iOS signing

iOS Simulator builds use Xcode’s local ad-hoc identity (-). Xcode signs the framework and extensions before sealing the application. When WidgetKit is enabled, the pipeline then re-signs only the widget and containing application, inside-out and without --deep, so their generated application-group entitlements are embedded in the effective signatures. Artifact validation requires exact signature identifiers, sealed plists/resources, strict verification for every bundle, and recursive strict verification for the application. No Apple Account, team, certificate, or provisioning profile is needed.

Physical-device signing is an implemented official Xcode development pipeline with an explicit user-selected Team. Provisioning updates are disabled unless requested, and manual signing can name a profile. After Xcode builds, RustFerry checks the expected executable and Cargo provenance, arm64 architecture, signatures, signing certificate, embedded profiles, expiration, Team and bundle identifiers, entitlement authorization, and embedded extensions before returning a validated artifact.

The implementation and deterministic signing tests do not establish a real signing or device result. This repository had no Apple Development identity, Team, provisioning profile, signed physical artifact, or attached device available, so the path is neither artifact-validated nor device-validated. Widget application groups and other entitlements can require additional profile capabilities. No signing identity, private key, password, profile contents, or account token is stored in ferry.toml or generated logs. See Physical iPhone development and STATUS for the current evidence level.