bug:ITMS-91065 Missing signature for _ssl.framework and _hashlib.framework in iOS IPA built with Flet 0.86.2

[azarmama56-ship-it]

Duplicate Check

• I have searched the opened issues and there are no duplicates

Describe the bug

Hello!

I'm having a problem publishing an iOS app built with Flet.

Environment:
•⁠ ⁠Flet 0.86.2
•⁠ ⁠Flutter 3.44.7
•⁠ ⁠Python 3.13.9
•⁠ ⁠Xcode 26.0
•⁠ ⁠macOS 26.5.2

The app builds successfully and uploads to App Store Connect.

Apple rejects every uploaded build with:

ITMS-91065: Missing signature

Affected frameworks:
•⁠ ⁠Frameworks/_ssl.framework/_ssl
•⁠ ⁠Frameworks/_hashlib.framework/_hashlib

Apple references BoringSSL / openssl_grpc.

Things already tested:

•⁠ ⁠Rebuilt the app multiple times
•⁠ ⁠Clean build
•⁠ ⁠Regenerated certificates and provisioning profiles
•⁠ ⁠Verified code signing
•⁠ ⁠Manually re-signed _ssl.framework
•⁠ ⁠Manually re-signed _hashlib.framework
•⁠ ⁠Built with --no-swift-package-manager
•⁠ ⁠Built with Python 3.14 runtime
•⁠ ⁠Same result

My normal build (with default settings) produces an IPA that uploads successfully but is rejected by Apple with ITMS-91065.

The alternative build using --no-swift-package-manager produced only an .xcarchive and no IPA.

Is this a known issue with the embedded Python runtime?

Is there an updated runtime or workaround that allows publishing to the App Store?

If needed, I can provide the complete build logs and the generated archive for investigation.Additional information:

The default build produces an IPA that uploads successfully to App Store Connect but is rejected with ITMS-91065.

I also tested:

•⁠ ⁠--no-swift-package-manager
•⁠ ⁠--python-version 3.14

In that configuration Flet reported "Successfully built your .ipa bundle", but only an .xcarchive was generated and no .ipa file was created.

Could you please confirm whether this is a known issue with the current embedded Python runtime or the iOS packaging process?

Thank you!

Code sample

Code

[Paste your code here]

To reproduce

1. Create a Flet iOS app.
2. Build using:

flet build ipa --ios-export-method app-store

3. Upload the generated IPA to App Store Connect.
4. Apple rejects the upload with:

ITMS-91065: Missing signature

Affected frameworks:

• _ssl.framework/_ssl
• _hashlib.framework/_hashlib

Expected behavior

The IPA should be accepted by App Store Connect without ITMS-91065 missing signature errors.

Screenshots / Videos

Captures

[Upload media here]

Operating System

macOS

Operating system details

macOS 26.5.2

Flet version

0.86.2

Regression

No, it isn't

Suggestions

I suspect the issue is related to signing of bundled Python frameworks (_ssl.framework and _hashlib.framework) when building an iOS IPA for App Store distribution.

Logs

Logs

[Paste your logs here]

Additional details

Environment:

• Flet 0.86.2
• Flutter 3.44.7
• Python 3.13.9
• Xcode 26.0

I also tested:

• --python-version 3.14
• --no-swift-package-manager

The issue still occurs. Apple rejects the IPA with ITMS-91065 for _ssl.framework and _hashlib.framework.

[FeodorFitsner]

Have you built it with Python 3.14 (default)?

[FeodorFitsner]

Working on it! Thanks for reporting.

[azarmama56-ship-it]

Yes.

I built it with Python 3.14 using:

flet build ipa --python-version 3.14 --no-swift-package-manager --build-number 10 --ios-export-method app-store

Apple still rejects the IPA with ITMS-91065:

• Missing signature for _ssl.framework/_ssl
• Missing signature for _hashlib.framework/_hashlib

[FeodorFitsner]

Can you build a signed .ipa and check with the following script its contents:

#!/usr/bin/env bash
# Usage: check-ipa-signatures.sh path/to/App.ipa
set -euo pipefail

ipa=${1:?usage: check-ipa-signatures.sh <App.ipa>}
work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
unzip -q "$ipa" -d "$work"
app=$(find "$work/Payload" -maxdepth 1 -name '*.app' | head -1)
[ -n "$app" ] || { echo "no .app inside $ipa" >&2; exit 1; }

printf '%-34s %-8s %-9s %s\n' FRAMEWORK SIGNED MANIFEST AUTHORITY
for fw in "$app"/Frameworks/*.framework; do
    if info=$(codesign -dvvv "$fw" 2>&1); then
        signed=yes; authority=$(printf '%s\n' "$info" | grep -m1 '^Authority=' | cut -d= -f2-)
    else
        signed=NO; authority='-'
    fi
    [ -f "$fw/PrivacyInfo.xcprivacy" ] && manifest=yes || manifest=-
    printf '%-34s %-8s %-9s %s\n' "$(basename "$fw" .framework)" "$signed" "$manifest" "$authority"
done

[azarmama56-ship-it]

Hi! I rebuilt the app using:
flet build ipa --no-swift-package-manager --python-version 3.14 --build-number 11 --ios-export-method app-store
The build completed successfully and printed:
Successfully built your .ipa bundle for iOS!
However, no .ipa file was generated. The build/ipa directory contains only:
epds_ios.xcarchive
I checked the entire project and my home directory, and there is no .ipa file anywhere, so I can't run check-ipa-signatures.sh because it expects an .ipa archive.
Inside the archive I found the app here:
epds_ios.xcarchive/Products/Applications/epds_ios.app
Am I missing a step to export the signed .ipa, or should I run the script on the .app instead?

[FeodorFitsner]

Then how/what did you submit to App Store?

[azarmama56-ship-it]

I did submit an .ipa to App Store Connect previously, and Apple processed it before rejecting it with ITMS-91065. However, after rebuilding today with the same command, I can only find the .xcarchive and no .ipa

[azarmama56-ship-it]

The original upload was definitely an .ipa. I checked the Transporter logs, and they show that Transporter uploaded epds_ios.ipa (43,780,630 bytes). Unfortunately, I no longer have that IPA because it was removed after the upload. I can generate a new build and run your signature-check script on the new IPA.

[FeodorFitsner]

Yes, you need .ipa to submit to App Store. If you don't get .ipa check flet build logs more carefully - there could be errors/warnings like cert/profile is not found.