'Code sign a bundle.
This function tries to code sign an iOS bundle, following the same
algorithm as Xcode:
1. pick the provisioning profile that best match the bundle identifier,
and copy it into the bundle as embedded.mobileprovision,
2. copy Entitlements.plist from user or SDK next to the bundle,
3. code sign the bundle.'

def ExecCodeSignBundle(self, key, entitlements, provisioning):

    (substitutions, overrides) = self._InstallProvisioningProfile(provisioning, self._GetCFBundleIdentifier())
    entitlements_path = self._InstallEntitlements(entitlements, substitutions, overrides)
    subprocess.check_call(['codesign', '--force', '--sign', key, '--entitlements', entitlements_path, '--timestamp=none', os.path.join(os.environ['TARGET_BUILD_DIR'], os.environ['FULL_PRODUCT_NAME'])])
