Signature cannot be verified

[adsantos]

Description

I updated to Firebase 10.24.0 and consequently updated GoogleDataTransport, GoogleUtilities and nanopb using the xcframeworks you provide. For these three frameworks, I got an error saying that the signature cannot be verified, so the project doesn't build. Could you please check if this is an issue on your side?

Reproducing the issue

No response

Firebase SDK Version

10.24.0

Xcode Version

15.0

Installation Method

Swift Package Manager

Firebase Product(s)

Crashlytics

Targeted Platforms

iOS

Relevant Log Output

No response

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[paulb777]

This may be related to #12740. Please take a look.

Also, please clarify the information in the issue template. The Swift Package Manager distribution distributes those three packages as source, not as xcframeworks.

[adsantos]

I used cp -rfP as suggested in #12740.
Instead of three frameworks having a signature that cannot be verified, now it's only one: nanopb.xcframework. Is there anything else I could try?
My flow was to download the xcframeworks from https://github.com/firebase/firebase-ios-sdk/releases/tag/10.24.0
Then I added them into our internal SPM.

[adsantos]

Here is a screenshot of the framework added to the project, which isn't working.

[ncooke3]

If the new version frameworks are being placed at the same path of where the old version frameworks, I believe this might happen. Xcode must have some cache and may be thinking that the old version's signature has been compromised when the new version is copied.

I would recommend doing a fresh install (remove the dependency from the app target), delete derived data, and try re-adding the dependencies.

[adsantos]

@ncooke3 I tried that, but I continue having the same error. I also tried with a different simulator and deleted any old version of the app from the simulator.
Besides deleting derived data, can you think of anything else I might need to delete to make sure I'm in a clean state?

[ncooke3]

@adsantos, there are some SPM caches they may also need to be cleared. Take a look at this answer: https://stackoverflow.com/a/72838880/9331576

[olejnjak]

Well Carthage distribution suffers this issue as well, but not sure those solutions are actually applicable 🤔

[ncooke3]

@olejnjak, are the solutions in #12740 helpful?

[olejnjak]

As I am thinking a bit more about it, it might be connected to our caching tool, that zips and unzips the framework. I will eventually report back if I found other problems.

[adsantos]

@ncooke3 I deleted the SPM caches, derived data, I renamed the dependency in Package.swift, I added another framework just to make the structure changed, I removed the SPM dependency and put it back. Nothing seems to work.
If I add the frameworks directly into the project, then the signatures are valid, but not when I add them via SPM.
I'm running out of ideas. Does anyone have any more suggestions?

[adsantos]

These are the frameworks I deleted:

rm -r FBLPromises.xcframework
rm -r FirebaseABTesting.xcframework
rm -r FirebaseAnalytics.xcframework
rm -r FirebaseCore.xcframework
rm -r FirebaseCoreExtension.xcframework
rm -r FirebaseCoreInternal.xcframework
rm -r FirebaseCrashlytics.xcframework
rm -r FirebaseInstallations.xcframework
rm -r FirebaseMessaging.xcframework
rm -r FirebasePerformance.xcframework
rm -r FirebaseRemoteConfig.xcframework
rm -r FirebaseRemoteConfigInterop.xcframework
rm -r FirebaseSessions.xcframework
rm -r FirebaseSharedSwift.xcframework
rm -r GoogleAppMeasurement.xcframework
rm -r GoogleAppMeasurementIdentitySupport.xcframework
rm -r GoogleDataTransport.xcframework
rm -r GoogleUtilities.xcframework
rm -r GTMAppAuth.xcframework
rm -r GTMSessionFetcher.xcframework
rm -r nanopb.xcframework
rm -r Promises.xcframework

I then added them in two ways: rsync -a and cp -rfP. In both cases, the signature ended up as not valid when I install them via SPM.

[paulb777]

We don't support a mix of the binary distribution and SPM, so will likely need a fully reproducible example to help.

[google-oss-bot]

Hey @adsantos. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!