68 lines
4.0 KiB
Bash
Executable File
68 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Builds build/public/stemify-<version>.ipa on a Mac: ad-hoc signed, for releases and re-signing with Sideloadly/AltStore.
|
|
# With prov/Stemify.mobileprovision, prov/key.p12 and P12_PASS set, it also writes a signed
|
|
# build/prov/stemify-<version>-signed.ipa (keeps CarPlay/Siri) for the owner's own device.
|
|
# Finished IPAs are kept per version; build/work is scratch and is wiped each run.
|
|
# ios/scripts/build-remote.sh runs this on White-M1 and copies build/public and build/prov back to DevOps.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
export PATH=/opt/homebrew/bin:$PATH
|
|
B=build; OUT=$B/work; APP=$OUT/Payload/Stemify.app; EXT=$APP/PlugIns/StemifyWidgets.appex
|
|
rm -rf $OUT && mkdir -p $OUT/Payload $B/public $B/prov
|
|
VERSION=$(sed -nE 's/^ *MARKETING_VERSION: "(.*)"/\1/p' project.yml)
|
|
|
|
# xcodebuild compiles the app, the widget extension, the asset catalog and the App Intents metadata.
|
|
xcodegen generate -q
|
|
xcodebuild -project Stemify.xcodeproj -scheme Stemify -configuration Release -sdk iphoneos \
|
|
-destination generic/platform=iOS -derivedDataPath $B/dd CODE_SIGNING_ALLOWED=NO -quiet build
|
|
cp -R $B/dd/Build/Products/Release-iphoneos/Stemify.app $APP
|
|
[ -d $EXT ] || { echo "widget extension missing" >&2; exit 1; }
|
|
|
|
# Ad-hoc signature carrying only the App Group, so Sideloadly/AltStore keep the widgets' shared data when re-signing.
|
|
cat > $OUT/group.plist <<PL
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0"><dict><key>com.apple.security.application-groups</key><array><string>group.org.cdnutter.stemify</string></array></dict></plist>
|
|
PL
|
|
codesign -f -s - --entitlements $OUT/group.plist $EXT
|
|
codesign -f -s - --entitlements $OUT/group.plist $APP
|
|
|
|
# Public build, for the releases and AltStore/Sideloadly.
|
|
rm -f $B/public/stemify-$VERSION.ipa
|
|
(cd $OUT && zip -qry ../public/stemify-$VERSION.ipa Payload)
|
|
echo "$B/public/stemify-$VERSION.ipa"
|
|
|
|
if [ -f prov/Stemify.mobileprovision ] && [ -f prov/key.p12 ] && [ -n "${P12_PASS:-}" ]; then
|
|
KC=$PWD/$OUT/sign.keychain-db; KP=$(uuidgen)
|
|
security create-keychain -p "$KP" $KC
|
|
security set-keychain-settings -lut 3600 $KC
|
|
security unlock-keychain -p "$KP" $KC
|
|
security import prov/key.p12 -P "$P12_PASS" -A -t agg -f pkcs12 -k $KC >/dev/null
|
|
# The dev cert chains to Apple's WWDR G3 intermediate, which a fresh keychain doesn't have.
|
|
[ -f prov/wwdr.cer ] || curl -fsSL -o prov/wwdr.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
|
|
security import prov/wwdr.cer -A -k $KC >/dev/null 2>&1 || true
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k "$KP" $KC >/dev/null
|
|
security list-keychains -d user -s $KC $(security list-keychains -d user | tr -d '"')
|
|
ID=$(security find-identity -v -p codesigning $KC | sed -nE 's/.*"(Apple Development:.*)"/\1/p' | head -1)
|
|
security cms -D -i prov/Stemify.mobileprovision > $OUT/prov.plist
|
|
/usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/prov.plist > $OUT/ent.plist
|
|
# The widgets need their own profile (org.cdnutter.stemify.widgets with the App Group). Without one they're left out.
|
|
if [ -f prov/StemifyWidgets.mobileprovision ]; then
|
|
security cms -D -i prov/StemifyWidgets.mobileprovision > $OUT/wprov.plist
|
|
/usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/wprov.plist > $OUT/went.plist
|
|
cp prov/StemifyWidgets.mobileprovision $EXT/embedded.mobileprovision
|
|
codesign -f -s "$ID" --entitlements $OUT/went.plist --timestamp=none $EXT
|
|
else
|
|
rm -rf $APP/PlugIns
|
|
fi
|
|
cp prov/Stemify.mobileprovision $APP/embedded.mobileprovision
|
|
codesign -f -s "$ID" --entitlements $OUT/ent.plist --timestamp=none $APP
|
|
security list-keychains -d user -s $(security list-keychains -d user | tr -d "\"" | grep -v sign.keychain)
|
|
security delete-keychain $KC
|
|
# Personal build for this device only: stays in build/prov (gitignored), never released.
|
|
rm -f $B/prov/stemify-$VERSION-signed.ipa
|
|
(cd $OUT && zip -qry ../prov/stemify-$VERSION-signed.ipa Payload)
|
|
echo "$B/prov/stemify-$VERSION-signed.ipa (signed as $ID)"
|
|
fi
|
|
|