From 42af7506e17fe244a5d97d60a8b382580c3612a8 Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Thu, 18 Jun 2026 19:31:45 -0700
Subject: [PATCH] RU-T50 build fix

---
 app.config.ts                      | 17 +++++++++++++++++
 plugins/withCheckInLiveActivity.js | 24 ++++++++++++++++--------
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/app.config.ts b/app.config.ts
index 2f3a862..f0e4a41 100644
--- a/app.config.ts
+++ b/app.config.ts
@@ -21,6 +21,16 @@ const appIconBadgeConfig: AppIconBadgeConfig = {
   ],
 };
 
+// Declares the Live Activity widget extension to EAS so it provisions a matching
+// profile and signs the embedded .appex with the SAME certificate as the parent
+// app. Without this the widget builds unsigned and the archive fails with
+// "Embedded binary is not signed with the same certificate as the parent app".
+// Mirrors the Responder app's working Live Activity signing setup.
+const liveActivityExtension = {
+  targetName: 'CheckInTimerWidget',
+  bundleIdentifier: `${Env.BUNDLE_ID}.CheckInTimerWidget`,
+};
+
 export default ({ config }: ConfigContext): ExpoConfig => ({
   ...config,
   name: Env.NAME,
@@ -239,6 +249,13 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     ...ClientEnv,
     eas: {
       projectId: Env.EAS_PROJECT_ID,
+      build: {
+        experimental: {
+          ios: {
+            appExtensions: [liveActivityExtension],
+          },
+        },
+      },
     },
   },
 });
diff --git a/plugins/withCheckInLiveActivity.js b/plugins/withCheckInLiveActivity.js
index c228960..377125c 100644
--- a/plugins/withCheckInLiveActivity.js
+++ b/plugins/withCheckInLiveActivity.js
@@ -551,20 +551,28 @@ const withCheckInLiveActivity = (config, props = {}) => {
             CODE_SIGN_STYLE: 'Automatic',
             MARKETING_VERSION: resolvedMarketingVersion,
             CURRENT_PROJECT_VERSION: resolvedCurrentProjectVersion,
-            // Disable independent code signing for the widget extension.
-            // The widget is embedded in the main app and signed during the
-            // main target's archive/export phase. Without this, EAS (which
-            // uses manual signing) fails because it has no provisioning
-            // profile for the widget's bundle identifier.
-            CODE_SIGNING_ALLOWED: 'NO',
-            // Propagate the development team from the host target so the
-            // widget extension can be signed (required since Xcode 14+).
+            // Sign the widget extension with the SAME team/certificate as the parent
+            // app. The extension is declared to EAS via
+            // extra.eas.build.experimental.ios.appExtensions (app.config.ts), so EAS
+            // provisions a matching profile for its bundle id. We must NOT set
+            // CODE_SIGNING_ALLOWED=NO — an unsigned embedded binary fails the archive
+            // with "Embedded binary is not signed with the same certificate as the
+            // parent app".
             ...(hostDevelopmentTeam ? { DEVELOPMENT_TEAM: hostDevelopmentTeam } : {}),
           });
         }
       }
     }
 
+    // Mark the widget for automatic provisioning under the host app's development
+    // team so EAS/Xcode sign the embedded extension with the same certificate as
+    // the parent app (matches the host target's signing identity). Mirrors the
+    // Responder app's working Live Activity signing setup.
+    if (hostDevelopmentTeam) {
+      project.addTargetAttribute('DevelopmentTeam', hostDevelopmentTeam, widgetTarget);
+      project.addTargetAttribute('ProvisioningStyle', 'Automatic', widgetTarget);
+    }
+
     return config;
   });