iOs - widget - .appex' is not signed using an Apple submission certificate

[rokmeglicbit]

Knowledge / References

• Microsoft blog: using AdditionalAppExtensions
• Medium article: using BundleResource

I have a valid, properly signed Widget Extension with the correct distribution certificate and provisioning profile.
The widget works on Development profile.
Codesign shows correct profile.
codesign -dv --verbose=4 Payload/.../WidgetExtension.appex

The problem starts when we upload this to the App Store.

What's strange is that both approaches produce a valid .appex bundle before the MAUI build:

However, after building the MAUI app, the resulting .appex inside the application bundle becomes 0 KB:

As a result, App Store Connect validation fails with:

Validation failed (409)

Missing or invalid signature. The bundle '.WidgetExtension' at bundle path
'Payload/AppExample.app/PlugIns/WidgetExtension.appex'
is not signed using an Apple submission certificate.

The original WidgetExtension.appex is correctly signed and contains all expected files (Info.plist, executable, _CodeSignature, etc.).

The issue appears to occur during the MAUI build/publish process, where the .appex bundle is copied into the final .app package as an empty (0 KB) bundle, causing the signature to be lost.

Has anyone successfully bundled an existing signed Widget Extension into a .NET MAUI iOS application using either AdditionalAppExtensions or BundleResource? Is there an additional MSBuild step required to preserve the contents and signature of the .appex bundle?

[rokmeglicbit]

@rolfbjarne is this related to dotnet/macios#23424?

[JohnHDev]

@rokmeglicbit Yes my Maui apps have widget extensions and deploy to the App Store correctly.
Im using ADO build pipelines and had to resign as part of the build though. Copilot helped me with that.

[rokmeglicbit]

@JohnHDev can you please give me an example how did you achieve this?

[rolfbjarne]

Yes, this might be a variation of dotnet/macios#23424.

As a workaround, it should work if you create the .ipa on macOS (dotnet publish) instead of using Windows.

[rokmeglicbit]

@rolfbjarne confirmed, it works. The project must be copied to macOS, and the full build is then executed locally via command.