howsigned is a macOS CLI for auditing the signing state of Apple IPA archives. It is useful when a TestFlight or App Store submission fails because a nested app, extension, framework, or provisioning profile does not match expectations.
gem install howsignedThe tool requires macOS developer tools (codesign and security) and Ruby 3.2 or newer.
Generate a complete, CI-friendly signing manifest:
howsigned manifest MyApp.ipa > signing-manifest.jsonVerify every discovered nested binary. Exit status 1 means a signature finding:
howsigned verify MyApp.ipaInspect entitlements or embedded provisioning profiles:
howsigned entitlements MyApp.ipa
howsigned profiles MyApp.ipa
howsigned profiles --expiration MyApp.ipaCompare two builds. Exit status 1 means their manifests differ:
howsigned compare Old.ipa New.ipaAll structured output is JSON. Exit status 2 indicates invalid input or usage; 3 indicates an unavailable tool or runtime failure.
CI runs on macOS for Ruby 3.2–3.4, executes the test suite, and builds the gem. A tag such as v2.0.0 invokes the release workflow and publishes to RubyGems using the repository’s RUBYGEMS_API_KEY secret. GitHub is the release source of truth; do not upload gems manually.
bundle install
bundle exec rake
gem build howsigned.gemspecThe tests use synthetic IPA archives and fake command execution, so they are safe to run without a signed application. The production audit remains macOS-specific because Apple’s signing tools are macOS tools.
MIT. See LICENSE.