title: Code Signing: Identifier of Designated Requirements mismatches app identifier
body: <p>I have an app that <code>codesign</code> can’t completely verify because it "does not satisfy its designated Requirement". The first check returns "valid on disk", so that's okay.</p>
  
  <p><code>codesign -dvvvv -r- PATH_TO_APP</code> told me the requirement, it is:</p>
  
  <pre><code>Identifier=com.foobar.BarBuz-Helper
  [...]
  designated =&gt; anchor apple generic and identifier "com.foobar” and
    (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or 
    certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and 
    certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and 
    certificate leaf[subject.OU] = XXXXXXXXXX)
  </code></pre>
  
  <p>Looks correct. Except, that the identifier of the app is actually not “com.foobar” but "com.foobar.BarBuz-Helper", in my opinion that's the reason why it does not satisfy its requirements.</p>
  
  <p>Xcode signs the app with the wrong identifier. That’s the Xcode command that is run:</p>
  
  <pre><code>CodeSign /Users/matthias/[…]-Helper
      setenv CODESIGN_ALLOCATE /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
      Using code signing identity "Developer ID Application: Matthias Bauch"
      /usr/bin/codesign --force --sign 0123456789 --requirements =designated\ =&gt;\ anchor\ apple\ generic\ \ and\ identifier\ \"com.foobar\"\ and\ ((cert\ leaf[field.1.2.840.113635.100.6.1.9]\ exists)\ or\ (\ certificate\ 1[field.1.2.840.113635.100.6.2.6]\ exists\ and\ certificate\ leaf[field.1.2.840.113635.100.6.1.13]\ exists\ \ and\ certificate\ leaf[subject.OU]\ =\ \"XXXXXXXXXX\"\ )) /Users/matthias/[...]-Helper
  </code></pre>
  
  <p>I have no idea why this happens. </p>
  
  <p>Does anybody know what went wrong here? Where does an app get its designated code signing requirements from? Why does the identifier of the app not match the identifier in the DR? </p>
  
  <p>I checked all the plists, and the build settings, I can’t find the place where this happens.</p>