How does Apple enforce the expiration of beta apps distributed through TestFlight

Question

A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired.

How can Apple enforce beta app expiration and how the test expiration time determined?

Answer 1

I'm assuming you are talking about beta versions of apps distributed through TestFlight.

While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in subject to a runtime kernel check which validates that the application expires after 60 days. See this example console log:

Mar  9 08:34:48 ***-iPhone amfid[***] <Error>:  SecTrustEvaluate  [leaf CriticalExtensions IssuerCommonName]
Mar  9 08:34:48 ***-iPhone amfid[***] <Error>: /private/var/mobile/Containers/Bundle/Application/B4BF7C1D-2DF4-4B8D-943B-57BABD30****/***.app/*** not valid: 0xe8008015: A valid provisioning profile for this executable was not found.
Mar  9 08:34:48 ***-iPhone kernel[0] <Notice>: AMFI: hook..execve() killing pid 10282: no code signature
Mar  9 08:34:48 ***-iPhone kernel[0] <Notice>: Sandbox: hook..execve() killing pid 10282: application requires container but none set
Mar  9 08:34:48 ***-iPhone com.apple.xpc.launchd[1] (UIKitApplication:com.***.***[0x4711][10282]) <Notice>: Service exited due to signal: Killed: 9

The kernel kills the process during a runtime check to see if the profile used to run the executable has passed its expiration day. The expiration of a provisioning profile is different than the expiration of the beta distributed application. Previously, users were able to turn back the device time to bypass this check, but I believe this was fixed in iOS 10.

The expiration time is set by Apple. In the early days of TestFlight this was 30 days, but I believe it has been extended to 60 days now.