Moe's App Hub Signer Documentation

Introduction

Moe's App Hub Signer is a web-based signing workspace for iOS IPA files. Start from /signer, then Moe's App Hub will send approved sessions into the signer app while keeping this documentation public for everyone else.

Requirements

To use Moe's App Hub Signer, you'll need the following:

• An IPA file (iOS application)
• A P12 certificate file (exported from Keychain Access or Apple Developer Portal)
• A mobile provisioning profile (.mobileprovision file)
• The password for your P12 certificate (if it's password protected)
• A modern web browser (Chrome, Firefox, Safari, or Edge recommended)
• A verified Moe's App Hub account with signer access

Basic Usage

Step 1: Prepare Your Files

Make sure you have all the required files ready:

• IPA file (the application you want to sign)
• P12 certificate file
• Mobileprovision profile

Step 2: Upload Your Files

1. Click on the respective file selection buttons to upload your IPA, P12, and mobileprovision files.
2. If your P12 certificate requires a password, enter it in the password field.
3. Alternatively, if you have a direct URL to an IPA file, you can enter it in the "Direct IPA URL" field instead of uploading an IPA file.

Step 3: Choose Storage Option

Select one of the available storage modes:

• Temporary share link: Standard signing with an expiring install/share link
• 5-day direct link: Uploads your signed IPA to Storj-backed storage when that option is enabled

Step 4: Sign IPA

Click the "Sign IPA" button to start the signing process. The system will:

1. Upload your files to the server
2. Process and sign the IPA file with your certificate
3. Generate an install button and a shareable landing page

Step 5: Install the Signed App

Once the signing process is complete, you'll see a success message with options to:

• Install the app directly on your device
• Copy the share link to send a landing page with app details and an install button
• Sign another app

File Requirements

IPA File

An IPA (iOS App Store Package) file is a compressed application bundle. Requirements:

• Must be a valid, unencrypted IPA file
• Default app-side size limit: 4096MB (proxy or CDN limits may still apply upstream)
• Should be the original application without previous modifications (for best results)

P12 Certificate

A P12 file contains your private key and certificate for signing. Requirements:

• Must be exported from Keychain Access or the Apple Developer Portal
• Should contain both the certificate and private key
• If password protected, you'll need to provide the password

Mobileprovision Profile

A provisioning profile connects your certificate with allowed devices. Requirements:

• Must be valid and not expired
• Should include the UDID of any device you want to install the app on
• Should match the certificate you're using
• For wildcard provisioning profiles, make sure the bundle ID in advanced settings matches your profile's allowed pattern

Advanced Options

Moe's App Hub Signer provides several advanced options for modifying your IPA during the signing process. Click the "Advanced Modifications" button to access these features:

App Customization

• New App Name: Change the display name applied before the final signing step
• New Version: Modify the version number
• New Bundle ID: Change the bundle identifier applied before the final signing step
• Minimum OS Version: Set the minimum iOS version required to run the app
• New Icon: Replace the app icon with a custom image

Tweaks and Modifications

• Tweak Files: Add custom dylib or tweak files to the application
• Dylib Removal: Scan and selectively remove dylib files from the application
• Remove UISupportedDevices: Remove device restrictions from the Info.plist
• Remove watch apps: Strip Apple Watch components to reduce file size
• Enable document support: Add document support capabilities to the app
• Fakesign all binaries: Use fake signing for internal binaries
• Thin to arm64: Remove unused architectures to reduce file size
• Remove all extensions: Strip app extensions to reduce file size or fix compatibility issues
• Ignore encryption check: Try to sign even if the app appears to be encrypted
• Compression Level: Set the compression level for the output IPA (0-9, with 6 being the default)

ipapatch by ZX

Moe's App Hub Signer builds IPApatch v2.1.3 from pinned source with the executable-path collision fix used by MoeInjectorNew. This preserves separate executable paths when a main app and an extension use the same executable filename.

Patch Modes

• Off: Do not patch the app or its extensions.
• Full app and plugins: Patch the main app and every retained .appex extension.
• Plugins only: Patch retained .appex extensions without changing the main app executable.

Before running IPApatch, the signer scans the selected executables for existing PluginsInject and zxPluginsInject load commands. If a selected target is already patched, it skips duplicate patching and shows a compatibility warning instead of injecting a second copy.

Processing Order

Cyan modifications -> archive removals -> IPApatch -> zsign -> manifest/share creation

This order keeps the requested app name and bundle ID in the final archive, patches only extensions that were not removed, and signs the completed IPA once with zsign.

Storage Options

Moe's App Hub Signer offers different storage options for signed IPA output:

Temporary share link

This is the standard option where:

• Files are only temporarily stored on the server
• Links expire after the configured signer retention window
• Best for one-time installations or testing

5-day direct link

This option provides longer-lived Storj-backed storage where:

• Your signed IPA is stored on a distributed storage network
• Installation links stay active for 5 days when Storj links are enabled
• You can share the link with multiple people or save it for short-term reuse
• Ideal for distribution to multiple devices during a short testing window

Account Features

A verified Moe's App Hub account is required to open the signer, submit signing jobs, and use saved signer tools.

Saved Profiles

Store your P12 certificate, provisioning profile, and password in your Moe's App Hub account so you can reload them without uploading everything again each time.

Presets

Save signer options such as bundle ID overrides, storage mode, compression level, and artifact removal selections so you can apply the same setup again later.

Library

Your signed app history lives in the library, including share links, install links, storage mode, and expiration state for older signer output.

Sources

Save AltStore-style source URLs, browse cached apps, and hand a selected app directly into the signer flow without rebuilding your source list every session.

Troubleshooting

Common Issues and Solutions

• Invalid certificate or profile:

  Ensure your certificate and provisioning profile are valid and not expired. They must match (be issued to the same Apple Developer account).

• Installation fails:

  Verify that your device's UDID is included in the provisioning profile. For enterprise certificates, ensure the enterprise is trusted in Settings > General > Profiles & Device Management.

• Encrypted IPA:

  If you receive an "IPA is encrypted" error, the application may have DRM protection. Try enabling the "Ignore encryption check" option, but results may vary.

• Bundle ID mismatch:

  If your provisioning profile only supports specific bundle IDs, make sure to set the correct bundle ID in the advanced settings.

• App crashes after installation:

  This could be due to incompatible modifications or signing issues. Try signing again with fewer modifications or using a different provisioning profile.

Frequently Asked Questions

Is this service free?

Yes, Moe's App Hub Signer is free to use. You still need to provide your own certificate and provisioning profile.

Do I need a Moe's App Hub account?

Yes. You must be logged into a verified Moe's App Hub account with signer access before you can open the signer or submit a job.

Can I sign any IPA file?

Most unencrypted IPA files can be signed. However, heavily DRM-protected apps or those with complex entitlements may not work properly after signing.

How long do the links remain active?

Temporary links expire after the signer’s configured retention period. Storj-backed direct links stay active for the configured 5-day window.

Is my data secure?

Moe's App Hub Signer encrypts saved certificate material and short-term certificate archives at rest. Even so, it is best to avoid using highly sensitive production certificates here and to prefer dedicated signing certificates when possible.

Can I install signed apps on non-jailbroken devices?

Yes, that's the primary purpose of this service. As long as your device's UDID is included in the provisioning profile, you can install the signed app on a standard, non-jailbroken iOS device.

Why does the app still ask for a developer to be trusted?

This is normal. When installing apps signed with a developer certificate, you'll need to trust the developer in Settings > General > Profiles & Device Management.