Skip to content

Instantly share code, notes, and snippets.

@nodeselector

nodeselector/codesigning.md

Last active July 24, 2024 03:10
Show Gist options
  • Save nodeselector/e698e27212dd4437b9f713df5d956589 to your computer and use it in GitHub Desktop.
Save nodeselector/e698e27212dd4437b9f713df5d956589 to your computer and use it in GitHub Desktop.
Download ZIP
Code signing is confusing. This is my info dump of links that I used to learn it.
Raw
codesigning.md

Code Signing

Terms

Bundle ID

https://developer.apple.com/documentation/bundleresources/information_property_list/cfbundleidentifier

  • A string used to uniquely identify an app.
  • By convention, it's a reverse-DNS style string.
  • Must be globally unique.

Example:

  • GitHub com.github.stormbreaker
  • TikTok com.zhiliaoapp.musically
  • Temple Run com.imangi.templerun

Toolbelt:

App ID

https://developer.apple.com/library/archive/documentation/General/Conceptual/DevPedia-CocoaCore/AppID.html (doc says it could be outdated but this seems foundational enough to not have changed and is the best description I've found so far.)

  • Two part string used to identify one or more apps from a single development team.
    • First part is the Team ID.
    • Second part is a bundle ID search string.
  • There are two types of App IDs:
    • an explicit App ID, used for a single app.
    • wildcard App IDs, used for a set of apps.

Example:

  • Explicit: TeamID.com.example.app
  • Wildcard: TeamID.com.example.*

App ID prefixes

https://developer.apple.com/library/archive/technotes/tn2311/_index.html

  • An app ID prefix is a unique identifier used to group a collection of apps so that they can share keychain and UIPasteboard data.
  • Notably, it's possile for a team to have multiple App ID prefixes, if they were created prior to the introduction of iCloud in June 2011. The new version is a Team ID and the old version a ten digit alphanumeric string. This has disadvantages:
    • Apps with different App ID prefixes cannot share keychain or UIPasteboard data.
      • Implies that migrating would cause the user to lose access to previously stored data.
    • App ID prefix mismatch can cause issues at distribution time.

Diagnostic:

  • Log into the Apple Developer Portal and check the App ID prefix for the app in question.

Team ID

https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/

  • A unique 10-character string that Apple assigns to your team.
  • AKA an App ID prefix.

Provisioning Profile

Certificate

Entitlements

IPA File Type

Automatic vs Manual Provisioning

https://devcenter.bitrise.io/en/code-signing/ios-code-signing/managing-ios-code-signing-files---automatic-provisioning.html#apple-services-authentication-for-automatic-provisioning

  • Automatic Provisioning requires that you log into Xcode in some way:
    • App Store Connect API Key
    • Apple ID
  • Manual Provisioning requires that you download the provisioning profile and certificate from the Apple Developer Portal and install them in Xcode.
    • The certificate must be installed in the Keychain.
    • The provisioning profile must be in the expected location on disk.

In both case, you will need to store something in your CI/CD system to authenticate with Apple. Automatic Provisioning requires that you store an App Store Connect API Key in your CI/CD system, while manual provisioning requires that you store a certificate(s) and provisioning profile(s) in your CI/CD system.

The major pro of automatic provisioning is that you don't need to think about the certificate and provisioning profile. The major con is that you need to store an App Store Connect API Key in your CI/CD system.

The major pro of manual provisioning is that you don't need to store an App Store Connect API Key in your CI/CD system. The major con is that you need to manage the certificate and provisioning profile, and if you go the fastlane match route, you'll end up storing an encrypted blob of your certificate and provisioning profile in your git repository OR have a complicated CI/CD setup to manage the certificate and provisioning profile injection into the build environment.

Distribution Methods

Development

  • Run a signed app on devices in the provisioning profile.
  • Run in debug mode.

App Store

  • Submit an app to the App Store.
  • Once approved and signed by Apple, the app can be downloaded by anyone via the App Store.

Ad Hoc

  • Run a signed app on devices in the provisioning profile.
  • Can register up to 100 devices.

Enterprise

  • Similar to Ad Hoc, but can register an unlimited number of devices.
  • Requires an Enterprise Developer Program membership.
  • Requires that devices trust the enterprise certificate.

App Store Connect API

Building without code signing

https://stackoverflow.com/questions/11034133/building-ios-applications-using-xcodebuild-without-codesign fastlane/fastlane#6027

Sometimes you just want to know if your code compiles. Fastlane gym doesn't support skipping code signing, but they say that you can use their xcodebuild action to do so.

xcodebuild clean build CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO

Fastlane

Match

https://codesigning.guide/ https://docs.gitlab.com/ee/ci/secure_files/ https://docs.fastlane.tools/actions/match/

Authentication mechanisms that work with match:

Notably, the app specific password won't work, since it only supports the iTMSTransporter API (uploads ipa files to the App Store) and not the App Store Connect API.

App Store Connect API

https://github.com/fastlane/fastlane/blob/3697170626b3270dcaa1471d512e73ccf8bc04bd/fastlane/lib/fastlane/actions/app_store_connect_api_key.rb#L52-L98

UDID

UUID

macs have uuids, virtual machines too. The UUID for an M1 virtual machine is bound to the create operation, so even clones will have the same UUID.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment