What changed from xcode 13.2.1 to 14.2 that would affect an app's entitlements?

Question

We have a Xamarin iOS app that is building in DevOps pipeline using the XamariniOS@2 task. This worked quite fine for many years until a number of months ago when we changed vm image so we could update the xcode version to 14.2 to support iOS 16+. Since then, installs to devices fail due to the error:

Application is missing the application-identifier entitlement.

Analyzing the app files shows that the IPA built with xcode 13.2.1 has entitlements.

@-Mac-mini Downloads % codesign -d --entitlements - --xml  Inform.Forms.iOS.**macOS-11**.app 
Executable=/Downloads/Inform.Forms.iOS.macOS-11.app/Inform.Forms.iOS
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>get-task-allow</key>
    <false/>
    <key>com.apple.developer.team-identifier</key>
    <string>[OUR APP ID]</string>
    <key>application-identifier</key>
    <string>OUR APP ID].com.b2wsoftware.inform</string>
    <key>keychain-access-groups</key>
    <array><string>OUR APP ID].com.b2wsoftware.inform</string>
    </array>
</dict>
</plist>

But running the same codesign statement against the IPA app generated by xcode 14.2 does not produce any entitlements.

@-Mac-mini Downloads % codesign -d --entitlements - --xml  Inform.Forms.iOS.**macOS-12**.app
Executable=/Downloads/Inform.Forms.iOS.macOS-12.app/Inform.Forms.iOS
-- no output --

No code difference between the two the only change is targetting a different vm Image (macOS-11 to macOS-12) that has a different default xcode (xcode 13.2.1 to 14.2).

Does anyone know what changes in xcode might have affected why we are not getting entitlements properly generated and how to get that corrected?

I've tried to add a custom entitlements file that lists the default generated entitlements but it seems to ignore them. I even tried adding the CodeEntitlements argument to the XamarainiOS task:

args: '/p:CodesignEntitlements=Entitlements.plist'

No change in behavior. Add still will not install with error "Application is missing the application-identifier entitlement."

Answer 1

This is how mine looks:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>application-identifier</key>
    <string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
    <key>get-task-allow</key>
    <false/>
    <key>beta-reports-active</key>
    <true/>
    <key>keychain-access-groups</key>
    <array>
        <string>$(AppIdentifierPrefix)$(CFBundleIdentifier)</string>
    </array>
    <key>aps-environment</key>
    <string>production</string>
</dict>
</plist>

Looks very similar, main difference is that identifiers are just inferred now.