Just create xarchive using your certificate and provisioning profile and pass it to the client
A client can open xarchive using xcode, and they can resign using their distribution certificate and provisioning profile and publish it to the appstore

PS:
Verify that the client has the same package identifier added to the member center application identifier.
Make sure that the customer provisioning profile reflects your project capabilities, as well as push notification, etc.
In case of client rights, the client must enter the application and manually change the rights.
The file that they need to open in a text editor is archived by foam-entitlements.xcent and change PREFIX with their command identifier, which can be found here
<key>application-identifier</key> <string>PREFIX.yourappBundleID</string> <key>keychain-access-groups</key> <array> <string>PREFIX.yourappBundleID</string> </array>
And it is better to ask the client to make sure that get-task-allow is false only if you signed your xarchive with the signature of the developers
<key>get-task-allow</key> <false/>
The same is true for APNS
<key>aps-environment</key> <string>production</string>
FYI: Many companies that I know follow this process because of their safety recommendations.
Durai Amuthan.H Jun 01 '17 at 15:35 2017-06-01 15:35
source share