A small bash script to re-sign iOS applications to wildcard app id provisioning

floatsign.sh

# !/bin/bash

# Copyright (c) 2011 Float Mobile Learning
# http://www.floatlearning.com/
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the "Software"),
# to deal in the Software without restriction, including without limitation
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
# and/or sell copies of the Software, and to permit persons to whom the
# Software is furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included
# in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# Please let us know about any improvements you make to this script!
# ./sign source identity -p "path/to/profile" -e "path/to/entitlements" target

if [ $# -lt 3 ]; then
	echo "Usage: $0 source <identity name> [-p path/to/.mobileprovision] [-e path/to/entitlements.plist] target" >&2
	exit 1
fi

ORIGINAL_FILE="$1"
NEW_IDENTITY="$2"
NEW_PROVISION=""
NEW_ENTITLEMENTS=""
TEMP_DIR="/tmp/floatsign"

OPTIND=3
while getopts p:e: opt; do
	case $opt in
		p)
			NEW_PROVISION="$OPTARG"
			echo "Specified provisioning profile: $NEW_PROVISION" >&2
			;;
		e)
			NEW_ENTITLEMENTS="$OPTARG"
			echo "Specified signing entitlements: $NEW_ENTITLEMENTS" >&2
			;;
		\?)
			echo "Invalid option: -$OPTARG" >&2
			exit 1
			;;
		:)
			echo "Option -$OPTARG requires an argument." >&2
			exit 1
			;;
	esac
done

shift $((OPTIND-1))

NEW_FILE="$1"


# Check if the supplied file is an ipa or an app file
if [ "${ORIGINAL_FILE##*.}" == "ipa" ]; then
	# Unzip the old ipa quietly
	unzip -q "$ORIGINAL_FILE" -d "$TEMP_DIR"
elif [ "${ORIGINAL_FILE##*.}" == "app" ]; then
	# Copy the app file into an ipa-like structure
	mkdir -p "$TEMP_DIR/Payload"
	cp -rf "$ORIGINAL_FILE" "$TEMP_DIR/Payload/$(basename "$ORIGINAL_FILE")"
else
	echo "Error: Only support .app or .ipa file" >&2
	exit
fi


# Set the app name
# The app name is the only file within the Payload directory
APP_NAME=$(ls "$TEMP_DIR/Payload/")
echo "APP_NAME=$APP_NAME" >&2


# Remove the old code signature
rm -r "$TEMP_DIR/Payload/$APP_NAME/_CodeSignature"


# Using existing entitlements.plist
export PATH=$PATH:/usr/libexec
if [ "$NEW_ENTITLEMENTS" == "" ] && [ "$NEW_PROVISION" != "" ]; then
	echo "\nGenerate default entitlements.plist"
	codesign -d --entitlements :"$TEMP_DIR/entitlements.plist" "$TEMP_DIR/Payload/$APP_NAME"

	# Convert .mobileprovision to .plist
	security cms -D -i "$NEW_PROVISION" > "$TEMP_DIR/NEW_PROVISION.plist"

	# Modify team-identifier
	CURRENT_TEAM_IDENTIFIER=`PlistBuddy -c "Print :com.apple.developer.team-identifier" "$TEMP_DIR/entitlements.plist"`
	echo "CURRENT_TEAM_IDENTIFIER=$CURRENT_TEAM_IDENTIFIER"
	NEW_TEAM_IDENTIFIER=`PlistBuddy -c "Print :Entitlements:com.apple.developer.team-identifier" "$TEMP_DIR/NEW_PROVISION.plist"`
	echo "NEW_TEAM_IDENTIFIER=$NEW_TEAM_IDENTIFIER"
	perl -pi -e "s/$CURRENT_TEAM_IDENTIFIER/$NEW_TEAM_IDENTIFIER/g" "$TEMP_DIR/entitlements.plist"

	# Modify get-task-allow
	NEW_GET_TASK_ALLOW=`PlistBuddy -c "Print :Entitlements:get-task-allow" "$TEMP_DIR/NEW_PROVISION.plist"`
	echo "NEW_GET_TASK_ALLOW=$NEW_GET_TASK_ALLOW"
	PlistBuddy -c "Set :get-task-allow $NEW_GET_TASK_ALLOW" "$TEMP_DIR/entitlements.plist"

	# Modify aps-environment
	CURRENT_APS_ENVIRONMENT=`PlistBuddy -c "Print :aps-environment" "$TEMP_DIR/entitlements.plist"`
	if [ "$CURRENT_APS_ENVIRONMENT" != "" ]; then
		NEW_APS_ENVIRONMENT=`PlistBuddy -c "Print :Entitlements:aps-environment" "$TEMP_DIR/NEW_PROVISION.plist"`

		if [ "$NEW_APS_ENVIRONMENT" == "" ]; then
			echo "Do not support aps-environment"
			PlistBuddy -c "Delete :aps-environment" "$TEMP_DIR/entitlements.plist"
		else
			echo "Update aps-environment=$NEW_APS_ENVIRONMENT"
			PlistBuddy -c "Set :aps-environment $NEW_APS_ENVIRONMENT" "$TEMP_DIR/entitlements.plist"
		fi
	fi

	NEW_ENTITLEMENTS="$TEMP_DIR/entitlements.plist"
fi


# Replace the embedded mobile provisioning profile
if [ "$NEW_PROVISION" != "" ]; then
	echo "\nAdding the new provision: $NEW_PROVISION"
	cp "$NEW_PROVISION" "$TEMP_DIR/Payload/$APP_NAME/embedded.mobileprovision"
fi

# Resign *.dylib files
echo "\nResigning *.dylib files using identity: \"$NEW_IDENTITY\"" >&2
/usr/bin/codesign -f -s "$NEW_IDENTITY" "$TEMP_DIR/Payload/$APP_NAME/Frameworks/"*.dylib

# Resign *.framework files
echo "\nResigning *.framework files using identity: \"$NEW_IDENTITY\"" >&2
codesign -f -s "$NEW_IDENTITY" "$TEMP_DIR/Payload/$APP_NAME/Frameworks/"*.framework

# Resign the application
echo "\nResigning application using identity: \"$NEW_IDENTITY\"" >&2
if [ "$NEW_ENTITLEMENTS" != "" ]; then
	echo "Using Entitlements: $NEW_ENTITLEMENTS" >&2
	codesign -f -s "$NEW_IDENTITY" --entitlements="$NEW_ENTITLEMENTS" "$TEMP_DIR/Payload/$APP_NAME"
else
	codesign -f -s "$NEW_IDENTITY" "$TEMP_DIR/Payload/$APP_NAME"
fi


# Repackage quietly
echo "\nRepackaging as $NEW_FILE" >&2

if [ "${NEW_FILE##*.}" == "ipa" ]; then
	# Zip up the contents of the temp directory
	# Navigate to the temporary directory (sending the output to null)
	# Zip all the contents, saving the zip file in the above directory
	# Navigate back to the orignating directory (sending the output to null)
	pushd "$TEMP_DIR" > /dev/null
	zip -qry "$TEMP_DIR/temp.ipa" * -x *.plist
	popd > /dev/null

	# Move the resulting ipa to the target destination
	mv "$TEMP_DIR/temp.ipa" "$NEW_FILE"
else
	if [ -d "$NEW_FILE" ]; then
		rm -rf "$NEW_FILE"
	fi

	mv "$TEMP_DIR/Payload/$APP_NAME" "$NEW_FILE"
fi


# Remove the temp directory
rm -rf "$TEMP_DIR"

echo "Resigned successfully" >&2