How to Fix “Entitlements File Was Modified During the Build” in Xcode

Entitlements file "MyApp.entitlements" was modified during the build, which is not supported.

You can disable this error by setting 'CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION' to 'YES', however this may cause the built product's code signature or provisioning profile to contain incorrect entitlements.

What is an entitlements file?

Entitlements describe special capabilities that an executable claims through its code signature.

They can include features such as:

• Push Notifications
• App Groups
• Keychain Sharing
• iCloud
• Associated Domains
• Sign in with Apple
• App Sandbox

A typical file is named:

MyApp.entitlements

and uses property-list syntax.

What does “modified during the build” mean?

Xcode treats the entitlements file as part of the signing input.

If the file changes after Xcode has already inspected it, the content originally used to prepare the signing operation may no longer match the content available later in the build.

Xcode therefore stops with:

Entitlements file was modified during the build

Typical situations where the error appears

• A Run Script phase edits the .entitlements file
• PlistBuddy changes App Groups during the build
• sed replaces environment-specific values
• Debug and Release dynamically rewrite one shared file
• A Fastlane action modifies the entitlements file
• A CI process rewrites the file during xcodebuild
• Several targets share and modify the same entitlements file
• A code-generation tool recreates the file during the build
• A script copies another file over the signing entitlements
• Stale DerivedData causes a one-time mismatch

What to check first

1. Check CODE_SIGN_ENTITLEMENTS

Open:

Target → Build Settings → Code Signing Entitlements

The underlying setting is:

CODE_SIGN_ENTITLEMENTS

For example:

MyApp/MyApp.entitlements

Identify exactly which file Xcode is using.

2. Inspect Run Script phases

Open:

Target → Build Phases

and search scripts for commands such as:

PlistBuddy sed cp mv echo cat

that may modify the entitlements file.

3. Search the project for references to .entitlements

grep -R "\.entitlements" .

Search for PlistBuddy:

grep -R "PlistBuddy" .

Common causes

1. A Run Script edits the entitlements file in place

For example:

/usr/libexec/PlistBuddy \ -c "Set :com.apple.developer.associated-domains:0 applinks:staging.example.com" \ MyApp.entitlements

This mutates a signing input during the build.

2. One entitlements file is rewritten for several configurations

For example:

Debug: group.com.example.debug

Release:
group.com.example

should not normally be implemented by rewriting the same file during xcodebuild.

3. CI rewrites the file while the build is running

A CI job that modifies the source tree after xcodebuild has begun can trigger the error.

4. Fastlane or another automation step changes entitlements

Signing automation may contain an action or custom script that edits the source file.

5. Multiple targets modify a shared file

The app, widget, or notification extension may share one file even though they need different capabilities.

6. A generated file is copied over the original

cp generated.entitlements MyApp.entitlements

can invalidate Xcode’s earlier view of the signing input.

7. Build caches are stale

After configuration changes, a stale build artifact can occasionally trigger the error even though the source file is no longer being modified.

Solution 1: Clean the build folder

Start with:

Product → Clean Build Folder

This can resolve a one-time stale-build-state issue.

Solution 2: Delete DerivedData

rm -rf ~/Library/Developer/Xcode/DerivedData/*

Then reopen Xcode and rebuild.

Solution 3: Stop editing the source entitlements file during the build

Remove scripts such as:

/usr/libexec/PlistBuddy \ -c "Set :com.apple.security.application-groups:0 group.com.example.staging" \ MyApp.entitlements

when they operate on the same file Xcode uses for signing.

Solution 4: Use separate entitlements files per configuration

Create stable files such as:

MyApp-Debug.entitlements MyApp-Staging.entitlements MyApp-Release.entitlements

Then configure Debug:

CODE_SIGN_ENTITLEMENTS = MyApp/MyApp-Debug.entitlements

and Release:

CODE_SIGN_ENTITLEMENTS = MyApp/MyApp-Release.entitlements

Solution 5: Switch entitlements with .xcconfig files

Debug.xcconfig:

CODE_SIGN_ENTITLEMENTS = MyApp/MyApp-Debug.entitlements

Release.xcconfig:

CODE_SIGN_ENTITLEMENTS = MyApp/MyApp-Release.entitlements

This keeps the signing input stable for each build.

Solution 6: Use Signing & Capabilities when possible

For standard capabilities, prefer:

Target → Signing & Capabilities

for configuration instead of custom scripts that rewrite the plist.

Solution 7: Generate entitlements before xcodebuild starts

If generated entitlements are unavoidable, generate them before invoking Xcode:

./Scripts/generate-entitlements.sh

xcodebuild
-project MyApp.xcodeproj
-scheme MyApp
-configuration Release
archive

Do not modify the selected signing file after xcodebuild has started.

Solution 8: Generate into a dedicated file

For example:

Generated/MyApp-Release.entitlements

Generate that file before the build and point CODE_SIGN_ENTITLEMENTS to it.

Solution 9: Check build-phase ordering

Inspect:

Target → Build Phases

but prefer eliminating mid-build mutation instead of relying solely on phase ordering.

Solution 10: Use Git to detect changes caused by the build

Before building:

git status

After building:

git status

Then inspect:

git diff -- MyApp/MyApp.entitlements

If the build itself creates a diff, something is modifying the file.

Solution 11: Check the file timestamp

stat MyApp/MyApp.entitlements

If the timestamp changes during a build even when the content appears unchanged, a script may be regenerating or copying the file.

Solution 12: Understand CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION

Xcode’s diagnostic mentions:

CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES

This can disable the error check.

However, Xcode also warns that allowing modifications may result in incorrect entitlements in the signed product or provisioning profile.

Solution 13: If absolutely necessary, limit the workaround to Debug

Debug: CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES

Release:
CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = NO

This is still not a replacement for fixing the build pipeline.

Solution 14: Verify the provisioning profile supports the entitlements

Even after preventing file mutation, the entitlements in the file must still be compatible with your signing assets.

For example, an App Group entitlement requires the corresponding capability and provisioning configuration.

Solution 15: Inspect the entitlements in the final code signature

codesign -d \ --entitlements :- \ /path/to/MyApp.app

This shows the entitlements actually embedded in the code signature.

Solution 16: Inspect the provisioning profile entitlements

security cms -D \ -i /path/to/MyApp.app/embedded.mobileprovision \ > /tmp/profile.plist

Then:

/usr/libexec/PlistBuddy \ -c "Print :Entitlements" \ /tmp/profile.plist

Compare those values with the application’s signed entitlements.

Solution 17: Do not rewrite App Groups during the build

If environments use different identifiers:

group.com.example.debug group.com.example.staging group.com.example

use separate stable files instead.

Solution 18: Do not rewrite Associated Domains during the build

For example:

Debug: applinks:staging.example.com

Release:
applinks:example.com

should preferably live in separate configuration-specific entitlements files.

Solution 19: Give each target its own entitlements file when appropriate

MyApp.entitlements MyWidget.entitlements NotificationService.entitlements

Different executable targets often require different entitlement sets.

Solution 20: Do not mutate the source tree during xcodebuild in CI

Avoid performing commands such as:

sed -i ... PlistBuddy ... cp ... MyApp.entitlements

while xcodebuild is already running.

Complete all generation or substitution work before starting the build.

If Clean Build Folder fixes the problem only once

That usually suggests something modifies the entitlements again during the next build.

Inspect Run Script phases and external build automation rather than adding Clean Build Folder to every workflow.

If deleting DerivedData does not help

Focus on:

1. Run Script phases
2. Fastlane
3. CI scripts
4. PlistBuddy commands
5. sed substitutions
6. File-copy or generation steps
7. Shared entitlements files across multiple targets

If the error occurs only during Archive

Check:

• Release-only scripts
• Release .xcconfig files
• Archive environment variables
• Distribution-signing settings
• The Release CODE_SIGN_ENTITLEMENTS value

What you should avoid

The build may succeed while producing unexpected signing entitlements for capabilities such as:

• App Groups
• Push Notifications
• Associated Domains
• Keychain Sharing

For distribution builds in particular, keeping signing inputs deterministic is the safer design.

Fast troubleshooting checklist

1. Check CODE_SIGN_ENTITLEMENTS.
2. Run Product → Clean Build Folder.
3. Delete DerivedData if needed.
4. Inspect Run Script phases.
5. Search for PlistBuddy modifications.
6. Search for sed replacements.
7. Compare git status before and after the build.
8. Check the entitlements file timestamp.
9. Use separate files for Debug and Release.
10. Switch files with CODE_SIGN_ENTITLEMENTS.
11. Prefer Signing & Capabilities for standard capabilities.
12. Generate entitlements before xcodebuild starts.
13. Check whether multiple targets modify one shared file.
14. Verify provisioning-profile compatibility.
15. Use CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION only as a last-resort workaround.

Summary

Xcode’s “Entitlements file was modified during the build” error means that the entitlements file used for code signing changed after the build had already started.

The most common causes are Run Script phases, PlistBuddy, sed, CI automation, Fastlane, or generated-file steps that directly rewrite the .entitlements file.

Start by cleaning the build folder and, if necessary, deleting DerivedData. If the error returns, inspect the build scripts rather than repeatedly cleaning.

If different environments require different entitlement values, use separate Debug, Staging, and Release entitlements files and select them through CODE_SIGN_ENTITLEMENTS or .xcconfig files.

Xcode does provide CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION=YES as a way to suppress the check, but its own diagnostic warns that the resulting signed product may contain incorrect entitlements.

The safest permanent solution is to make the signing entitlements stable before the build starts and keep them unchanged until code signing is complete.