base template sets Code Sign Identity to empty (latest SDK has unwanted default value)