Skip to main content

Solved: Xcode "Unable to install the app" (Error -402620395)

 Few things break a developer's flow like a build that succeeds during compilation but fails specifically during installation on a physical device.

You have likely encountered a generic alert stating "Unable to install the app," accompanied by the "Details" expansion revealing the true culprit: Error -402620395: A valid provisioning profile for this executable was not found.

This error is common, notoriously vague, and almost exclusively happens when moving from the iOS Simulator to a physical iPhone or iPad. Below is the technical root cause analysis and the definitive fix for this code signing mismatch.

The Root Cause: Entitlements Mismatch

To fix this efficiently, you must understand what iOS is rejecting. The error is rarely about the profile being "missing" in the literal sense; it is usually present but invalid for the current operation.

When you click "Run" in Xcode, two distinct actions occur:

  1. Installation: installd moves the binary to the device.
  2. Debugging: debugserver attempts to attach the LLDB debugger to the process.

The get-task-allow Conflict

For a debugger to attach to a running app on a secured iOS device, the app's code signature must contain the get-task-allow entitlement.

Development Profiles include get-task-allow: true. Distribution/Ad Hoc Profiles strictly set get-task-allow: false.

Error -402620395 usually occurs because your Xcode Scheme is configured to build a Release/Distribution version of the app, but you are trying to Run/Debug it. The device installs the app (which lacks debug permissions), and when Xcode attempts to attach the debugger, the security handshake fails, triggering the rollback.

Solution 1: Check the Build Configuration Scheme

The most frequent cause is an accidental configuration change in the Xcode Scheme. You are likely telling Xcode to "Run" the "Release" build configuration.

  1. In Xcode, click the Product menu.
  2. Select Scheme -> Edit Scheme... (or press Cmd + <).
  3. On the left sidebar, ensure Run is selected.
  4. Check the Info tab.
  5. Look at the Build Configuration dropdown.

The Fix: If this is set to Release, change it to Debug.

Release builds are optimized for performance and stripped of debug symbols and the get-task-allow entitlement. They cannot be debugged via Xcode's "Run" button.

Solution 2: Verify Signing Identity Mismatches

If your Scheme was already correct, the issue lies in your Build Settings. You may be forcing a Distribution certificate onto the Debug configuration.

  1. Navigate to your Project Navigator (left sidebar).
  2. Select your generic Project node (blue icon).
  3. Select your Target in the center pane.
  4. Click the Signing & Capabilities tab.

The Fix: Ensure that "Automatically manage signing" is checked. If you must use manual signing, verify the following in the Build Settings tab (search for "Signing Identity"):

  • Debug should map to Apple Development (or iOS Developer).
  • Release should map to Apple Distribution (or iOS Distribution).

If your Debug configuration is pointing to an "iPhone Distribution" certificate, the provisioning profile generated will reject the debugger, causing Error -402620395.

Solution 3: The "clean" Command

Sometimes, Xcode caches an old provisioning profile inside the DerivedData folder, even after you have corrected the settings.

  1. Stop any running tasks in Xcode.
  2. Run Product -> Clean Build Folder (Shift + Cmd + K).
  3. Delete the app manually from your physical iPhone.
  4. Run the build again.

Deep Dive: Verifying the Entitlements

If the error persists, you need to verify exactly what entitlements are ending up in your built binary. We can use the command line to inspect the code signature of the .app bundle generated by Xcode.

The Inspection Script

Open your terminal. Navigate to your DerivedData folder (usually ~/Library/Developer/Xcode/DerivedData) and find your built app.

Run the following command to extract the entitlements from the signed application:

# Syntax: codesign -d --entitlements :- "PathToYour.app"

codesign -d --entitlements :- /Users/yourname/Library/Developer/Xcode/DerivedData/MyApp-abcd/Build/Products/Debug-iphoneos/MyApp.app

Analyzing the Output

The output will be an XML property list. You are looking for this specific key:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Other entitlements... -->
    
    <key>get-task-allow</key>
    <true/>
    
    <!-- Other entitlements... -->
</dict>
</plist>

If <key>get-task-allow</key> is missing or set to <false/>: Your build system is still using a Distribution profile or Release configuration. You cannot debug this build.

If <key>get-task-allow</key> is <true/>: Your binary is correct. The issue is likely that the physical device's UDID is missing from the specific Development Provisioning Profile being used.

Handling Edge Cases

Device Not Registered

If you recently bought a new test device, standard "Automatic Signing" usually catches this. However, if you are in a large team, the profile might not have updated yet.

  1. Log in to the Apple Developer Portal.
  2. Go to Devices.
  3. Ensure your device UDID is present.
  4. In Xcode, go to Settings (Preferences) -> Accounts.
  5. Select your Apple ID and click Download Manual Profiles (or simply delete the cached profiles in ~/Library/MobileDevice/Provisioning Profiles/ to force a refresh).

The "Trust" Issue

On iOS 16 and later, even with a valid install, the device may block launch until Developer Mode is enabled.

  1. On the iPhone, go to Settings -> Privacy & Security.
  2. Scroll to the bottom and look for Developer Mode.
  3. Turn it On and restart the device.

Summary

Xcode Error -402620395 is a safety mechanism, not a bug. It prevents a debugger from attaching to a secure, production-signed application.

By ensuring your Scheme is set to Debug and your Signing Identity is set to Development, you ensure the get-task-allow entitlement is present, allowing Xcode to install and attach to your application successfully.

Labels: