purposes. Then open it with Safari and iOS will ask you to accept it.
Then the installation works. But beware of using .htaccess as using HTTPS and HTTP together in the installation process seems to trigger the login/password for every request, which are 4 for images, .ipa and .plist, which is really annoying.
[EDIT]
Please keep in mind that you need to refer to the .plist file only with HTTPS since Apple introduced iOS 7.1.
See here: Enterprise app deployment doesn't work on iOS 7.1

Related

Fetch (or Axios) in react native not working for expo for iOS apps

iOS doesn't allow to navigate to http only url, allowing only https.
There is a solution, which is changing some code inside info.plist file
https://github.com/facebook/react-native/issues/8717
How can I change settings for iOS, as it comes with only .expo folder but nothing else.
Do I need to change server configuration for this at last? :(
As you properly find out, the problem is that iOS do not allow arbitrary calls to non-secure(http only) domains. It was a feature introduced with iOS 9 in order to push developers onto more secured connections.
As per writing of this(mid 2017), there is workaround. You should open
{Your-project}/ios/{Your-project}/Info.plist
and set proper values for the domain you are targeting(docs).
Following example will disable ATS and allow HTTP call to somedomain.com:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>localhost</key>
<dict>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
</dict>
</dict>
In your situation, I believe you are looking for the Info.plist file in the wrong place. It is not part of the node modules, instead look at the ios path specified above.
Unfortunately Expo doesn't allow you to modify the App Transport Security Settings but may bake in a configuration option. Here's a Github thread.
You can eject from Expo but only do this if you are 100% sure.
This will give you a project very similar to one created by react-native init
This features an ios and android directory, navigating to ios/YourProject/ will reveal Info.plist.
How much of a struggle would it be to install an SSL certificate on your server? It may be more beneficial to do this and you can use a free service like letsencrypt.

APNs not delivered to Ad-Hoc build

I am working with an App which is using Apple Push Notifications.
I have permissions to use Push Notifications granted to the app.
When I was using xCode to install App I was able to receive APNS. However, when prepared ad-hoc build of my application the server (which is using URL = gateway.sandbox.push.apple.com ) was receiving from the service error "Invalid token".
So we decided to provide Production Certificate to server and it caused that there is no error returned but also no notification was delivered.
I have checked also app package and it seems to be OK:
<plist version="1.0">
<dict>
<key>application-identifier</key>
<string>XXXXXX</string>
<key>aps-environment</key>
<string>production</string>
<key>com.apple.developer.team-identifier</key>
<string>XXXXXX</string>
<key>get-task-allow</key>
<false/>
<key>keychain-access-groups</key>
<array>
<string>XXXXXX</string>
</array>
</dict>
</plist>
I am looking for a solution.
I have APN Production Cert in Keychain Access (but without Private Key), but I can obtain a p12 file and import it that way with private key
Maybe URL is wrong (but why it gives no error?)
I will be grateful for any help related to solving my problem.
Kind regards
The problem now was that we have been using for our tester ad-hoc deployment with development provisioning profile. And with X-Code6 there is no longer possible to do such thing. As a workaround we use XCode6 to package everything and XCode5 to export it.

iOS distribution via manifest.plist - using query string parameters in url string?

My company rolls our own distribution platform for iOS apps. Currently our system works well using the following method:
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>http://mydomain.com/app.ipa</string>
</dict>
We're hosting our IPAs on Amazon S3 with no layer of security. Problem is that i'm wanting to add a secure layer, which will involve passing a query string along with the IPA string to enable the download, like this:
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>http://mydomain.com/app.ipa?AWSAccessKeyId=xxxxxx</string>
</dict>
As soon as we add parameters to the url string however, the install will no longer work (the error is "Cannot connect to mydomain.com").
Trying the link directly (with query string) works fine, so it's not an issue with the URL.
Does anyone have any thoughts on how to fix this / work arounds?
Cheers,
Jason
EDIT: Fixed in comment below.
Derp. I seem to have resolved this myself. Encoding the url string (using htmlspecialchars in php) has fixed the issue (characters such as & need to be encoded as &).
Thanks.

iOS Enterprise OTA distribution Unable to Download Application

I created an iOS app and want to distribute it Over-The-Air. I followed this guide:
http://help.apple.com/iosdeployment-apps/mac/1.1/?lang=en-us#app43ad77ea
The App is signed with the enterprise certificate and contains the distribution provisioning profile.
When I try to download the App onto the ipad (using the technique described in this guide), a square icon with my download icon appears on the screen with the name "Waiting...", then a second later the name changes to my actual application name and then again a second later i receive the error message:
Unable to Download Application
"Your Application" could not be downloaded at this time.
in the guide, there are three troubleshooting tips:
if wireless app distribution fails with an “unable to download”
message, check the following:
Make sure the app is signed correctly. Test it by installing it on a
device using iPhone Configuration Utility or Apple Configurator, and
see if any errors occur.
Make sure the link to the manifest file is correct and the manifest
file is accessible to web users.
Make sure the URL to the .ipa file (in the manifest file) is correct
and the .ipa file is accessible to web users.
I checked all three things and they are fine.
What else could cause my download problems?
As alexey mentioned, too many reasons can cause that message. Apple use it as a "catch all errors".
You can diagnose it through the Console. Connect the device to your desktop and access it either from XCode's Organizer (mac only) or iPhone Configuration Utility (mac and windows). But...
It just ain't that simple! :-(
Console may be far from enough. Sometimes there is no relevant message there.
Then, the last resort is following a checklist. Doing all over from zero again. There are many out there... But following there's my generic and non-detailed checklist for Over The Air distribution, at the moment.
Have a Distribution build - This is the most complicated part, done always on the web, and Apple changes the steps all the time. In general, you need a certificate, an identifier and the provisioning profile. Listing devices is almost always required. My current choice is "Distribution -> In House".
P.S.: If you do want to list the devices, make sure the UDIDs are correct. Many issues reported here.
Set the profile under Project -> Build Settings - Since XCode 5, things changed. Instead of code signing with an identity you can clear all that up and set it under *Code Signing -> *Provisioning Profile. The Identity should automatically change to "Automatic". There's also no more need to manually download files from step 1 and install them. XCode manages that now.
Archive - In Xcode 5, there's no need any more to "Build for Archive". Just archive it. It should show up next on Organizer, and it will take some time if it's a big project. Many errors can come up on this step, but they're almost always related to code compilation and not to OTA.
Deploy - Now in Organizer -> Archives, select the proper archive (should be already selected as the most recent one) click on "Distribute", then Save for Enterprise or Ad Hoc Deployment. May be big wait now. When saving the file, there is an option to "Save for Enterprise Distribution". That is a completely misleading name. What it really does is create the plist file. If you have one already, it's fine. You can even manually edit it, which is generally better. The plist be needed for step (5). Here's a good one:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>items</key>
<array>
<dict>
<key>assets</key>
<array>
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>http://example.com/app.ipa</string>
</dict>
<dict>
<key>kind</key>
<string>full-size-image</string>
<key>needs-shine</key>
<false/>
<key>url</key>
<string>http://example.com/FullSizeImage.png</string>
</dict>
<dict>
<key>kind</key>
<string>display-image</string>
<key>needs-shine</key>
<false/>
<key>url</key>
<string>http://example.com/Icon.png</string>
</dict>
</array>
<key>metadata</key>
<dict>
<key>bundle-identifier</key>
<string>com.example.app</string>
<key>kind</key>
<string>software</string>
<key>subtitle</key>
<string>for iOS</string>
<key>title</key>
<string>My App</string>
</dict>
</dict>
</array>
</dict>
</plist>
Distribute - Skip this step if you want to install it using XCode or iPhone Configuration Utility. You're done. This is putting on the file on a web site. "Simply" add a HTML page with a href link such as this:
itms-services://?action=download-manifest&url=http://example.com/app.plist
Unfortunately dealing with web servers is never simple. So also check the server mime-type! I've made a couple PHP files to deal with them, if your server supports php. Just keep your files as they are (the plist, html and ipa) and link to app.plist.php instead:
app.plist.php
$file = fopen("app.plist", "r");
while(!feof($file)){
$line = fgets($file);
print str_replace(".ipa", ".ipa.php", $line);
}
fclose($file);
?>
app.ipa.php
<?php
header('Content-type: application/octet-stream');
$file = fopen("app.ipa", "r");
while(!feof($file)){
$line = fgets($file);
print $line;
}
fclose($file);
?>
Verify - Ensure that all files listed in the assets array are available to download. If any of these files return 404 or such (including the icons) the entire install will fail. You must either (A) make those files available or (B) delete those missing entries from the plist. The icon entries are not required for the download to work.
Here is an example plist with no icons:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>items</key>
<array>
<dict>
<key>assets</key>
<array>
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>http://example.com/app.ipa</string>
</dict>
</array>
<key>metadata</key>
<dict>
<key>bundle-identifier</key>
<string>com.example.app</string>
<key>kind</key>
<string>software</string>
<key>subtitle</key>
<string>for iOS</string>
<key>title</key>
<string>My App</string>
</dict>
</dict>
</array>
</dict>
</plist>
The file examples are a very important part of the checklist. They have to be 100% correct.
Double check the plist and html files!
P.S.: I'm writing this answer because, in my case, it was a "simple" matter of wrong link on the .plist file. And, as such, it's hard as hell to diagnose. Well, only doing this checklist could I find the error! It was pointing to "another-app.ipa" rather than "app.ipa"!
There are a plenty of reasons to cause this message.
The best way to diagnose it is to connect a device to Mac and look Console for the device in Organizer.
In my case, for example, it was:
verify_bundle_metadata: This app was not build to support this device family
Answering my own question:
The problem was that one of the thumbnails did not have the correct path set in the manifest.plist - so not only the ipa needs the correct path, but also the temporary download icons, otherwise the installation will fail with the mentioned error message.
Another Issue that it could be is that both the .plist AND the .ipa need to be hosted with HTTPS and not just regular HTTP. The software package string should look like below:
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>https://example.com/app.ipa</string>
Stupid little oversight but it was tripping me up for awhile.
We did experience the very same error message when trying to install an iOS 5+ app to an iOS4.3.5 phone.
Did you also check deployment/build targets and target architecture to match the device(s) showing that issue?
Make sure the casing is matching in all the files. They tend to be case insensitive.
In my case the issue was on my device an older version of same app was installed with same bundle identifier (downloaded from applstore) so now when I was trying to download its new version via enterprise distribution it was doing nothing, no error at all. Delete existing version from the device solved my issue.
I found in console.
installcoordinationd(MobileInstallation)[99] :
****bundleID****:5:11:1:1:Updating PlaceholderMetadata for
****bundleID**** with failure 1 _LSInstallType 1, underlyingError
(Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code
signature of
/private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.IoCSM9/extracted/Payload/App.app
: 0xe8008016 (The executable was signed with invalid entitlements.)"
UserInfo={LibMISErrorNumber=-402620394,
LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=147,
FunctionName=+[MICodeSigningVerifier
_validateSignatureAndCopyInfoForURL:withOptions:error:], NSLocalizedDescription=Failed to verify code signature of
/private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.IoCSM9/extracted/Payload/App.app
: 0xe8008016 (The executable was signed with invalid entitlements.)}),
source 17>
Here we should look at:
Failed to verify code signature of App.app
The executable was signed with invalid entitlements.
In my case it was because i downloaded enterprise build from amazon. But the provisioning profile, which it was builded with, was expired (figured out in developer console).
Another one with the other purpose:
"This app could not be installed at this time."
UserInfo={NSLocalizedDescription=This app could not be installed at
this time., NSUnderlyingError=0x100cbd3c0 {Error
Domain=MIInstallerErrorDomain Code=64 "Upgrade's
application-identifier entitlement string (BBBUUUU.com.bundle.www)
does not match installed application's application-identifier string
(CCCEEEE.com.bundle.www); rejecting upgrade."
UserInfo={LegacyErrorString=MismatchedApplicationIdentifierEntitlement,
FunctionName=-[MIInstallableBundle
_validateApplicationIdentifierForNewBundleSigningInfo:error:], SourceFileLine=878, NSLocalizedDescription=Upgrade's
application-identifier entitlement string (BBBUUUU.com.bundle.www)
does not match installed application's application-identifier string
(CCCEEEE.com.bundle.www); rejected
Here i just removed the previous version of the app. The error was, because i changed the team for the bundle ID and it was installed the app with previous bundle ID.
Open console with:
Xcode > Window > Devices
Select the device
Expand a console with with a box with an arrow inside of it in the bottom left corner.
Try checking bundle identifier in your XCode and .plist file
In my case I did following to get rid off "cannot connect to dl.dropboxusercontent" message after providing ipa shared link.
1. Removed md5 section from plist
2. Uploaded 512*512 and 57*57 images to drop box, and provided shared link in fill_size_image and display_image in plist.
The first thing to check here is that the device you are installing on has the correct OS for the app your are installing. For instance, if the app is built for iOS 11, and your device has iOS 10 on it, then the app will install but you will see this error "Unable to Download Application".
In my case, there was a problem with incorrect file permissions of the FTP folder and the files inside (manifest, ipa, images). Check that they have 775 (rwx) and that Owner/Group is your owner.
The error in the device console was like "Cannot connect to iTunes Store" or "Failed artwork for bundleID" or "Failed to load placeholder artwork for bundleID". But it's just about the files.

Xcode 4.5 - Wirelessly build app on my device

So recently my iPhone 4 decided to stop working and I can no longer connect it to my Mac or PC with a USB (it'll only charge if I connect it to a USB that's in a wall outlet and I have to push the 30 pin connector upwards while inserting) but that's another issue.
The problem is that I can no longer build and test my app on my device.
I have my device set up with iTunes so I can do a wireless sync. So other than testing my apps on my device the phone is still 100% usable.
I was reading this other post Xcode 4.2 Support Wirelessly Connected Devices that seems to be talking about wirelessly building apps onto devices. But they also say it was removed in Xcode 4.3.1.
I've never actually used this feature in previous Xcode's so i'm not sure if that's what they were actually for/if they worked well or what not.
Basically i'm asking if anyone knows a way to build my apps wirelessly to my device.
I guess I could build make an AdHoc release, put the app file in my iTunes and sync my device there, but at that point I would rather just borrow a friends device to test on.
You can certainly do this. Make your own app store :)
First, build your app to an archive (.IPA) file. Next, export your project PLIST file.
This should look something like this:
<plist version="1.0">
<dict>
<key>items</key>
<array>
<dict>
<key>assets</key>
<array>
<dict>
<key>kind</key>
<string>software-package</string>
<key>url</key>
<string>[URL]</string>
</dict>
</array>
<key>metadata</key>
<dict>
<key>bundle-identifier</key>
<string>com.usaa.FileTransfer</string>
<key>bundle-version</key>
<string>2.21</string>
<key>kind</key>
<string>software</string>
<key>title</key>
<string>File Transfer</string>
</dict>
</dict>
</array>
</dict>
</plist>
Finally:
Ensure that the string entry for [URL] contains the correct path to your archive (IPA).
Create a small HTML page with a download link to that plist file. (see below) Be sure to include the mime-types below!
Navigate to that download link via your iPhone and install!
a href=itms-services://?action=download-manifest&url=YOURURLGOESHERE>Download App
MIME Types
application/octet-stream ipa
text/xml plist
If you try to navigate on anything other than an iPhone you will get an error about the itms protocol not being recognized. You can test this out on your desktop by right clicking the link, and select copy shortcut. Paste into the url browser, and remove the everything except your plist URL location. This should kick off a download on you browser and you should receive the ipa file (which you can uncompress and check out)
Find more info here!

Resources