resign_ipa.sh

#!/usr/bin/env bash
set -xe 

# RS_CONF example
# CFBundleShortVersionString 1.9.20
# CFBundleVersion 888

: ${RS_UUID:='2ecad13d-4cc9-4f96-88cc-a8f1c693c663'}

RS_IPA_FILE=${1}

[ -f ${RS_IPA_FILE} ] || exit 1

RS_MOBILEPROVISION=~/Library/MobileDevice/Provisioning\ Profiles/${RS_UUID}.mobileprovision
[ -f "${RS_MOBILEPROVISION}" ] || exit 2

RS_MOBILEPROVISION_XML=${RS_MOBILEPROVISION##*/}.xml
security cms -D -i "${RS_MOBILEPROVISION}" | tee ${RS_MOBILEPROVISION_XML}

plutil -extract DeveloperCertificates xml1 -o - ${RS_MOBILEPROVISION_XML} | xmllint --xpath '//array/data/text()' - | base64 -D > sign.crt 
RS_CODESIGN_IDENTITY=$(openssl x509 -inform der -noout -in sign.crt -fingerprint | awk -F'=' '{print $2}' | tr -d ':')

rm -fr Payload
unzip -f ${RS_IPA_FILE}

[ -d Payload ] || exit 3

RS_APP=$(find Payload -name '*.app' -type d -maxdepth 1 | head -n 1)
RS_INFO_PLIST=${RS_APP}/Info.plist
RS_EMBEDDED_MOBILEPROVISION=${RS_APP}/embedded.mobileprovision
cp -fv "${RS_MOBILEPROVISION}" ${RS_EMBEDDED_MOBILEPROVISION}

if [ -n "${RS_CONF}" ] && [ -f ${RS_CONF} ]
then
    cat ${RS_CONF} | while read line
    do
        kv=(${line})
        if [ ${#kv[@]} -eq 2 ]
        then
            plutil -replace ${kv[0]} -string ${kv[1]} ${RS_INFO_PLIST}
        elif [ ${#kv[@]} -eq 3 ]
        then
            plutil -replace ${kv[@]} ${RS_INFO_PLIST}
        else
            continue
        fi
    done
fi

find ${RS_APP} -name _CodeSignature -type d -delete
find ${RS_APP} -name '*.meta' -type f -delete

codesign --preserve-metadata=entitlements --force --sign ${RS_CODESIGN_IDENTITY} ${RS_APP}

RS_RESIGNED_IPA_FILE=${RS_IPA_FILE%.*}_resign.ipa
[ -f ${RS_RESIGNED_IPA_FILE} ] && rm -f ${RS_RESIGNED_IPA_FILE}

zip -qr ${RS_RESIGNED_IPA_FILE} Payload
ls -lh ${RS_RESIGNED_IPA_FILE}
md5 -r ${RS_RESIGNED_IPA_FILE}