I`m somehow amateur in Xcode and this matter is so important for me.
My Friend use his developer id to publish my app and he ask me to give him .xcarchive instead *.ipa file
As I read in stackoverflow topics .xcarchive have the same content of ipa and there is no concern about lose and steal source code.
But when I check my xcarchive and use show content option I see most of project files like images and sources in application folder , also some of my code are in *.nib files
Is that normal ? and if I extract ipa if I get the same result ?
Is there any security or tips in Xcode that better to active before archive project ?
It is normal. In order to publish your app, your friend really needs the xcarchive, because they need to export an IPA file with the appropriate provisioning profile and signed with their code signing identity. Although it's possible to replace the provisioning profile in an IPA file and re-sign it again, it's a daunting task you don't want any of your friends to do. If you trust your friend with publishing your app, you should trust them and share the xcarchive.
When you compare the contents of xcarchive and IPA files, you can see xcarchive contains a dSYMs folder with dSYM files used to desymbolicate your crash logs -- the developer needs that to know in what file and at what line number the application crashed.