ok, by following advice in https://stackoverflow.com/questions/16550594/jenkins-xcode-build-works-codesign-fails we could create custom keychain and switch to it - and that seems to always work, even if we could not successfully sign the app yet. Will consider this solved for now.