diff --git a/.github/workflows/ios.preview.build.yml b/.github/workflows/ios.preview.build.yml index 460fc51f8..c8cfcc679 100644 --- a/.github/workflows/ios.preview.build.yml +++ b/.github/workflows/ios.preview.build.yml @@ -110,10 +110,12 @@ jobs: cd apps/mobile/ios/build-configs ./use-ios-build-config.sh staging --marketing-version ${{steps.marketing-version.outputs.version}} --build-number ${{steps.build-number.outputs.timestamp}} - # Archive WITHOUT signing. No certificates or secrets are present in this - # job. The trusted publish workflow re-signs and exports this archive; - # `-exportArchive` only packages/signs and does NOT re-run the app's build - # phases, so fork code never runs alongside secrets. + # Archive unsigned: this job has no certs/profiles (secrets), and the iOS + # device SDK forbids ad-hoc signing, so real signing happens in the trusted + # publish workflow (ios.preview.publish.yml). Do NOT pass + # CODE_SIGN_ENTITLEMENTS="" -- each target must keep its own entitlements so + # the archive records them; blanking them dropped the App Group and crashed + # MMKV on launch. - name: Archive (unsigned) run: | set -euo pipefail @@ -127,7 +129,6 @@ jobs: CODE_SIGNING_ALLOWED=NO \ CODE_SIGNING_REQUIRED=NO \ CODE_SIGN_IDENTITY="" \ - CODE_SIGN_ENTITLEMENTS="" \ archive - name: Stage build artifact diff --git a/.github/workflows/ios.preview.publish.yml b/.github/workflows/ios.preview.publish.yml index d2bd57bac..ada319788 100644 --- a/.github/workflows/ios.preview.publish.yml +++ b/.github/workflows/ios.preview.publish.yml @@ -3,9 +3,9 @@ name: Notesnook iOS Preview Publish # TRUSTED stage. Runs via `workflow_run` after the build workflow finishes, so # it has the base repo's secrets and a write-scoped token. It checks out the # BASE repository (never fork code), downloads the unsigned archive the build -# produced, then signs + exports + distributes it and posts the PR comment. -# `xcodebuild -exportArchive` only packages and signs a prebuilt archive; it -# does not run the app's build phases, so fork code is never executed here. +# produced, then signs + distributes it and posts the PR comment. Signing is +# done directly with `codesign` on the prebuilt archive -- no app build phases +# run here, so fork code is never executed in this trusted context. # # Split into two jobs on purpose: signing needs macOS, but the Firebase # distribution action is a Docker container action and only runs on Linux. @@ -71,29 +71,88 @@ jobs: i=$((i + 1)) done - - name: Export signed IPA - env: - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + # Sign the unsigned archive by hand. `xcodebuild -exportArchive` re-signs + # from the archive's `archived-expanded-entitlements.xcent`, which an + # unsigned archive does not contain, so it dropped the App Group and the + # app crashed on launch. Instead we sign each bundle directly, taking the + # entitlements from each provisioning profile (exactly what Apple + # provisioned -- App Group, keychain groups with the right team prefix). + # Runs on macOS but executes NO fork build phases, so it stays trusted. + - name: Sign IPA run: | set -euo pipefail - EXPORT_PLIST="$RUNNER_TEMP/ExportOptions.plist" - cp apps/mobile/ios/ExportOptionsStaging.plist "$EXPORT_PLIST" - # Augment the checked-in profile map with the fields exportArchive needs. - /usr/libexec/PlistBuddy -c "Add :method string ad-hoc" "$EXPORT_PLIST" 2>/dev/null \ - || /usr/libexec/PlistBuddy -c "Set :method ad-hoc" "$EXPORT_PLIST" - /usr/libexec/PlistBuddy -c "Add :signingStyle string manual" "$EXPORT_PLIST" 2>/dev/null || true - /usr/libexec/PlistBuddy -c "Add :signingCertificate string Apple Distribution" "$EXPORT_PLIST" 2>/dev/null || true - /usr/libexec/PlistBuddy -c "Add :teamID string $APPLE_TEAM_ID" "$EXPORT_PLIST" 2>/dev/null \ - || /usr/libexec/PlistBuddy -c "Set :teamID $APPLE_TEAM_ID" "$EXPORT_PLIST" + PROFILES="$HOME/Library/MobileDevice/Provisioning Profiles" + APP="$(find "$RUNNER_TEMP/Notesnook.xcarchive/Products/Applications" -maxdepth 1 -name '*.app' | head -n1)" + [ -n "$APP" ] || { echo "::error::No .app in archive"; exit 1; } - xcodebuild -exportArchive \ - -archivePath "$RUNNER_TEMP/Notesnook.xcarchive" \ - -exportOptionsPlist "$EXPORT_PLIST" \ - -exportPath "$RUNNER_TEMP/export" + # Single Apple Distribution identity from the imported keychain. + IDENTITY="$(security find-identity -v -p codesigning | awk '/Apple Distribution/{print $2; exit}')" + [ -n "$IDENTITY" ] || { echo "::error::No Apple Distribution identity found"; exit 1; } + echo "Signing identity: $IDENTITY" - # Normalize the IPA name for the distribution job. - IPA="$(find "$RUNNER_TEMP/export" -name '*.ipa' | head -n1)" - cp "$IPA" "$RUNNER_TEMP/Notesnook.ipa" + TMP="$RUNNER_TEMP/sign"; mkdir -p "$TMP" + + # Decode a profile's bundle id (application-identifier minus team prefix). + profile_bundle_id() { + security cms -D -i "$1" -o "$TMP/_p.plist" 2>/dev/null + local appid; appid="$(plutil -extract Entitlements.application-identifier raw -o - "$TMP/_p.plist")" + echo "${appid#*.}" + } + # Find the profile matching a bundle id; echoes its path. + profile_for() { + local want="$1" p + for p in "$PROFILES"/*.mobileprovision; do + [ -e "$p" ] || continue + [ "$(profile_bundle_id "$p")" = "$want" ] && { echo "$p"; return 0; } + done + return 1 + } + # Embed the matching profile and sign a bundle with the profile's entitlements. + sign_bundle() { + local bundle="$1" bid prof ent + bid="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$bundle/Info.plist")" + prof="$(profile_for "$bid")" || { echo "::error::No provisioning profile for $bid"; exit 1; } + ent="$TMP/ent-$bid.plist" + security cms -D -i "$prof" -o "$TMP/_p.plist" + plutil -extract Entitlements xml1 -o "$ent" "$TMP/_p.plist" + cp "$prof" "$bundle/embedded.mobileprovision" + echo "Signing $(basename "$bundle") ($bid)" + codesign --force --sign "$IDENTITY" --entitlements "$ent" "$bundle" + } + + # Sign inside-out: nested code first, then extensions, then the app. + if [ -d "$APP/Frameworks" ]; then + find "$APP/Frameworks" -maxdepth 1 \( -name '*.framework' -o -name '*.dylib' \) -print0 \ + | while IFS= read -r -d '' f; do codesign --force --sign "$IDENTITY" "$f"; done + fi + if [ -d "$APP/PlugIns" ]; then + for appex in "$APP/PlugIns"/*.appex; do + [ -e "$appex" ] || continue + if [ -d "$appex/Frameworks" ]; then + find "$appex/Frameworks" -maxdepth 1 \( -name '*.framework' -o -name '*.dylib' \) -print0 \ + | while IFS= read -r -d '' f; do codesign --force --sign "$IDENTITY" "$f"; done + fi + sign_bundle "$appex" + done + fi + sign_bundle "$APP" + + codesign --verify --deep --strict --verbose=2 "$APP" + + # Package into an IPA. + rm -rf "$TMP/Payload"; mkdir -p "$TMP/Payload" + cp -R "$APP" "$TMP/Payload/" + ( cd "$TMP" && zip -qry "$RUNNER_TEMP/Notesnook.ipa" Payload ) + + # Fail fast if the App Group didn't make it into the signed app -- its + # absence is the launch crash (MMKV nil group path). Never distribute + # a build without it. + echo "::group::Signed app entitlements" + codesign -d --entitlements :- "$APP" 2>/dev/null || true + echo "::endgroup::" + codesign -d --entitlements :- "$APP" 2>/dev/null | grep -q "group.org.streetwriters.notesnook" \ + || { echo "::error::Signed app is missing the App Group entitlement; it would crash on launch."; exit 1; } + echo "App Group entitlement present." - name: Upload signed IPA uses: actions/upload-artifact@v4