check up your mailbox associated with your apple developer account, apple will send email to your mailbox with some diagnose information and how to solve your problem.
for me, apple send following diagnose information. I actually have never touched iCound, which is really confusing. after all, I created a new app id without Wild-card character, then a new distribution profile, and sign my app, finally summit to apple, which turn out to be successful.
Invalid Code Signing Entitlements – The signature for your app bundle contains entitlement values that are not supported. For the com.apple.developer.ubiquity-container-identifiers entitlement, the first value in the array must consist of the prefix provided by Apple in the provisioning profile followed by a bundle identifier suffix. The bundle identifier must match the bundle identifier for one of your apps or another app that you are permitted to use as the iCloud container identifier.
Specifically, value “K8FN29QYP2.*” for key “com.apple.developer.ubiquity-container-identifiers” in ProductName is not supported.
Invalid Code Signing Entitlements – The signature for your app bundle contains entitlement values that are not supported.
Specifically, value “K8FN29QYP2.*” for key “com.apple.developer.ubiquity-kvstore-identifier” in ProductName is not supported.