iOS 2019.4 cloud builds crash at startup - signing problem?

I've spent the past week or so upgrading our iOS project from 2019.2 to 2019.4, and all was going well (albeit slowly), however I can't get a working cloud build.

Initially, cloud builds just wouldn't install - showing a popup "Unable to install <app_name>. This app cannot be installed because its integrity could not be verified".

I then made a build with a distribution profile, and tried uploading it to the App Store, which gave a more informative message: "ERROR ITMS-90075: "This bundle is invalid. The application-identifier entitlement is missing; it should contain your 10-character Apple Developer ID, followed by a dot, followed by your bundle identifier."

Comparing builds using the codesign utility, I found that in my working Xcode build, UnityFramework.framework was not signed, and in my not-working cloud builds, it was signed, but the entitlements file was missing "application-identifier".

I was able to add that through a PostProcess build step, which led to a build that would install but crashed on startup.

Strangely, a distribution build with that configuration did upload to TestFlight successfully, and installs and runs, but I need to be able to install direct from UCB.

I'd like to understand why the Cloud Build signing behaviour is different to Xcode - I assume this is the problem - and know how to change it. Grateful for any suggestions.

 

Best guess is that it's a problem with different Cocoapods versions. That's caused problems before (https://forum.unity.com/threads/builds-failing-with-cocoapods-errors.923495/). We use 1.10.1 locally, @victorw what's used in Cloud Build?

 

Is anyone successfully using cloud build for iOS with 2019.3/2019.4? If so, are you adding entitlements through a post process step?