iOS app signing with deviceShare

deviceShare signs iOS apps at install time so you can upload a build once and run it across your device fleet.

Overview

When you upload an iOS app to Kobiton App Repository, deviceShare re-signs the binary at install time. Each install uses your organization’s signing certificate and provisioning profile, which your lab team has already imported into deviceShare for the devices in your fleet.

deviceShare does not modify your original upload in App Repository. Re-signing happens on each install.

Prerequisites

Re-signing with deviceShare requires:

  • deviceShare installed on the Mac mini hosts in your Kobiton deployment.

  • Your organization’s development signing certificate and provisioning profiles imported into the deviceShare keychain, covering the UDIDs of the hosted devices.

Both tasks are handled by your device lab team. For the admin setup, see Update deviceShare and Import certificates and profiles.

How re-signing works

Build and upload your app once using an iOS Development certificate or an Ad-hoc Distribution certificate. When you start a session on a hosted device, deviceShare:

  1. Retrieves your uploaded binary from App Repository.

  2. Re-signs it with your organization’s development certificate and provisioning profile, which already cover the hosted device UDIDs.

  3. Installs the re-signed app on the selected device.

You do not need to add fleet device UDIDs to your Apple Developer account, list them on your build, or re-upload the app for different devices. deviceShare handles signing and installation for every device the session targets.

Entitlements stripped by re-signing

Re-signing replaces the app’s original signing identity. deviceShare does not carry over entitlements tied to that identity. The following entitlements are stripped:

  • Access WiFi Information

  • App Groups

  • Apple Pay Payment Processing

  • Associated Domains

  • AutoFill Credential Provider

  • ClassKit

  • Fonts

  • Game Center

  • HealthKit

  • HomeKit

  • Hotspot

  • In-App Purchase

  • NFC Tag Reading

  • Personal VPN

  • Push Notifications

  • Sign in With Apple

  • System Extension

  • User Management

  • Wireless Accessory Configuration

  • Any other entitlement that depends on the original signing identity

If your app depends on any stripped entitlement, keep your own signing identity instead. See Keep your own signing identity.

Keep your own signing identity

If your app depends on a stripped entitlement, turn off Kobiton re-signing before you upload. Only Org Admins can change this setting. In Kobiton Portal, open Other settings and disable App signing using Kobiton Certificate (iOS) under Kobiton Re-signing Process.

With re-signing off, your app installs exactly as you uploaded it. You are then responsible for signing the app so it installs on the hosted devices. You have two options.

Option A: Development or Ad-hoc Distribution certificate

Sign the app with an iOS Development or Ad-hoc Distribution certificate whose Provisioned Devices list includes every device UDID in your fleet. Development and Ad-hoc builds only install on devices listed in the profile, so every target device must be added.

Apple limits registered devices to 100 per device type per account per year. For a large fleet, this cap can make Option A impractical. In that case, use Option B.

Option B: Enterprise (in-house) certificate

An Enterprise certificate does not require listing individual device UDIDs. The trade-off is a one-time trust step on each device, which changed with iOS 18.

On iOS 18 and later, trusting an Enterprise or developer-signed app triggers an Allow & Restart prompt. The device reboots, and after the reboot, the trust step must be completed manually on the device. Because the reboot takes the device offline and the post-reboot step requires a physical touch, your lab team has to bring each device back manually. iOS 17 and earlier do not require the restart.

To avoid repeating the trust step on every build:

  • Turn off the cleanup policy, or use a custom cleanup policy that preserves the trusted app and its provisioning profile.

  • Keep a trusted copy of the app installed on the device.

Once the device trusts your certificate, future builds signed with the same certificate install without repeating the trust and restart, as long as the profile stays on the device.

Frequently asked questions

Does deviceShare re-sign the apps I upload?

Yes, by default. deviceShare re-signs the application IPA with your organization’s development certificate at install time while App signing using Kobiton Certificate (iOS) is enabled. If you turn re-signing off, your IPA installs on the hosted device without any changes to its signature.

What does deviceShare modify when re-signing?

Re-signing replaces the app’s signing identity and provisioning profile, and strips the entitlements tied to the original identity. See Entitlements stripped by re-signing.

Can my IPA install exactly as I uploaded it?

Yes. Disable App signing using Kobiton Certificate (iOS) in Other settings. With re-signing off, your app installs exactly as you uploaded it, with no changes to signatures, provisioning profiles, entitlements, or bundle contents. You are then responsible for signing the app so it installs on the hosted devices. See Keep your own signing identity.

Related guides