[net11.0] CoreCLR iOS device install fails with MismatchedBundleIDSigningIdentifier on bundled native frameworks

[davidnguyen-tech]

Note

Issue description generated with GitHub Copilot.

Summary

Publishing a net11.0-ios app to an iOS device with CoreCLR (UseMonoRuntime=false) fails at install time with MismatchedBundleIDSigningIdentifier (MIInstallerErrorDomain error 77).

Failing build: https://dev.azure.com/dnceng/internal/_build/results?buildId=2958313&view=results
Job: https://dev.azure.com/dnceng/internal/_build/results?buildId=2958313&view=logs&j=22562ed2-ac63-545d-00a9-948aa372a9bb&t=087f1567-7589-5970-688b-4e9b08762a52

Affected configuration: net11.0-ios, iOS device, CoreCLR / UseMonoRuntime=false. Mono and NativeAOT are not affected.

Key evidence

Check	Observed
Framework Info.plist bundle id	<app-id>.<libname>
codesign -dvvv identifier	<libname>
codesign -dvvv format	Mach-O dylib

Example observed in the failing app: libSystem.IO.Compression.Native.framework had CFBundleIdentifier = net.dot.mauitesting.libSystem.IO.Compression.Native, but its codesign identifier was only libSystem.IO.Compression.Native.

Likely cause

Converted CoreCLR dylib frameworks are being signed before they are complete/recognized as framework bundles. Codesign therefore treats the payload as a bare Mach-O dylib and derives the signature identifier from the binary name. Later, the framework Info.plist contains <app-id>.<libname>, so iOS install-time validation sees a bundle-id/signing-identifier mismatch and rejects the app.

Suggested fix direction

Ensure each converted CoreCLR framework has its Info.plist in place before signing, so codesign recognizes it as a framework bundle and uses the plist bundle identifier.

[davidnguyen-tech]

Note

Comment generated with GitHub Copilot.

Suspected regressing/root-cause PR: #24506.

PR #24506 introduced the CoreCLR device dylib-to-framework conversion path. The current failure is in that converted framework signing path: the converted frameworks appear to be signed before they are complete/recognized as framework bundles, producing a signing identifier that does not match the eventual Info.plist bundle identifier.