-allowProvisioningUpdates doesn't work

I have the same problem. I reported the bug to Apple, to no avail. To move forward with Xcode 9, I switched to manual signing for Jenkins only. (Developers still use automatic signing.)

/usr/bin/xcodebuild -exportArchive \    DEVELOPMENT_TEAM=*your-dev-team-id* \    CODE_SIGN_STYLE=Manual \    CODE_SIGN_IDENTITY="iPhone Distribution: *your cert*" \    PROVISION_PROFILE="*your*.mobileprovision" \    *rest of your parameters*

This -allowProvisioningUpdates worked for me in Xcode 9 final release.

Verify You Can Build an auto-signing Xcode Project Using Xcode IDE

• 1) Open an Xcode project configured for automatically sign
  • Select target from Targets > General > Signing
  • [x] Automatically manage signing
  • Enter your team account credentials
• 2) Build the project and verify build succeeds

Close Xcode and Build project using xcodebuild with options -allowProvisioningUpdates

• 1) Add option "xcodebuild ... -allowProvisioningUpdates
• 2) When prompted, "xcode wants to access key "xcode apple id access" in your keychain"
  • Enter credentials and press button Always Allow

Now Jenkins command line builds should work.

I've fixed this. The problem was that I specified the team using team_id Fastlane command. You should use enable_automatic_code_signing instead. Also, configuration was not specified. Now I have this script:

    enable_automatic_code_signing(        team_id: <YOUR_TEAM_ID_REQUIRED_HERE>,    )    gym(        scheme: <YOUR_SCHEME_REQUIRED HERE>,        configuration: <YOUR_CONFIGURATION_REQUIRED HERE>,        export_method: "development",        xcargs: "-allowProvisioningUpdates",    )

Also, I'v found this page. I've tried it at the same time with changes above, so I don't know what helped me. But I've reverted the change from the page and it still works. So I assume the problem was with team_id and configuration.