iPhone Entitlements problem with XCode 4 for Ad Hoc distribution - iphone

Question

I have reread all the documentation and postings on Ad Hoc distribution and still have a problem. If I try 'wireless' distribution (with a .plist and .ipa file being downloaded using Safari) the app starts to download, the icon is drawn correctly and the name changes from 'Installing..' but when its about 90% complete I get an 'Unable to Download ...' alert.
If I use the iTunes method of transferring the app I get 'The app "xx" was not installed on the iPhone "xx" because the entitlements are not correct.'
Q1: I have read that you no longer need to separately add the .mobileprovision file because XCode (I am using 4.0.1) adds it to the bundle - is this true ?
Q2: when I 'download' the .mobileprovision in safari (on the iPhone) it merely displays it as text. Is this symptomatic of my problem or an irrelevancy ?
Q3: does this problem concern the Entitlements.plist ? I can't find any documentation from Apple or any blogs that relate to what I see when editing this file with XCode 4.0.1. If I follow the instructions (New->New File->Code Signing->Entitlements) I get a default file with only a 'Can be debugged' Key. I have tried setting this to NO, adding a get-task-allow Key (replacing the existing - presumably Can be debugged is the same key ?) adding my application-identifier, and adding an iPhone Entitlements Dictionary with the above two keys in (as per Apple's documentation).
Q4: what is the suicide rate amongst iPhone developers trying to get Entitlements and Code Signing working?
To cut down on suggestions I've seen for similar questions:
I do have Code Signing Entitlements set to my Entitlements.plist for Distribution and Release.
I have tried restarting XCode, rebuilding, archiving etc
I have tried restarting the iPhone
I have gone back to the iPhone
Update:In XCode 4.0.1 there is a menu option when the Entitlements.plist is being edited (Editor->Show Raw Keys and Values) which will toggle the key from 'Can be debugged' to 'get-task-allow'

Answer 1

The entitlements file should be:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<false/>
<key>application-identifier</key>
<string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
</array>
</dict>
</plist>
this works for wireless too.
Why on earth the default one doesn't have all this in is something only Apple can answer.
I can't see how to edit the raw text of a plist in Xcode so edited in TextEdit.

Answer 2

Code signing entitlements are no longer necessary for Ad Hoc builds in Xcode 4 - see details notes in Apple Technical Note TN2250

Answer 3

I just wrote a blog post outlining all the steps to successful ad hoc distributions in Xcode 4 which may be helpful. http://www.musicalgeometry.com/?p=1237

Answer 4

Entitlements.plist should be added in project and there should be only get-task-allow key inside it.
When debugging on device using developer profile, It should be checked
When building using Ad-Hoc or Distribution profile, It should be unchecked
Regarding Q4: If you like you can increase it by just doing... but I don't recommend it.

Answer 5

If you right click on the plist file in the project navigator, and select "Open As" then "Source Code", you can edit it as plain source.

Answer 6

Maybe they made a shorter version of Entitlements.plist in xcode4. The default Entitlements.plist does not contain the 'application-identifier' and the 'keychain-access-groups' keys, but if you change the value of the 'Can be debugged' key via the 'ASCII Property editor' it really changes the value of the 'get-task-allow' key in the background...

Answer 7

I tried setting the entitlements parameter "on" or "off", re-download my ad-hoc provisional that had been used for as long as I can remember, and tried hundreds of other combinations. None worked for me until...I went to the provisional portal and recreate a new provisional.
What really got me to stay up until 4:00AM and wasting hours of time that I did not have was how I created the ad hoc provisional. On Apple's iOS provisional Portal page, if you click on the "provisioning" on the left side bar, you will see 4 tabs: "development", "distribution", and the other two. I used to use my provisional created under the "development" tab and added all the test users' phone UUID. That had worked for me for years until the xCode 4 came along, and I was stupid enough to jump on board too fast. Apple engineers had always given me a surprise "mid-night" party every time xCode had an update. And they will wait long enough for me to forget this experience and release the next one.
The solution that worked for me was to create a provisional under the distribution tab. When you create a new provisional here, you have the option of selecting "ad hoc" as the "Distribution Method." After used this provisional on xCode project and target build setting, and turned off "can be debugged" on the entitlements, I then could install via iTunes or via OTA. I hope this tip might help someone save a few gray hair.