Unable to install Xamarin watchOS app on device using automatic provisioning - xamarin

Question

I'm trying to install a Xamarin watchOS app to a device using Visual Studio for Mac automatic provisioning but getting a "this app could not be installed at this time" error on the iPhone.
I'm on macOS Big Sur (11.6), Visual Studio for Mac (8.10.11), watchOS 8.0.1 on an SE (A2354), and iPhone 11 (iOS 15.0.2). I've verified that the iPhone and the watch are listed in devices in the Apple developer center, although I did have to add the watch manually as it doesn't appear that Xamarin automatic provisioning picked it up.
I can install and run the iPhone app from Visual Studio just fine by clicking the run button but the watchOS app is not automatically installed. The watch app is visible in available apps, but clicking the 'install' button results in the "this app could not be installed..." error. Everything runs fine on the simulator if I choose the watchOS project in VS for Mac and run using the simulator. If try to run on my watchOS device installation fails with this error:
ApplicationVerificationFailed: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.3e2xzs/extracted/WatchOSApp.app : 0xe8008029 (The code signature version is no longer supported.)
error MT1006: Could not install the application '/Users/scottmetoyer/src/WatchApp/bin/iPhone/Debug/device-builds/iphone12.1-15.0.2/WatchApp.app' on the device 'iPhone': AMDeviceSecureInstallApplicationBundle returned: 0xe8008029.
Are there additional troubleshooting steps or logs I can review to figure out what's going on?

Answer 1

After iOS 15/WatchOS 8, it is mandatory to sign the applications using the latest signature format.
See: https://developer.apple.com/documentation/xcode/using-the-latest-code-signature-format
All your .app files must be properly signed by XCode 13. However, it seems that it is not signing the WatchOS .app files bundled inside the iOS app.
To verify it, you can use the following command:
codesign -dvvvvv YourApp.app
You must execute that command in every .app file in your bundle (iOS app, WatchOS app and WatchOSExtension appex)
If CodeDirectory v=20500 everything is fine.
If CodeDirectory is less than 20400, you must resign
If CodeDirectory is 20400 or greater, you must check the the hash list under Pages size.
If you're in the last case, you must resign your app if -5 entry contains a value and -7 is not present or is zero.
To resign your app you must unzip your latest ipa and execute se the following command:
codesign -s "Your Codesign Identity" -f --preserve-metadata --generate-entitlement-der /path/to/MyApp.app
You have to resign every .app in your bundle (iOS, WatchOS and WatchOSExtension).
Once all .app are signed, you must re-zip the /Payload folder to an ipa file.
To sum up:
unzip myApp.ipa -d ./signed
codesign -s "Your Codesign Identity" -f --preserve-metadata --generate-entitlement-der ./signed/Payload/MyApp.app/Watch/PlugIns/MyWatchAppWatchOSExtension.appex
codesign -s "Your Codesign Identity" -f --preserve-metadata --generate-entitlement-der ./signed/Payload/MyApp/Watch/MyWatchApp.app
./signed/Payload/MyApp.app/Watch/PlugIns/MyWatchAppWatchOSExtension.appex
codesign -s "Your Codesign Identity" -f --preserve-metadata --generate-entitlement-der ./signed/Payload/MyApp.app
cd signed
zip -q -r -y myApp-resigned.ipa ./Payload