[FileCopyTaskAction] Injected codeless-framework stubs retain the linker's temporary signing identifier

[Brett-Best]

Important

The below is produced by Claude and Codex, I have read it and it sounds reasonable to me but my knowledge of Swift Build and code signing is rather limited.

Description

When builtin-copy -remove-static-executable leaves an embedded framework codeless, FileCopyTaskAction injects a dynamic stub binary. The stub is linked using -adhoc_codesign.

The resulting linker-generated signature uses the temporary per-architecture output filename as its identifier, for example:

Identifier=arm64-apple
flags=...linker-signed...

This does not match the framework bundle identifier:

CFBundleIdentifier=com.apple.AStaticFwk

Distribution signing flows can derive an explicit designated requirement from the existing signature before re-signing the framework. That captures the temporary identifier, while codesign subsequently derives the actual identifier from the framework bundle. The resulting signature has a mismatched designated requirement and can be rejected during App Store validation with:

90035: Invalid Signature. Code failed to satisfy specified code requirement(s).

Minimal reproduction

The regression test included in the associated pull request, codelessFrameworkStubSignatureNormalizationWithCodeSigningDisallowed, constructs an in-memory project containing:

• An application target
• A static framework copied into the application's Frameworks directory
• codeSignOnCopy: false
• CODE_SIGNING_ALLOWED=NO

It performs a real build operation and inspects the copied framework with codesign.

The test fails without the fix because the embedded framework reports the temporary identifier and retains the linker-signed flag. It covers both macOS and an iOS device destination without requiring signing identities or provisioning.

CODE_SIGNING_ALLOWED=NO is intentional: the linker ad-hoc signs the injected stub regardless of code-signing policy, and an unsigned archive may still be signed later during distribution.

Expected behavior

After injecting the stub:

Identifier=com.apple.AStaticFwk

The signature should not retain the linker-signed flag.

Actual behavior

The stub retains the linker's temporary filename identifier, such as:

Identifier=arm64-apple