Missing signature ergo rejection for invalid binary reasons

[ilendemli]

How frequently does the bug occur?

Always

Description

It seems like the xcframeworks are not signed anymore which causes our app to be rejected by apple when submitted for review.

ITMS-91065: Missing signature - Your app includes “Frameworks/RealmSwift.framework/RealmSwift”, which includes RealmSwift, an SDK that was identified in the documentation as a commonly used third-party SDK. If a new app includes a commonly used third-party SDK, or an app update adds a new commonly used third-party SDK, the SDK must include a signature file. Please contact the provider of the SDK that includes this file to get an updated SDK version with a signature. For details about verifying the code signature for a third-party SDK, visit: https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks.

Stacktrace & log output

Can you reproduce the bug?

Always

Reproduction Steps

Create a new app with RealmSwift using the v10.54.6 release, submit to the AppStore for review, watch it get automatically rejected.

Version

v10.54.6 because v20 packages are not available for Xcode 26

What Atlas Services are you using?

Local Database only

Are you using encryption?

No

Platform OS and version(s)

iOS

Build environment

Xcode version: 26.0.1
Dependency manager and version: SPM

[ilendemli]

Why would you skip codesigning? ad7fe19

[tgoyne]

We no longer have an active Apple Developer account.

[ilendemli]

So any future Update and Integration using Carthage and SPM will get rejected by Apple because of the missing Signature. Apple mentions RealmSwift here requiring the framework to have a signature: https://developer.apple.com/support/third-party-SDK-requirements
Related issue: #8585

The workaround would be to integrate and build from source (which causes the build-time of our apps to almost tripple) or to sign the framework locally and use that (we would rather have officially signed packages).