Skip to content

Capacitor 8.4.1/9.0.0-alpha SDK is stale (Xcode 26.0/iOS 26.0), and self-rebuilding to fix it breaks Apple's SDK signature requirement (ITMS-91065) #8537

Description

@para-digm-fckr

We're hitting a real catch-22 shipping a Capacitor iOS app right now, and since Capacitor and Cordova are both on Apple's "commonly used third-party SDK" signature list, this is likely affecting every app trying to comply with current App Store requirements, not just ours.

The bind:

  1. Apple's App Review is rejecting submissions with ITMS-90111 ("Unsupported SDK or Xcode version, app submissions must use the latest Xcode and SDK Release Candidates") whenever the app bundles a framework built with an older SDK. The official Capacitor.xcframework/Cordova.xcframework from capacitor-swift-pm (checked through 8.4.2 and 9.0.0-alpha.6, both published mid-July 2026) are still built with Xcode 26.0/iOS 26.0, not rebuilt against anything newer even though Xcode 26.6 has been out for a while.

  2. To work around that, we rebuilt Capacitor.framework and Cordova.framework ourselves from the open source 8.4.1 tag, compiled with the current Xcode. That fixed ITMS-90111, but broke something else: Apple's SDK signature program requires "commonly used" SDKs to carry a signature that only the registered publisher, Drifty Co in this case, can produce (we confirmed the official binary carries one at the xcframework level, _CodeSignature/, tied to Team ID 9YN2HU59K8, and that our rebuild has none, since it's cryptographically bound to the exact compiled bytes of your release). Self-rebuilding structurally can't produce a valid signature no matter how faithfully we compile from your own source.

  3. We confirmed both failure modes directly and cleanly: our rebuilt frameworks (current SDK, no valid signature) get ITMS-91065. The genuine official 8.4.1 frameworks (valid signature, stale SDK) get ITMS-90111, verbatim RC-requirement text, on a completely unrelated stable Xcode 26.6 host, ruling out any host-machine explanation.

So right now there is no way to ship a compliant Capacitor iOS app: current-SDK builds fail the signature check, and signed builds fail the SDK-freshness check.

Ask: is there a release planned that rebuilds the xcframework binaries against a current Xcode/SDK while keeping the real Apple SDK signature intact? Given Apple's tightened enforcement this cycle, this seems likely to hit a lot of Capacitor apps soon if it hasn't already. Happy to share our test archives/logs if useful for reproducing this.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions