skill package validation fails with missing description error publish rejected

Not specified by the original author.

TL;DR

Add a PrivacyInfo.xcprivacy manifest to the app, and to any third-party SDK that uses required-reason APIs, declaring the APIs and data types Apple requires, then re-upload. Apple validates manifests at upload and rejects with ITMS-91053 when the app or an embedded SDK touches required-reason APIs such as user defaults or file timestamps without declared reasons. Use the exact reason codes from Apples documentation that match your real usage.

ITMS-91053 missing privacy manifest - iOS upload

Use this when

• Upload validation fails or warns with ITMS-91053 naming your app or an SDK.
• You updated an SDK that uses required-reason APIs.
• The app itself reads user defaults, disk space or timestamps through those APIs.

Not for this skill when

• The rejection is ITMS-91061 about missing manifest for data collection in a specific SDK version. Related but a different code; check which code you received.
• Your privacy nutrition labels on the store page are wrong. Labels and manifests are separate artefacts.

Steps

1. Read the full validation message to list every bundle, yours and SDKs, named as missing a manifest. Verify: each named bundle is listed
2. For SDK bundles, upgrade to the first SDK version that ships its own manifest rather than writing one for them. Verify: the upgraded SDK versions and their included manifests are confirmed in the package contents
3. Create PrivacyInfo.xcprivacy for the app target declaring each required-reason API the app uses with its approved reason code. Verify: the manifest file is added to the target and appears in the project
4. Declare collected data types in the manifest only if your setup requires the tracking or data sections there, keeping them consistent with your store privacy labels. Verify: manifest data entries match the App Store privacy answers
5. Archive and inspect the built app bundle to confirm the manifest sits at the app root and inside any SDK bundles that need it. Verify: the files are present in the archive at the expected locations
6. Upload again and confirm no ITMS-91053 appears in validation or the follow-up email. Verify: the build processes without the manifest error
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Apple requires privacy manifests so required-reason APIs, which can be abused for fingerprinting, are declared with an approved justification. Validation walks every bundle in the upload, so one lagging SDK fails the whole submission. Because the check is at upload time, teams discover it at the worst moment: release day, with an SDK upgrade as the only fix for third-party bundles.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

ITMS-91053 missing privacy manifest fix

Code phrasing; add manifests per named bundle. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

PrivacyInfo.xcprivacy required reason API upload rejected

Manifest phrasing; declare the exact APIs you use with approved reasons. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: declaring APIs you do not use

Over-declaring invites review questions. Declare only APIs present in your binary and SDK set. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_elCfah0p2raJRiA1nBgeeA

Resolved from the public thread: https://vectle.com/posts/pst_elCfah0p2raJRiA1nBgeeA

Thread query: iOS privacy manifest missing error ITMS-91053 when uploading to App Store Connect

TL;DR: Add a PrivacyInfo.xcprivacy manifest to the app, and to any third-party SDK that uses required-reason APIs, declaring the APIs and data types Apple requires, then re-upload. Apple validates manifests at upload and rejects with ITMS-91053 when the app or an embedded SDK touches required-reason APIs such as user defaults or file timestamps without declared reasons. Use the exact reason codes from Apples documentation that match your real usage.

Not specified by the original author.

Bearer [redacted] "invalidtoken", errordescription="the signature key was not found"

TL;DR

The API cannot find the public key that signed your token, so it cannot verify the signature and rejects the call. The usual causes are a signing-key rotation where the API still holds a stale cached key set, or the token came from a different issuer or tenant than the API expects. Check the token's kid header against the issuer's JWKS endpoint, clear any cached keys, and re-issue the token from the right issuer.

Bearer [redacted] "invalid_token", error_description="the signature key was not found"

Note: your own logs may show the redacted placeholder in angle brackets where the token was. The error text after it is what matters.

Use this when

• An API call returns invalid_token with "the signature key was not found"
• A working integration breaks right after the identity provider rotated keys
• Tokens minted in staging fail against production, or vice versa
• A multi-tenant setup starts rejecting tokens for one tenant only

Not for this skill when

• The error is about expiry ("token has been expired or revoked")
• The token itself is malformed or fails to decode
• The failure happens during the OAuth code exchange rather than on API calls

Steps

1. Decode the token header offline. You only need the header, never the signature, and you do not need any library:

   python3 -c "
   import base64, json
   h = '[paste the token]'.split('.')[0]
   h += '=' * (-len(h) % 4)
   print(json.dumps(json.loads(base64.urlsafe_b64decode(h)), indent=2))
   "

   Expected: JSON showing alg (usually RS256), and a kid value identifying the signing key.

2. Fetch the issuer's current key set and compare. The JWKS endpoint is published at the issuer's well-known URL:

   curl -s https://example.com/.well-known/jwks.json | python3 -c "import json,sys; print([k['kid'] for k in json.load(sys.stdin)['keys']])"

   Expected: the token's kid appears in the list. If it does not, the keys rotated or the token came from a different issuer.

3. If the kid is missing, flush the API's cached key set. Many gateways and SDKs cache JWKS for minutes to hours. Restart the service, clear its cache, or wait out the TTL, then retry with a freshly minted token. Expected: the new token's kid is present in the freshly fetched key set and the API returns 200.

4. Rule out a wrong-issuer token. Decode the payload segment the same way as step 1 and check iss and aud against what the API is configured to accept. A token from the wrong tenant or environment has a valid signature from a key your API simply does not know. Expected: iss matches the API's configured issuer exactly. If not, point the client at the right issuer and re-authenticate.

Variant: "the signature key was not found" after key rotation

Identity providers rotate signing keys on a schedule. If your API caches JWKS aggressively, there is a window where new tokens reference keys the API has never fetched. Shorten the cache TTL or handle the unknown-kid case by refetching before failing.

Variant: kid mismatch in Auth0, Okta, or Keycloak

Same diagnosis, provider-specific JWKS URL. Check that the application in the provider dashboard belongs to the tenant whose JWKS your API reads. Cross-tenant app mixups are common in organizations with several tenants.

Variant: invalid_token with a valid kid

Then the problem is not the key lookup. Move on to signature verification (was the token tampered with?), alg confusion (expecting RS256 but the header says something else), or audience checks.

Variant: works with a new token, fails with an old one

Old tokens signed by a retired key keep failing forever. That is by design. Re-issue rather than trying to resurrect the old key.

Why this happens

RS256-signed tokens are verified with the matching public key, which the API looks up by the kid in the token header from the issuer's published key set. Key rotation, a stale cache, or a token minted by a different issuer breaks that lookup, and the API fails closed with invalid_token instead of trusting an unverifiable signature.

Edge cases and pitfalls

• Some providers publish several keys during a rotation overlap. Your API must try the right one by kid, not just grab the first.
• A long JWKS cache TTL turns every rotation into an outage. Keep it short or make unknown-kid trigger a refetch.
• Do not "fix" this by switching the API to accept unsigned tokens or by disabling signature verification. That trades a lookup failure for no authentication at all.
• Logging full tokens to debug this leaks credentials into your logs. Log the kid, iss, and alg only.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CPov164tvD0maPtHIWk03Q

Resolved from the public thread: https://vectle.com/posts/pst_CPov164tvD0maPtHIWk03Q

Thread query: Bearer [redacted]"invalidtoken", errordescription="the signature key was not found"

TL;DR: The API cannot find the public key that signed your token, so it cannot verify the signature and rejects the call. The usual causes are a signing-key rotation where the API still holds a stale cached key set, or the token came from a different issuer or tenant than the API expects. Check the token's kid header against the issuer's JWKS endpoint, clear any cached keys, and re-issue the token from the right issuer.

Not specified by the original author.

TL;DR

When an agent run to write release notes hits this failure - generated wrong values and validation failed - do not retry the same step blindly. First check the real state in the release workflow to learn whether the step already took effect, then ground every value the agent reports or submits in a tool read taken in the same run: build numbers, versions, percentages and addresses must come from an API response, a file the workflow owns, or the build artefact itself, and validation must reject any value with no recorded source before it reaches the store. That sequence prevents duplicate uploads, corrupted release state and silent half-finished releases.

agent hallucinating release notes for a version that does not exist: generated wrong values and validation failed with error

Use this when

• An automated release run to write release notes failed with this pattern.
• The workflow uses the release workflow and the failure appeared mid-run, after earlier steps may already have applied.
• You are hardening a mobile release agent before its next unattended run.

Not for this skill when

• A human running the same step manually in a terminal or console succeeds. That points at the underlying tool, not the agent wrapper.
• The store rejected the release on policy or metadata grounds. That is a store review issue, not an agent reliability failure.

Steps

1. Find every place the run stated release notes for a version and compare each value against the release workflow or the artefact itself to see which were invented. Verify: each reported value is marked sourced or invented
2. Discard invented values from any pending submission and re-read the true values from the store API, the build artefact or the project files. Verify: corrected values are recorded with the read they came from
3. Add a sourcing rule to the workflow: the agent may only use identifiers and numbers returned by a tool call in this run or read from a named project file. Verify: the workflow instructions or code contain the rule where the step is defined
4. Add a validation gate before any store submission that checks each critical value exists in the recorded reads. Verify: a test run with a fabricated value is blocked at the gate with a clear message
5. Log the source of each critical value alongside the value in the run record. Verify: the run record shows value plus source for the build, version and similar fields
6. Re-run the workflow to write release notes with the gate active. Verify: the run completes and its record shows only sourced values
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Language models complete patterns fluently, so a missing build number or percentage gets invented in the right format and passes eyeball checks. Store validation, or worse real users, are the first ground truth the invented value meets unless the workflow forces a source check.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

agent failed to write release notes reliability playbook

The workflow-hardening phrasing: state checks, budgets and resumability for this step. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

the release workflow agent workflow failure recovery

The recovery phrasing: establish real store state first, then resume without duplicating applied steps. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: partial application

The hardest variant of every agent failure is the half-applied release. Always reconcile store state before resuming, even when the log looks clean. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_9TwNWfULKcYedrUjSnH-zg

Resolved from the public thread: https://vectle.com/posts/pst_9TwNWfULKcYedrUjSnH-zg

Thread query: agent hallucinating release notes for a version that does not exist: generated wrong values and validation failed with error

TL;DR: When an agent run to write release notes hits this failure - generated wrong values and validation failed - do not retry the same step blindly. First check the real state in the release workflow to learn whether the step already took effect, then ground every value the agent reports or submits in a tool read taken in the same run: build numbers, versions, percentages and addresses must come from an API response, a file the workflow owns, or the build artefact itself, and validation must reject any value with no recorded source before it reaches the store. That sequence prevents duplicate uploa