Code signing and provisioning
The certificates and profiles that prove your build is really yours and say which capabilities, and for test builds which devices, it may use.
See it
What it is
Phones only run apps that carry a cryptographic signature they trust, so shipping means proving three things. On iOS: a certificate (who built this), a provisioning profile (which bundle ID, which capabilities, and, for development and ad hoc profiles only, which specific devices; an App Store distribution profile carries no device list at all), and entitlements (push, iCloud, app groups) that must match what the profile allows. On Android it is simpler in shape: a keystore holding the key that signs your APK or bundle, with Play App Signing keeping the real distribution key on Google's side while you hold an upload key.
Day to day, let Xcode's automatic signing handle it while you develop, and move to something reproducible for CI: fastlane match keeps certificates and profiles encrypted in a private git repo so every machine gets the same identity, and Expo EAS or Codemagic will manage credentials for you. The rule that saves hours is that a signing error is almost always a mismatch, not corruption: a development or ad hoc profile does not list this device, or the entitlement is not in the profile, or the bundle ID has a typo.
Two real gotchas. Apple certificates expire annually and distribution profiles go with them, which means a build that worked in March fails in April for no code reason. And on Android, if you sign with your own key and lose that keystore, you can never update the app again; enrolling in Play App Signing before launch is the fix, since a lost upload key can be reset and a lost app signing key cannot.
Ask AI for it
Set up reproducible code signing for my iOS and Android app in CI. For iOS, use fastlane match to store the distribution certificate and App Store provisioning profile in a private encrypted git repo, disable Xcode automatic signing for the release configuration, and pin the bundle ID and entitlements the profile must contain. For Android, generate an upload keystore, enroll the app in Play App Signing, and keep the keystore password and key alias in CI secrets rather than the repo. Add a preflight step that fails early with a readable message if a certificate or profile expires within 30 days.