| # Copyright 2016 The Chromium Authors |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| |
| import argparse |
| import codecs |
| import datetime |
| import fnmatch |
| import glob |
| import json |
| import os |
| import plistlib |
| import shutil |
| import subprocess |
| import stat |
| import sys |
| import tempfile |
| |
| if sys.version_info.major < 3: |
| basestring_compat = basestring |
| else: |
| basestring_compat = str |
| |
| |
| def GetProvisioningProfilesDir(): |
| """Returns the location of the installed mobile provisioning profiles. |
| |
| Returns: |
| The path to the directory containing the installed mobile provisioning |
| profiles as a string. |
| """ |
| return os.path.join( |
| os.environ['HOME'], 'Library', 'MobileDevice', 'Provisioning Profiles') |
| |
| |
| def ReadPlistFromString(plist_bytes): |
| """Parse property list from given |plist_bytes|. |
| |
| Args: |
| plist_bytes: contents of property list to load. Must be bytes in python 3. |
| |
| Returns: |
| The contents of property list as a python object. |
| """ |
| if sys.version_info.major == 2: |
| return plistlib.readPlistFromString(plist_bytes) |
| else: |
| return plistlib.loads(plist_bytes) |
| |
| |
| def LoadPlistFile(plist_path): |
| """Loads property list file at |plist_path|. |
| |
| Args: |
| plist_path: path to the property list file to load. |
| |
| Returns: |
| The content of the property list file as a python object. |
| """ |
| if sys.version_info.major == 2: |
| return plistlib.readPlistFromString( |
| subprocess.check_output( |
| ['xcrun', 'plutil', '-convert', 'xml1', '-o', '-', plist_path])) |
| else: |
| with open(plist_path, 'rb') as fp: |
| return plistlib.load(fp) |
| |
| |
| def CreateSymlink(value, location): |
| """Creates symlink with value at location if the target exists.""" |
| target = os.path.join(os.path.dirname(location), value) |
| if os.path.exists(location): |
| os.unlink(location) |
| os.symlink(value, location) |
| |
| |
| class Bundle(object): |
| """Wraps a bundle.""" |
| |
| def __init__(self, bundle_path, platform): |
| """Initializes the Bundle object with data from bundle Info.plist file.""" |
| self._path = bundle_path |
| self._kind = Bundle.Kind(platform, os.path.splitext(bundle_path)[-1]) |
| self._data = None |
| |
| def Load(self): |
| self._data = LoadPlistFile(self.info_plist_path) |
| |
| @staticmethod |
| def Kind(platform, extension): |
| if platform == 'iphonesimulator' or platform == 'iphoneos': |
| return 'ios' |
| if platform == 'macosx': |
| if extension == '.framework': |
| return 'mac_framework' |
| return 'mac' |
| raise ValueError('unknown bundle type %s for %s' % (extension, platform)) |
| |
| @property |
| def kind(self): |
| return self._kind |
| |
| @property |
| def path(self): |
| return self._path |
| |
| @property |
| def contents_dir(self): |
| if self._kind == 'mac': |
| return os.path.join(self.path, 'Contents') |
| if self._kind == 'mac_framework': |
| return os.path.join(self.path, 'Versions/A') |
| return self.path |
| |
| @property |
| def executable_dir(self): |
| if self._kind == 'mac': |
| return os.path.join(self.contents_dir, 'MacOS') |
| return self.contents_dir |
| |
| @property |
| def resources_dir(self): |
| if self._kind == 'mac' or self._kind == 'mac_framework': |
| return os.path.join(self.contents_dir, 'Resources') |
| return self.path |
| |
| @property |
| def info_plist_path(self): |
| if self._kind == 'mac_framework': |
| return os.path.join(self.resources_dir, 'Info.plist') |
| return os.path.join(self.contents_dir, 'Info.plist') |
| |
| @property |
| def signature_dir(self): |
| return os.path.join(self.contents_dir, '_CodeSignature') |
| |
| @property |
| def identifier(self): |
| return self._data['CFBundleIdentifier'] |
| |
| @property |
| def binary_name(self): |
| return self._data['CFBundleExecutable'] |
| |
| @property |
| def binary_path(self): |
| return os.path.join(self.executable_dir, self.binary_name) |
| |
| def Validate(self, expected_mappings): |
| """Checks that keys in the bundle have the expected value. |
| |
| Args: |
| expected_mappings: a dictionary of string to object, each mapping will |
| be looked up in the bundle data to check it has the same value (missing |
| values will be ignored) |
| |
| Returns: |
| A dictionary of the key with a different value between expected_mappings |
| and the content of the bundle (i.e. errors) so that caller can format the |
| error message. The dictionary will be empty if there are no errors. |
| """ |
| errors = {} |
| for key, expected_value in expected_mappings.items(): |
| if key in self._data: |
| value = self._data[key] |
| if value != expected_value: |
| errors[key] = (value, expected_value) |
| return errors |
| |
| |
| class ProvisioningProfile(object): |
| """Wraps a mobile provisioning profile file.""" |
| |
| def __init__(self, provisioning_profile_path): |
| """Initializes the ProvisioningProfile with data from profile file.""" |
| self._path = provisioning_profile_path |
| self._data = ReadPlistFromString( |
| subprocess.check_output([ |
| 'xcrun', 'security', 'cms', '-D', '-u', 'certUsageAnyCA', '-i', |
| provisioning_profile_path |
| ])) |
| |
| @property |
| def path(self): |
| return self._path |
| |
| @property |
| def team_identifier(self): |
| return self._data.get('TeamIdentifier', [''])[0] |
| |
| @property |
| def name(self): |
| return self._data.get('Name', '') |
| |
| @property |
| def application_identifier_pattern(self): |
| return self._data.get('Entitlements', {}).get('application-identifier', '') |
| |
| @property |
| def application_identifier_prefix(self): |
| return self._data.get('ApplicationIdentifierPrefix', [''])[0] |
| |
| @property |
| def entitlements(self): |
| return self._data.get('Entitlements', {}) |
| |
| @property |
| def expiration_date(self): |
| return self._data.get('ExpirationDate', datetime.datetime.now()) |
| |
| def ValidToSignBundle(self, bundle_identifier): |
| """Checks whether the provisioning profile can sign bundle_identifier. |
| |
| Args: |
| bundle_identifier: the identifier of the bundle that needs to be signed. |
| |
| Returns: |
| True if the mobile provisioning profile can be used to sign a bundle |
| with the corresponding bundle_identifier, False otherwise. |
| """ |
| return fnmatch.fnmatch( |
| '%s.%s' % (self.application_identifier_prefix, bundle_identifier), |
| self.application_identifier_pattern) |
| |
| def Install(self, installation_path): |
| """Copies mobile provisioning profile info to |installation_path|.""" |
| shutil.copy2(self.path, installation_path) |
| st = os.stat(installation_path) |
| os.chmod(installation_path, st.st_mode | stat.S_IWUSR) |
| |
| |
| class Entitlements(object): |
| """Wraps an Entitlement plist file.""" |
| |
| def __init__(self, entitlements_path): |
| """Initializes Entitlements object from entitlement file.""" |
| self._path = entitlements_path |
| self._data = LoadPlistFile(self._path) |
| |
| @property |
| def path(self): |
| return self._path |
| |
| def ExpandVariables(self, substitutions): |
| self._data = self._ExpandVariables(self._data, substitutions) |
| |
| def _ExpandVariables(self, data, substitutions): |
| if isinstance(data, basestring_compat): |
| for key, substitution in substitutions.items(): |
| data = data.replace('$(%s)' % (key,), substitution) |
| return data |
| |
| if isinstance(data, dict): |
| for key, value in data.items(): |
| data[key] = self._ExpandVariables(value, substitutions) |
| return data |
| |
| if isinstance(data, list): |
| for i, value in enumerate(data): |
| data[i] = self._ExpandVariables(value, substitutions) |
| |
| return data |
| |
| def LoadDefaults(self, defaults): |
| for key, value in defaults.items(): |
| if key not in self._data: |
| self._data[key] = value |
| |
| def WriteTo(self, target_path): |
| with open(target_path, 'wb') as fp: |
| if sys.version_info.major == 2: |
| plistlib.writePlist(self._data, fp) |
| else: |
| plistlib.dump(self._data, fp) |
| |
| |
| def FindProvisioningProfile(provisioning_profile_paths, bundle_identifier, |
| required): |
| """Finds mobile provisioning profile to use to sign bundle. |
| |
| Args: |
| bundle_identifier: the identifier of the bundle to sign. |
| |
| Returns: |
| The ProvisioningProfile object that can be used to sign the Bundle |
| object or None if no matching provisioning profile was found. |
| """ |
| if not provisioning_profile_paths: |
| provisioning_profile_paths = glob.glob( |
| os.path.join(GetProvisioningProfilesDir(), '*.mobileprovision')) |
| |
| # Iterate over all installed mobile provisioning profiles and filter those |
| # that can be used to sign the bundle, ignoring expired ones. |
| now = datetime.datetime.now() |
| valid_provisioning_profiles = [] |
| one_hour = datetime.timedelta(0, 3600) |
| for provisioning_profile_path in provisioning_profile_paths: |
| provisioning_profile = ProvisioningProfile(provisioning_profile_path) |
| if provisioning_profile.expiration_date - now < one_hour: |
| sys.stderr.write( |
| 'Warning: ignoring expired provisioning profile: %s.\n' % |
| provisioning_profile_path) |
| continue |
| if provisioning_profile.ValidToSignBundle(bundle_identifier): |
| valid_provisioning_profiles.append(provisioning_profile) |
| |
| if not valid_provisioning_profiles: |
| if required: |
| sys.stderr.write( |
| 'Error: no mobile provisioning profile found for "%s" in %s.\n' % |
| (bundle_identifier, provisioning_profile_paths)) |
| sys.exit(1) |
| return None |
| |
| # Select the most specific mobile provisioning profile, i.e. the one with |
| # the longest application identifier pattern (prefer the one with the latest |
| # expiration date as a secondary criteria). |
| selected_provisioning_profile = max( |
| valid_provisioning_profiles, |
| key=lambda p: (len(p.application_identifier_pattern), p.expiration_date)) |
| |
| one_week = datetime.timedelta(7) |
| if selected_provisioning_profile.expiration_date - now < 2 * one_week: |
| sys.stderr.write( |
| 'Warning: selected provisioning profile will expire soon: %s' % |
| selected_provisioning_profile.path) |
| return selected_provisioning_profile |
| |
| |
| def CodeSignBundle(bundle_path, identity, extra_args): |
| process = subprocess.Popen( |
| ['xcrun', 'codesign', '--force', '--sign', identity, '--timestamp=none'] + |
| list(extra_args) + [bundle_path], |
| stderr=subprocess.PIPE, |
| universal_newlines=True) |
| _, stderr = process.communicate() |
| if process.returncode: |
| sys.stderr.write(stderr) |
| sys.exit(process.returncode) |
| for line in stderr.splitlines(): |
| if line.endswith(': replacing existing signature'): |
| # Ignore warning about replacing existing signature as this should only |
| # happen when re-signing system frameworks (and then it is expected). |
| continue |
| sys.stderr.write(line) |
| sys.stderr.write('\n') |
| |
| |
| def InstallSystemFramework(framework_path, bundle_path, args): |
| """Install framework from |framework_path| to |bundle| and code-re-sign it.""" |
| installed_framework_path = os.path.join( |
| bundle_path, 'Frameworks', os.path.basename(framework_path)) |
| |
| if os.path.isfile(framework_path): |
| shutil.copy(framework_path, installed_framework_path) |
| elif os.path.isdir(framework_path): |
| if os.path.exists(installed_framework_path): |
| shutil.rmtree(installed_framework_path) |
| shutil.copytree(framework_path, installed_framework_path) |
| |
| CodeSignBundle(installed_framework_path, args.identity, |
| ['--deep', '--preserve-metadata=identifier,entitlements,flags']) |
| |
| |
| def GenerateEntitlements(path, provisioning_profile, bundle_identifier): |
| """Generates an entitlements file. |
| |
| Args: |
| path: path to the entitlements template file |
| provisioning_profile: ProvisioningProfile object to use, may be None |
| bundle_identifier: identifier of the bundle to sign. |
| """ |
| entitlements = Entitlements(path) |
| if provisioning_profile: |
| entitlements.LoadDefaults(provisioning_profile.entitlements) |
| app_identifier_prefix = \ |
| provisioning_profile.application_identifier_prefix + '.' |
| else: |
| app_identifier_prefix = '*.' |
| entitlements.ExpandVariables({ |
| 'CFBundleIdentifier': bundle_identifier, |
| 'AppIdentifierPrefix': app_identifier_prefix, |
| }) |
| return entitlements |
| |
| |
| def GenerateBundleInfoPlist(bundle, plist_compiler, partial_plist): |
| """Generates the bundle Info.plist for a list of partial .plist files. |
| |
| Args: |
| bundle: a Bundle instance |
| plist_compiler: string, path to the Info.plist compiler |
| partial_plist: list of path to partial .plist files to merge |
| """ |
| |
| # Filter empty partial .plist files (this happens if an application |
| # does not compile any asset catalog, in which case the partial .plist |
| # file from the asset catalog compilation step is just a stamp file). |
| filtered_partial_plist = [] |
| for plist in partial_plist: |
| plist_size = os.stat(plist).st_size |
| if plist_size: |
| filtered_partial_plist.append(plist) |
| |
| # Invoke the plist_compiler script. It needs to be a python script. |
| subprocess.check_call([ |
| 'python3', |
| plist_compiler, |
| 'merge', |
| '-f', |
| 'binary1', |
| '-o', |
| bundle.info_plist_path, |
| ] + filtered_partial_plist) |
| |
| |
| class Action(object): |
| """Class implementing one action supported by the script.""" |
| |
| @classmethod |
| def Register(cls, subparsers): |
| parser = subparsers.add_parser(cls.name, help=cls.help) |
| parser.set_defaults(func=cls._Execute) |
| cls._Register(parser) |
| |
| |
| class CodeSignBundleAction(Action): |
| """Class implementing the code-sign-bundle action.""" |
| |
| name = 'code-sign-bundle' |
| help = 'perform code signature for a bundle' |
| |
| @staticmethod |
| def _Register(parser): |
| parser.add_argument( |
| '--entitlements', '-e', dest='entitlements_path', |
| help='path to the entitlements file to use') |
| parser.add_argument( |
| 'path', help='path to the iOS bundle to codesign') |
| parser.add_argument( |
| '--identity', '-i', required=True, |
| help='identity to use to codesign') |
| parser.add_argument( |
| '--binary', '-b', required=True, |
| help='path to the iOS bundle binary') |
| parser.add_argument( |
| '--framework', '-F', action='append', default=[], dest='frameworks', |
| help='install and resign system framework') |
| parser.add_argument( |
| '--disable-code-signature', action='store_true', dest='no_signature', |
| help='disable code signature') |
| parser.add_argument( |
| '--disable-embedded-mobileprovision', action='store_false', |
| default=True, dest='embedded_mobileprovision', |
| help='disable finding and embedding mobileprovision') |
| parser.add_argument( |
| '--platform', '-t', required=True, |
| help='platform the signed bundle is targeting') |
| parser.add_argument( |
| '--partial-info-plist', '-p', action='append', default=[], |
| help='path to partial Info.plist to merge to create bundle Info.plist') |
| parser.add_argument( |
| '--plist-compiler-path', '-P', action='store', |
| help='path to the plist compiler script (for --partial-info-plist)') |
| parser.add_argument( |
| '--mobileprovision', |
| '-m', |
| action='append', |
| default=[], |
| dest='mobileprovision_files', |
| help='list of mobileprovision files to use. If empty, uses the files ' + |
| 'in $HOME/Library/MobileDevice/Provisioning Profiles') |
| parser.set_defaults(no_signature=False) |
| |
| @staticmethod |
| def _Execute(args): |
| if not args.identity: |
| args.identity = '-' |
| |
| bundle = Bundle(args.path, args.platform) |
| |
| if args.partial_info_plist: |
| GenerateBundleInfoPlist(bundle, args.plist_compiler_path, |
| args.partial_info_plist) |
| |
| # The bundle Info.plist may have been updated by GenerateBundleInfoPlist() |
| # above. Load the bundle information from Info.plist after the modification |
| # have been written to disk. |
| bundle.Load() |
| |
| # According to Apple documentation, the application binary must be the same |
| # as the bundle name without the .app suffix. See crbug.com/740476 for more |
| # information on what problem this can cause. |
| # |
| # To prevent this class of error, fail with an error if the binary name is |
| # incorrect in the Info.plist as it is not possible to update the value in |
| # Info.plist at this point (the file has been copied by a different target |
| # and ninja would consider the build dirty if it was updated). |
| # |
| # Also checks that the name of the bundle is correct too (does not cause the |
| # build to be considered dirty, but still terminate the script in case of an |
| # incorrect bundle name). |
| # |
| # Apple documentation is available at: |
| # https://developer.apple.com/library/content/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html |
| bundle_name = os.path.splitext(os.path.basename(bundle.path))[0] |
| errors = bundle.Validate({ |
| 'CFBundleName': bundle_name, |
| 'CFBundleExecutable': bundle_name, |
| }) |
| if errors: |
| for key in sorted(errors): |
| value, expected_value = errors[key] |
| sys.stderr.write('%s: error: %s value incorrect: %s != %s\n' % ( |
| bundle.path, key, value, expected_value)) |
| sys.stderr.flush() |
| sys.exit(1) |
| |
| # Delete existing embedded mobile provisioning. |
| embedded_provisioning_profile = os.path.join( |
| bundle.path, 'embedded.mobileprovision') |
| if os.path.isfile(embedded_provisioning_profile): |
| os.unlink(embedded_provisioning_profile) |
| |
| # Delete existing code signature. |
| if os.path.exists(bundle.signature_dir): |
| shutil.rmtree(bundle.signature_dir) |
| |
| # Install system frameworks if requested. |
| for framework_path in args.frameworks: |
| InstallSystemFramework(framework_path, args.path, args) |
| |
| # Copy main binary into bundle. |
| if not os.path.isdir(bundle.executable_dir): |
| os.makedirs(bundle.executable_dir) |
| shutil.copy(args.binary, bundle.binary_path) |
| |
| if bundle.kind == 'mac_framework': |
| # Create Versions/Current -> Versions/A symlink |
| CreateSymlink('A', os.path.join(bundle.path, 'Versions/Current')) |
| |
| # Create $binary_name -> Versions/Current/$binary_name symlink |
| CreateSymlink(os.path.join('Versions/Current', bundle.binary_name), |
| os.path.join(bundle.path, bundle.binary_name)) |
| |
| # Create optional symlinks. |
| for name in ('Headers', 'Resources', 'Modules'): |
| target = os.path.join(bundle.path, 'Versions/A', name) |
| if os.path.exists(target): |
| CreateSymlink(os.path.join('Versions/Current', name), |
| os.path.join(bundle.path, name)) |
| else: |
| obsolete_path = os.path.join(bundle.path, name) |
| if os.path.exists(obsolete_path): |
| os.unlink(obsolete_path) |
| |
| if args.no_signature: |
| return |
| |
| codesign_extra_args = [] |
| |
| if args.embedded_mobileprovision: |
| # Find mobile provisioning profile and embeds it into the bundle (if a |
| # code signing identify has been provided, fails if no valid mobile |
| # provisioning is found). |
| provisioning_profile_required = args.identity != '-' |
| provisioning_profile = FindProvisioningProfile( |
| args.mobileprovision_files, bundle.identifier, |
| provisioning_profile_required) |
| if provisioning_profile and args.platform != 'iphonesimulator': |
| provisioning_profile.Install(embedded_provisioning_profile) |
| |
| if args.entitlements_path is not None: |
| temporary_entitlements_file = \ |
| tempfile.NamedTemporaryFile(suffix='.xcent') |
| codesign_extra_args.extend( |
| ['--entitlements', temporary_entitlements_file.name]) |
| |
| entitlements = GenerateEntitlements( |
| args.entitlements_path, provisioning_profile, bundle.identifier) |
| entitlements.WriteTo(temporary_entitlements_file.name) |
| |
| CodeSignBundle(bundle.path, args.identity, codesign_extra_args) |
| |
| |
| class CodeSignFileAction(Action): |
| """Class implementing code signature for a single file.""" |
| |
| name = 'code-sign-file' |
| help = 'code-sign a single file' |
| |
| @staticmethod |
| def _Register(parser): |
| parser.add_argument( |
| 'path', help='path to the file to codesign') |
| parser.add_argument( |
| '--identity', '-i', required=True, |
| help='identity to use to codesign') |
| parser.add_argument( |
| '--output', '-o', |
| help='if specified copy the file to that location before signing it') |
| parser.set_defaults(sign=True) |
| |
| @staticmethod |
| def _Execute(args): |
| if not args.identity: |
| args.identity = '-' |
| |
| install_path = args.path |
| if args.output: |
| |
| if os.path.isfile(args.output): |
| os.unlink(args.output) |
| elif os.path.isdir(args.output): |
| shutil.rmtree(args.output) |
| |
| if os.path.isfile(args.path): |
| shutil.copy(args.path, args.output) |
| elif os.path.isdir(args.path): |
| shutil.copytree(args.path, args.output) |
| |
| install_path = args.output |
| |
| CodeSignBundle(install_path, args.identity, |
| ['--deep', '--preserve-metadata=identifier,entitlements']) |
| |
| |
| class GenerateEntitlementsAction(Action): |
| """Class implementing the generate-entitlements action.""" |
| |
| name = 'generate-entitlements' |
| help = 'generate entitlements file' |
| |
| @staticmethod |
| def _Register(parser): |
| parser.add_argument( |
| '--entitlements', '-e', dest='entitlements_path', |
| help='path to the entitlements file to use') |
| parser.add_argument( |
| 'path', help='path to the entitlements file to generate') |
| parser.add_argument( |
| '--info-plist', '-p', required=True, |
| help='path to the bundle Info.plist') |
| parser.add_argument( |
| '--mobileprovision', |
| '-m', |
| action='append', |
| default=[], |
| dest='mobileprovision_files', |
| help='set of mobileprovision files to use. If empty, uses the files ' + |
| 'in $HOME/Library/MobileDevice/Provisioning Profiles') |
| |
| @staticmethod |
| def _Execute(args): |
| info_plist = LoadPlistFile(args.info_plist) |
| bundle_identifier = info_plist['CFBundleIdentifier'] |
| provisioning_profile = FindProvisioningProfile(args.mobileprovision_files, |
| bundle_identifier, False) |
| entitlements = GenerateEntitlements( |
| args.entitlements_path, provisioning_profile, bundle_identifier) |
| entitlements.WriteTo(args.path) |
| |
| |
| class FindProvisioningProfileAction(Action): |
| """Class implementing the find-codesign-identity action.""" |
| |
| name = 'find-provisioning-profile' |
| help = 'find provisioning profile for use by Xcode project generator' |
| |
| @staticmethod |
| def _Register(parser): |
| parser.add_argument('--bundle-id', |
| '-b', |
| required=True, |
| help='bundle identifier') |
| parser.add_argument( |
| '--mobileprovision', |
| '-m', |
| action='append', |
| default=[], |
| dest='mobileprovision_files', |
| help='set of mobileprovision files to use. If empty, uses the files ' + |
| 'in $HOME/Library/MobileDevice/Provisioning Profiles') |
| |
| @staticmethod |
| def _Execute(args): |
| provisioning_profile_info = {} |
| provisioning_profile = FindProvisioningProfile(args.mobileprovision_files, |
| args.bundle_id, False) |
| for key in ('team_identifier', 'name'): |
| if provisioning_profile: |
| provisioning_profile_info[key] = getattr(provisioning_profile, key) |
| else: |
| provisioning_profile_info[key] = '' |
| print(json.dumps(provisioning_profile_info)) |
| |
| |
| def Main(): |
| # Cache this codec so that plistlib can find it. See |
| # https://crbug.com/999461#c12 for more details. |
| codecs.lookup('utf-8') |
| |
| parser = argparse.ArgumentParser('codesign iOS bundles') |
| subparsers = parser.add_subparsers() |
| |
| actions = [ |
| CodeSignBundleAction, |
| CodeSignFileAction, |
| GenerateEntitlementsAction, |
| FindProvisioningProfileAction, |
| ] |
| |
| for action in actions: |
| action.Register(subparsers) |
| |
| args = parser.parse_args() |
| args.func(args) |
| |
| |
| if __name__ == '__main__': |
| sys.exit(Main()) |
