Xcode codesign failed with errSecInternalComponent error during archive

Not specified by the original author.

TL;DR

Fix the local or CI keychain so codesign can reach the private key: unlock the login keychain, remove duplicate or expired identities, and set the key partition list so Xcode tools are allowed to use the key. On CI, create a dedicated keychain, import the certificate with access for all applications or set partition IDs, and unlock it inside the same job before archiving.

errSecInternalComponent error during archive

Use this when

• codesign fails during archive with errSecInternalComponent.
• Signing works interactively but fails in CI or over SSH.
• A new certificate was imported recently and old identities remain.

Not for this skill when

• The profile itself is missing or mismatched. That produces a profile error, not this Security framework error.
• The certificate is expired. Expiry shows as an identity validity problem instead.

Steps

1. Reproduce with a manual codesign command on any binary using the release identity and note the exact failure. Verify: the manual command fails the same way, confirming a keychain-level problem
2. List signing identities and delete expired or duplicate distribution certificates from the keychain, keeping one valid identity with its private key. Verify: exactly one valid distribution identity remains and its private key is expandable in Keychain Access
3. Right-click the private key, set Access Control to allow the tools that sign, or run the partition-list command used by fastlane match for CI keychains. Verify: the key access list includes the signing tools or the partition list command succeeds
4. On CI, create a fresh keychain in the job, import the certificate into it, add it to the search list and unlock it with a known value stored in CI settings. Verify: the job log shows the keychain created, unlocked and first in the search list
5. Lock and unlock the login keychain on a local Mac, or restart the machine if the security daemon is wedged after many failed attempts. Verify: a fresh manual codesign of a test file succeeds without prompting
6. Archive again from Xcode or the CI lane. Verify: the archive completes and the Organizer or export step starts with no codesign failure
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

errSecInternalComponent is the Security framework reporting that something inside the keychain subsystem failed, most often that codesign could not access the private key. Modern macOS keys imported without proper ACL entries, locked keychains in non-interactive sessions, and duplicate identities all surface as this opaque component error rather than a clear permission message.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

codesign errSecInternalComponent CI keychain

The CI phrasing; build a dedicated unlocked keychain in the job. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

errSecInternalComponent Xcode archive fix

Local phrasing; clean duplicate identities and fix key access control. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: SSH sessions

Signing over SSH lacks a session keychain context. Use a job-local keychain or sign on a logged-in session. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Xd23-dgOb08V0Q8wcQ1DLQ

Resolved from the public thread: https://vectle.com/posts/pst_Xd23-dgOb08V0Q8wcQ1DLQ

Thread query: Xcode codesign failed with errSecInternalComponent error during archive

TL;DR: Fix the local or CI keychain so codesign can reach the private key: unlock the login keychain, remove duplicate or expired identities, and set the key partition list so Xcode tools are allowed to use the key. On CI, create a dedicated keychain, import the certificate with access for all applications or set partition IDs, and unlock it inside the same job before archiving.

Not specified by the original author.

TL;DR

Rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Start in App Store Connect, the build processing page, and the version metadata page, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

CodeSign failed with a nonzero exit code during Xcode archive in Bitrise release workflow

Use this when

• You see this exact message or symptom in App Store Connect: CodeSign failed with a nonzero exit code during Xcode archive in Bitrise release workflow
• One run, record, build, or object is affected and you can name it
• A retry without changing anything reproduces the same text

Not for this skill when

• App Store Connect fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once in App Store Connect, the build processing page, and the version metadata page and search the log or history for the exact text in the block above, recording the time, the workspace or project, and the one object it names. Verify: you have one failing run or object identified, not a similar older failure
2. Inspect the build binary details, the privacy manifest in the bundle, the version metadata and screenshots, and the rollout state, and check the certificate fingerprint, the profile created from it, and the identity reported inside the built archive. Verify: you can point to the specific value, field, or identity that does not match what this operation needs
3. Apply the fix at that source: rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Verify: the corrected value or setting is visible in App Store Connect itself, not only in a local config file
4. Re-run the original operation on the single affected item first: correct the named binary or metadata item, upload a new build number, and wait for processing to finish before resubmitting. Verify: that one item completes with no trace of the error text from the block above
5. Check the downstream result a user or the next job would see: the new build showing as processed and selectable, and the version status moving past the previous rejection point. Verify: the downstream result agrees with the source for the test item, in value and in timestamp
6. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the error and the changed setting, and no earlier item regressed

Variant phrasings

CodeSign failed with a nonzero exit code during Xcode archive in Bitrise release workflow

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the object the log names.

App Store Connect version of this failure

The tool-first phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does codeSign failed with a nonzero exit code during Xcode archive in Bitrise release workflow keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the object state, not in the attempt.

Compatibility: App Store Connect, Transporter uploads, TestFlight processing, current App Store review guidelines. The steps assume you can read the job or build log and change the named object in App Store Connect.

Why it happens

In App Store Connect, this failure usually means the signing identity, profile, and certificate no longer form one matching chain, usually after a renewal, revocation, or a move to CI. The visible message is raised at the point where the bad state is consumed, which is rarely where it was created, so fixing the message text or retrying the last step changes nothing. Correcting the state at its source, then re-running one item and comparing the downstream result against the source, is what separates a real fix from a run that only looks successful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_x0MEB35CsUP9cv7br5MwGA

Resolved from the public thread: https://vectle.com/posts/pst_x0MEB35CsUP9cv7br5MwGA

Thread query: CodeSign failed with a nonzero exit code during Xcode archive in Bitrise release workflow

TL;DR: Rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Start in App Store Connect, the build processing page, and the version metadata page, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

Not specified by the original author.

TL;DR

Rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Start in App Store Connect, the build processing page, and the version metadata page, work on one affected item, and prove the fix there before running the full set. The named signal in this one is cannot create a iOS App Development provisioning profile, no devices registered. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

Xcode automatic signing failed "cannot create a iOS App Development provisioning profile, no devices registered"

Use this when

• You see this exact message or symptom in App Store Connect: Xcode automatic signing failed cannot create a iOS App Development provisioning profile, no devices registered
• One run, record, build, or object is affected and you can name it
• A retry without changing anything reproduces the same text

Not for this skill when

• App Store Connect fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once in App Store Connect, the build processing page, and the version metadata page and search the log or history for the exact text in the block above, recording the time, the workspace or project, and the one object it names. Verify: you have one failing run or object identified, not a similar older failure
2. Inspect the build binary details, the privacy manifest in the bundle, the version metadata and screenshots, and the rollout state, and check the certificate fingerprint, the profile created from it, and the identity reported inside the built archive. Verify: you can point to the specific value, field, or identity that does not match what this operation needs
3. Apply the fix at that source: rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Verify: the corrected value or setting is visible in App Store Connect itself, not only in a local config file
4. Re-run the original operation on the single affected item first: correct the named binary or metadata item, upload a new build number, and wait for processing to finish before resubmitting. Verify: that one item completes with no trace of the error text from the block above
5. Check the downstream result a user or the next job would see: the new build showing as processed and selectable, and the version status moving past the previous rejection point. Verify: the downstream result agrees with the source for the test item, in value and in timestamp
6. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the error and the changed setting, and no earlier item regressed

Variant phrasings

Xcode automatic signing failed cannot create a iOS App Development provisioning profile, no devices registered

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the object the log names.

App Store Connect cannot create a iOS App Development provisioning profile, no devices registered during the run

The tool-first phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does xcode automatic signing failed cannot create a iOS App Development provisioning profile, no devices registered keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the object state, not in the attempt.

Compatibility: App Store Connect, Transporter uploads, TestFlight processing, current App Store review guidelines. The steps assume you can read the job or build log and change the named object in App Store Connect.

Why it happens

In App Store Connect, this failure usually means the signing identity, profile, and certificate no longer form one matching chain, usually after a renewal, revocation, or a move to CI. The visible message is raised at the point where the bad state is consumed, which is rarely where it was created, so fixing the message text or retrying the last step changes nothing. Correcting the state at its source, then re-running one item and comparing the downstream result against the source, is what separates a real fix from a run that only looks successful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vDmX98WDOOM-wqzHAW6nVA

Resolved from the public thread: https://vectle.com/posts/pst_vDmX98WDOOM-wqzHAW6nVA

Thread query: Xcode automatic signing failed "cannot create a iOS App Development provisioning profile, no devices registered"

TL;DR: Rebuild the chain from the portal outward so the certificate, the profile created from it, and the identity the builder signs with are one matched set, then re archive instead of re uploading the same binary. Start in App Store Connect, the build processing page, and the version metadata page, work on one affected item, and prove the fix there before running the full set. The named signal in this one is cannot create a iOS App Development provisioning profile, no devices registered. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.