codesign_ios.py 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. #!/usr/bin/env python2.7
  2. #
  3. # Copyright 2017 Google Inc.
  4. #
  5. # Use of this source code is governed by a BSD-style license that can be
  6. # found in the LICENSE file.
  7. import glob
  8. import os
  9. import re
  10. import shutil
  11. import subprocess
  12. import sys
  13. import tempfile
  14. # Arguments to the script:
  15. # pkg path to application directory, e.g. out/Debug/dm.app
  16. # executable and plist should already be in this directory
  17. # identstr search string (regex fragment) for code signing identity
  18. # profile name of provisioning profile
  19. pkg,identstr,profile = sys.argv[1:]
  20. # Find the Google signing identity.
  21. identity = None
  22. for line in subprocess.check_output(['security', 'find-identity']).split('\n'):
  23. m = re.match(r'''.*\) (.*) "''' + identstr + '"', line)
  24. if m:
  25. identity = m.group(1)
  26. assert identity
  27. # Find the Google mobile provisioning profile.
  28. mobileprovision = None
  29. for p in glob.glob(os.path.join(os.environ['HOME'], 'Library', 'MobileDevice',
  30. 'Provisioning Profiles', '*.mobileprovision')):
  31. if re.search(r'''<key>Name</key>
  32. \t<string>''' + profile + r'''</string>''', open(p).read(), re.MULTILINE):
  33. mobileprovision = p
  34. assert mobileprovision
  35. # The .mobileprovision just gets copied into the package.
  36. shutil.copy(mobileprovision,
  37. os.path.join(pkg, 'embedded.mobileprovision'))
  38. # Extract the appliciation identitifer prefix from the .mobileprovision.
  39. m = re.search(r'''<key>ApplicationIdentifierPrefix</key>
  40. \t<array>
  41. \t<string>(.*)</string>''', open(mobileprovision).read(), re.MULTILINE)
  42. prefix = m.group(1)
  43. app, _ = os.path.splitext(os.path.basename(pkg))
  44. # Write a minimal entitlements file, then codesign.
  45. with tempfile.NamedTemporaryFile() as f:
  46. f.write('''
  47. <plist version="1.0">
  48. <dict>
  49. <key>application-identifier</key> <string>{prefix}.com.google.{app}</string>
  50. <key>get-task-allow</key> <true/>
  51. </dict>
  52. </plist>
  53. '''.format(prefix=prefix, app=app))
  54. f.flush()
  55. subprocess.check_call(['codesign',
  56. '--force',
  57. '--sign', identity,
  58. '--entitlements', f.name,
  59. '--timestamp=none',
  60. pkg])