Xcode Cloud: Unable to verify project that links GEOSwift using SPM

[romnes]

Hi,

Our project depends on GEOSwift (at commit ab813f1acbd92986e8733356b73b3f6d4ddc08e0 which should be the same as 9.0.0). We've shipped builds of our app using this dependency before, where the app was built using Fastlane.

We're now trying to migrate some CI/CD jobs to Xcode Cloud, but are finding that we receive failures during the step Prepare Build for App Store Connect:

ITMS-90334: Invalid Code Signature Identifier. The identifier "geos-<long identifier>" in your code signature for "geos" must match its Bundle Identifier "geos"

Not entirely sure if this is an issue with GEOSwift/geos or Xcode Cloud, but simibac/ConfettiSwiftUI#8 seems to indicate it's an issue with libraries that are forced to be dynamic. This appears to be the case for the geos dependency as well (see https://github.com/GEOSwift/geos/blob/main/Package.swift)

[macdrevx]

it's an issue with libraries that are forced to be dynamic. This appears to be the case for the geos dependency as well (see https://github.com/GEOSwift/geos/blob/main/Package.swift)

That sounds like a good guess. The linked ConfettiSwiftUI issue suggests choosing Embed & Sign. Does that work?

geos is forced to be dynamic for licensing purposes: https://github.com/GEOSwift/GEOSwift#requirements

GEOS is licensed under LGPL 2.1 and its compatibility with static linking is at least controversial. Use of geos without dynamic linking is discouraged.

[romnes]

The dependency has been added through Xcode, and there are no options under the "Embed" part of the UI:

FYI I've also filed a feedback with Apple (FB10519932) and attached a sample project using GEOSwift as the dependency (though I don't think this is an issue with GEOSwift specifically).