Xcode Archive Integrity and Signing Behavior After External Restore

Direct Answer

Xcode does not provide a built-in checksum or integrity validator for a restored .xcarchive. Organizer will list the archive, but the only validation occurs when you start the export flow and Xcode resolves signing assets. If the original code-signing certificate and its private key are absent from the local keychain, Xcode cannot re-sign with the original identity; export will fail or Xcode will prompt you to select or create a different identity.

Confirmed Behavior

• An .xcarchive stores the app bundle, dSYMs, and archive metadata, but never the private key used to sign it.
• Re-export requires a matching distribution certificate with its private key present in the login or system keychain, plus a valid provisioning profile.
• With automatic signing, Xcode may offer to create or download a new certificate and profile, but it cannot recover a lost private key. If no usable identity exists, export fails.
• With manual signing, Xcode lists only identities that have private keys. If the original identity is missing, no matching certificate or profile appears, and Xcode does not silently substitute another identity.
• DerivedData is not part of the archive. Its absence does not corrupt the archive, but build logs and some indexed symbols are not restored.

Likely Explanation for Restore Problems

External backup and restore tools can drop extended attributes, ACLs, permissions, or the bundle bit when copying .xcarchive directories. If the bundle bit or symlinks under Products/Applications are lost, Organizer may fail to recognize the archive correctly. This is a filesystem metadata issue, not a signing issue.

Verification Steps

1. Check that the archive is still a bundle and metadata survived: ls -l@ /path/to/App.xcarchive and xattr -lr /path/to/App.xcarchive.
2. List usable code-signing identities: security find-identity -v -p codesigning.
3. Inspect the existing signature on the archived app: codesign -dv --verbose=4 /path/to/App.xcarchive/Products/Applications/App.app and spctl --assess --type execute /path/to/App.xcarchive/Products/Applications/App.app.
4. In Organizer, select the archive and choose Export. Note any missing identity or provisioning-profile error before selecting a distribution method.

Critical Diagnostic

Were the original code-signing certificate and its private key imported into the new Mac's keychain? If yes, the problem is likely archive metadata or profile validity. If no, you must import the key from a keychain backup or create a new distribution identity; the original archive cannot be re-signed with the original identity without that private key.

Behavior varies by Xcode and macOS release; confirm prompts and automatic-signing options on the exact Xcode version you use for export.