# Signed XCFramework from SPM

**URL:** https://community.tuist.dev/t/signed-xcframework-from-spm/940
**Category:** General
**Created:** [March 13, 2026, 11:52am UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940 "2026-03-13T11:52:31Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Jon889](https://community.tuist.dev/user_avatar/community.tuist.dev/jon889/32/821_2.png) [@Jon889](https://community.tuist.dev/u/Jon889)
#### Post date: [March 13, 2026, 11:52am UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/1 "2026-03-13T11:52:31Z")

</div>

Hi,

I’m trying to add the expected signature to an XCFramework that is an SPM dependency. I can see that it’s possible to add the expected signature for a local XCFramework dependency [here](https://github.com/tuist/tuist/blob/main/examples/xcode/generated_app_with_signed_xcframework_dependencies/Project.swift#L19) but the `expectedSignature`parameter doesn’t exist for an external dependency.

I can see from the pbxproj that it’s stored like this:

`77C479C930030662A4AF2CDF /* Foo.xcframework */ = {isa = PBXFileReference; expectedSignature = "AppleDeveloperProgram:TEAMID:NAME"; lastKnownFileType = wrapper.xcframework; path = Foo.xcframework; sourceTree = "<group>"; };`

Then in Xcode if the project is built and the code signature has changed it will fail the build. Without storing this in git then if the signing on the framework is removed or changed the build won’t fail.

Is there a way to do this in Tuist?

Thanks,  
Jonathan

---

<div class="post-metadata">

### Author: ![pepicrft](https://community.tuist.dev/user_avatar/community.tuist.dev/pepicrft/32/5_2.png) [@pepicrft](https://community.tuist.dev/u/pepicrft)
#### Post date: [March 18, 2026, 5:58pm UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/2 "2026-03-18T17:58:33Z")

</div>

Hey @Jon889 👋

Would like to get your thoughts on [this solution](https://github.com/tuist/tuist/pull/9914) and the API that I propose for it.

---

<div class="post-metadata">

### Author: ![Jon889](https://community.tuist.dev/user_avatar/community.tuist.dev/jon889/32/821_2.png) [@Jon889](https://community.tuist.dev/u/Jon889)
#### Post date: [March 19, 2026, 1:41am UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/3 "2026-03-19T01:41:45Z")

</div>

Thanks for the quick turnaround!  
The API makes sense to me 🙂

I tried out the branch locally and while there was a small compilation issue (with the `ProjectDescription.XCFrameworkSignatue.from`function being fileprivate and being used from `PackageInfoMapper)`It worked well, validating the SDK on generation and also inside Xcode, both for valid and invalid signatures.

---

<div class="post-metadata">

### Author: ![pepicrft](https://community.tuist.dev/user_avatar/community.tuist.dev/pepicrft/32/5_2.png) [@pepicrft](https://community.tuist.dev/u/pepicrft)
#### Post date: [March 19, 2026, 7:37am UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/4 "2026-03-19T07:37:36Z")

</div>

Thank you @Jon889. I’ll then push it to the finish line. Once we have it merged, it’ll be released automatically.

---

<div class="post-metadata">

### Author: ![Jon889](https://community.tuist.dev/user_avatar/community.tuist.dev/jon889/32/821_2.png) [@Jon889](https://community.tuist.dev/u/Jon889)
#### Post date: [April 10, 2026, 1:19pm UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/5 "2026-04-10T13:19:22Z")

</div>

Thanks for your work on this, I’ve implemented the changes and it’s working well!

---

<div class="post-metadata">

### Author: ![pepicrft](https://community.tuist.dev/user_avatar/community.tuist.dev/pepicrft/32/5_2.png) [@pepicrft](https://community.tuist.dev/u/pepicrft)
#### Post date: [April 19, 2026, 4:07pm UTC](https://community.tuist.dev/t/signed-xcframework-from-spm/940/6 "2026-04-19T16:07:12Z")

</div>

That’s awesome to hear 🙂