<p>These steps in the Azure DevOps docs may be helpful: <a href="https://docs.microsoft.com/en-us/azure/devops/pipelines/apps/mobile/app-signing?view=azure-devops&amp;tabs=apple-preinstall#configure-your-build" rel="nofollow noreferrer">Sign Your Mobile App</a>.</p>

<p>Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building.  No UUID should be needed for the agent.  <a href="https://neillans.dev/setting-up-an-ios-build-on-azure-devops/" rel="nofollow noreferrer">Here's a guide</a> that may be useful (it's targeting iOS, not macOS but the concept is the same).</p>

<p>The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: <a href="https://docs.microsoft.com/en-us/azure/devops/pipelines/ecosystems/xcode?view=azure-devops#deploy" rel="nofollow noreferrer">Deploy Documentation</a>.</p>

CC BY-SA 4.0
2019-09-23T21:30:30.990Z
This is very nice to know, but I don't see where it shows how to get past the problem I'm having
Ky -
CC BY-SA 4.0
2019-09-24T02:16:21.807Z
Sorry about that!  I updated the answer to hopefully clarify why those links should be more useful to answering your question.
Wesley Rolnick
CC BY-SA 4.0
2019-09-24T14:21:30.077Z
Thank you very much for your continued assistance. I've already done that, which is why the output in my screenshot names and shames the profiles instead of saying they're missing. The problem is that, AFAIK, when building for macOS, the certificates need to include the UUID of the machine which is using them to do the signing
Ky -
CC BY-SA 4.0
2019-09-24T14:28:27.973Z
When you install the p12 key and the profile on the mac build agent it should have what it needs to sign it's UUID into the provisioning profile.  Do you have the P12 key in addition to the profile?
Wesley Rolnick
CC BY-SA 4.0
2019-09-24T15:30:15.950Z
Our provisioning profile is generated on Apple's servers. AFAIK, it's cryptographically bound to its contents so it can't be modified on-the-fly; I'd have to update it on Apple's servers and re-download it every time I want to provision a new machine. So, I can't add the build machine's UUID to the profile at build time if I understand this correctly. I've put both development and distribution `p12` and `provisionprofile` files in Azure (I've added screenshots to my question to confirm). Thank you so much for continuing to try to resolve my confusion
Ky -
CC BY-SA 4.0
2019-09-23T19:44:47.827Z
2019-09-24T02:15:26.847Z
2019-09-24T02:15:26.847Z
Wesley Rolnick
<p>I'm trying to set up an Azure DevOps pipeline to build a macOS app. I think I have all the necessary steps in place, and it runs as far as I expect it to for now.</p>

<p>However, I now have reached the step where, in order to sign the product, the build machine device must be included in our provisioning profiles, which means we have to add its UUID to the list of devices in Apple Developer.</p>

<p><a href="https://i.sstatic.net/Zn0hp.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Zn0hp.png" alt="Two errors dictating that the profile doesn&#39;t include the device"></a></p>

<p>How do I get this pipeline to use this profile? I imagine a solution might involve one of these:</p>

<ul>
<li>There's a way to find the UUIDs of every Mac which might run the pipeline</li>
<li>There's a way to restrict that pipeline to always use the same Mac with the same UUID</li>
<li>There's a way to specify/spoof the UUID of the build machine</li>
<li>There's an API or something to register the build machine with Apple Developer at build time</li>
<li>Azure DevOps has a special way to circumvent this part of the build process while still allowing signing</li>
<li>Apple has some special way I don't know about to allow an arbitrary build machine to sign without knowing its UUID beforehand</li>
</ul>

<p>I've looked around for all these and can't find definitive info for any of them. <strong>Does anyone know the best practice for signing an Xcode project pipeline in Azure DevOps using a specific set of provisioning profiles?</strong></p>

<hr>

<p>Our certs and profiles are stored in Azure's "Secure files" section:</p>

<p><a href="https://i.sstatic.net/wNryT.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wNryT.png" alt="Two &lt;code&gt;p12&lt;/code&gt; and four &lt;code&gt;provisionprofile&lt;/code&gt; files in Azure&#39;s &quot;Secure files&quot; section"></a></p>

<p>And referenced in the pipeline's build steps:</p>

<p><a href="https://i.sstatic.net/TiLR6.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/TiLR6.png" alt="Several Xcode steps in Azure. The selected one is &quot;Install provisioning profile&quot; where one of the above-shown provisioning profiles is installed to the build machine."></a></p>

<azure-devops><azure-pipelines><macos>
How do I get the UUID of a build Mac from Azure DevOps?
Ky -
# How do I get the UUID of a build Mac from Azure DevOps?

(Asked by: username_0 on 2019-09-19)

I'm trying to set up an Azure DevOps pipeline to build a macOS app. I think I have all the necessary steps in place, and it runs as far as I expect it to for now.

However, I now have reached the step where, in order to sign the product, the build machine device must be included in our provisioning profiles, which means we have to add its UUID to the list of devices in Apple Developer.

[![Two errors dictating that the profile doesn't include the device](https://i.sstatic.net/Zn0hp.png)](https://i.sstatic.net/Zn0hp.png)

How do I get this pipeline to use this profile? I imagine a solution might involve one of these:

* There's a way to find the UUIDs of every Mac which might run the pipeline
* There's a way to restrict that pipeline to always use the same Mac with the same UUID
* There's a way to specify/spoof the UUID of the build machine
* There's an API or something to register the build machine with Apple Developer at build time
* Azure DevOps has a special way to circumvent this part of the build process while still allowing signing
* Apple has some special way I don't know about to allow an arbitrary build machine to sign without knowing its UUID beforehand

I've looked around for all these and can't find definitive info for any of them. **Does anyone know the best practice for signing an Xcode project pipeline in Azure DevOps using a specific set of provisioning profiles?**

---

Our certs and profiles are stored in Azure's "Secure files" section:

[![Two <code>p12</code> and four <code>provisionprofile</code> files in Azure's ](https://i.sstatic.net/wNryT.png)](https://i.sstatic.net/wNryT.png)

And referenced in the pipeline's build steps:

[![Several Xcode steps in Azure. The selected one is ](https://i.sstatic.net/TiLR6.png)](https://i.sstatic.net/TiLR6.png)

**Tags:** azure-devops, azure-pipelines, macos


---

## 1 answers

### Answer by username_1 on 2019-09-23. Score: 1

These steps in the Azure DevOps docs may be helpful: [Sign Your Mobile App](https://docs.microsoft.com/en-us/azure/devops/pipelines/apps/mobile/app-signing?view=azure-devops&tabs=apple-preinstall#configure-your-build).

Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building. No UUID should be needed for the agent. [Here's a guide](https://neillans.dev/setting-up-an-ios-build-on-azure-devops/) that may be useful (it's targeting iOS, not macOS but the concept is the same).

The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: [Deploy Documentation](https://docs.microsoft.com/en-us/azure/devops/pipelines/ecosystems/xcode?view=azure-devops#deploy).

> **Comments:**
> **username_0**: This is very nice to know, but I don't see where it shows how to get past the problem I'm having  
> **username_1**: Sorry about that!  I updated the answer to hopefully clarify why those links should be more useful to answering your question.  
> **username_0**: Thank you very much for your continued assistance. I've already done that, which is why the output in my screenshot names and shames the profiles instead of saying they're missing. The problem is that, AFAIK, when building for macOS, the certificates need to include the UUID of the machine which is using them to do the signing  
> **username_1**: When you install the p12 key and the profile on the mac build agent it should have what it needs to sign it's UUID into the provisioning profile.  Do you have the P12 key in addition to the profile?  
> **username_0**: Our provisioning profile is generated on Apple's servers. AFAIK, it's cryptographically bound to its contents so it can't be modified on-the-fly; I'd have to update it on Apple's servers and re-download it every time I want to provision a new machine. So, I can't add the build machine's UUID to the profile at build time if I understand this correctly. I've put both development and distribution `p12` and `provisionprofile` files in Azure (I've added screenshots to my question to confirm). Thank you so much for continuing to try to resolve my confusion  

---

