How to Add Developer Certificate in LiveContainer

How to Add Developer Certificate in LiveContainer.md

Important notes:

• A developer certificate grants more permissions, so you’ll have to make some compromises.
• LiveContainer is optimized for SideStore, some features may not work.

Preparation:

• Buy developer certificate with the get-task-allow (JIT) entitlement, or enable it on your existing certificate.
• A computer is required, as some steps must be performed on it. The examples below use macOS.

Tutorial:

• Sign LC with the certificate using ESign (do not remove the .mobileprovision file).
• During signing, change the Bundle ID to your App ID from the .mobileprovision file, without the Developer Team prefix.
• Send the signed LC to your computer.
• Extract the entitlements from the LiveContainer binary using ldid (open .ipa → .app → LiveContainer):

ldid -e LiveContainer > entitlements.xml 

• Open entitlements.xml file and edit it by removing:

<key>com.apple.developer.icloud-container-development-container-identifiers</key>
<array/>
<key>com.apple.developer.icloud-container-identifiers</key>
<array/>
<key>com.apple.developer.icloud-services</key>
<string>*</string>

• Add your Team ID to all keychain groups from 0 to 127 (find and replace everywhere):

<key>keychain-access-groups</key>
    <array>
            <string>Team ID.com.kdt.livecontainer.shared</string>
            ...
            <string>Team ID.com.kdt.livecontainer.shared.127</string>
    </array>

• Send the entitlements.xml file to your iPhone or iPad.
• Open ESign → import LC and entitlements.xml → sign the app using the modified entitlements.
• Done!

---

If everything was done correctly, all items in the JIT-less diagnostics should be green. For iCloud, you can use stub.

Original guide