title: How do I resign app with entitlements?
body: <p>I have an .ipa file which I need to resign. I tried doing it as explained on the <a href="https://www.objc.io/issues/17-security/inside-code-signing/" rel="noreferrer">objc.io blog</a>:</p>
  
  <pre><code>$ codesign -f -s 'iPhone Developer: Thomas Kollbach (7TPNXN7G6K)' Example.app
  </code></pre>
  
  <p>However this is insufficient. When I do codesign I get something like this:</p>
  
  <pre><code>$ codesign -d --entitlements - Example.app/Example
  Executable=/Users/myuser/Payload/Example.app/Example
  </code></pre>
  
  <p>I don't get any entitlements listed.</p>
  
  <p>However if I do <code>codesign -d --entitlements</code> on the original IPA file from xCode I get:</p>
  
  <pre><code>&lt;plist version="1.0"&gt;
  &lt;dict&gt;
      &lt;key&gt;application-identifier&lt;/key&gt;
      &lt;string&gt;UFAYDHAUP.com.company.example&lt;/string&gt;
      &lt;key&gt;aps-environment&lt;/key&gt;
      &lt;string&gt;production&lt;/string&gt;
      &lt;key&gt;beta-reports-active&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;com.apple.developer.team-identifier&lt;/key&gt;
      &lt;string&gt;UFAYDHAUP&lt;/string&gt;
      &lt;key&gt;get-task-allow&lt;/key&gt;
      &lt;false/&gt;
      &lt;key&gt;keychain-access-groups&lt;/key&gt;
      &lt;array&gt;
          &lt;string&gt;UFAYDHAUP.com.company.example&lt;/string&gt;
      &lt;/array&gt;
  &lt;/dict&gt;
  &lt;/plist&gt;
  </code></pre>
  
  <p>I tried the line below </p>
  
  <pre><code> codesign --entitlements Example.app/archived-expanded-entitlements.xcent -f -s 'iPhone Developer: Thomas Kollbach (7TPNXN7G6K)' Example.app
  </code></pre>
  
  <p>But the following keys are not included:</p>
  
  <ul>
  <li>beta-reports-activ </li>
  <li>get-task-allow</li>
  </ul>
  
  <p>So how am I supposed to do this? I don't have an entitlements file, in xCode 7, one only checks Capabilities. And all I have is Apple Push notifications.</p>
  
  <p>Finally to clarify my requirements:</p>
  
  <ol>
  <li>I will not change App ID or use different provisioning profile or code signing identity compared to what xCode exports. </li>
  <li>Only the main executable is changed with a tool, which is why a resign is needed. </li>
  </ol>