76 lines
2.6 KiB
Bash
Executable File
76 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
build_number="${1:-}"
|
|
codesign_key="${UM_TRACE_CODESIGN_KEY:-Apple Distribution: Underground Magnetics, Inc. (W2N8APPQ2C)}"
|
|
codesign_profile="${UM_TRACE_CODESIGN_PROVISION:-UM Trace App Store}"
|
|
profile_dir="${HOME}/Library/MobileDevice/Provisioning Profiles"
|
|
artifacts_dir="${repo_dir}/artifacts/ios-signed"
|
|
artifact_name="UMTrace-ios-build-${build_number}.ipa"
|
|
|
|
if [[ ! "${build_number}" =~ ^[1-9][0-9]*$ ]]; then
|
|
echo "A positive numeric iOS build number is required." >&2
|
|
exit 2
|
|
fi
|
|
|
|
if ! security find-identity -v -p codesigning | grep -Fq "${codesign_key}"; then
|
|
echo "Signing identity is unavailable: ${codesign_key}" >&2
|
|
exit 3
|
|
fi
|
|
|
|
profile_found=false
|
|
if [[ -d "${profile_dir}" ]]; then
|
|
for profile in "${profile_dir}"/*.mobileprovision; do
|
|
[[ -f "${profile}" ]] || continue
|
|
installed_name="$(openssl smime -inform der -verify -noverify -in "${profile}" 2>/dev/null | plutil -extract Name raw -o - - 2>/dev/null || true)"
|
|
if [[ "${installed_name}" == "${codesign_profile}" ]]; then
|
|
profile_found=true
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [[ "${profile_found}" != true ]]; then
|
|
echo "Provisioning profile is unavailable: ${codesign_profile}" >&2
|
|
exit 3
|
|
fi
|
|
|
|
UM_TRACE_CODESIGN_KEY="${codesign_key}" \
|
|
UM_TRACE_CODESIGN_PROVISION="${codesign_profile}" \
|
|
"${repo_dir}/scripts/publish-testflight.sh" "${build_number}"
|
|
|
|
source_ipa="$(find "${repo_dir}/FieldLogger/bin/Release/net9.0-ios/ios-arm64" -type f -name '*.ipa' -print -quit)"
|
|
if [[ -z "${source_ipa}" || ! -f "${source_ipa}" ]]; then
|
|
echo "The signed IPA was not created." >&2
|
|
exit 4
|
|
fi
|
|
|
|
mkdir -p "${artifacts_dir}"
|
|
ditto "${source_ipa}" "${artifacts_dir}/${artifact_name}"
|
|
|
|
verification_dir="$(mktemp -d)"
|
|
ditto -x -k "${artifacts_dir}/${artifact_name}" "${verification_dir}"
|
|
app_bundle="$(find "${verification_dir}/Payload" -maxdepth 1 -type d -name '*.app' -print -quit)"
|
|
|
|
if [[ -z "${app_bundle}" ]]; then
|
|
echo "The IPA does not contain an app bundle." >&2
|
|
exit 4
|
|
fi
|
|
|
|
codesign --verify --deep --strict --verbose=2 "${app_bundle}"
|
|
|
|
bundle_id="$(plutil -extract CFBundleIdentifier raw -o - "${app_bundle}/Info.plist")"
|
|
signed_build_number="$(plutil -extract CFBundleVersion raw -o - "${app_bundle}/Info.plist")"
|
|
if [[ "${bundle_id}" != "com.umagul.trace" || "${signed_build_number}" != "${build_number}" ]]; then
|
|
echo "Signed bundle metadata is incorrect: ${bundle_id} (${signed_build_number})." >&2
|
|
exit 5
|
|
fi
|
|
|
|
(
|
|
cd "${artifacts_dir}"
|
|
shasum -a 256 "${artifact_name}" > "${artifact_name}.sha256"
|
|
)
|
|
|
|
echo "Verified signed iOS IPA: ${artifacts_dir}/${artifact_name}"
|