Skip to content

Commit a520343

Browse files
radareradare
committed
Update and document rcodesign support
1 parent 77fff67 commit a520343

File tree

3 files changed

+362
-55
lines changed

3 files changed

+362
-55
lines changed

‎README.rcodesign.md‎

Lines changed: 288 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
# Using applesign with rcodesign
2+
3+
This document explains how to use applesign with
4+
[rcodesign](https://github.com/indygreg/apple-platform-rs), a pure Rust
5+
implementation of Apple code signing that works on Linux, Windows, and macOS.
6+
7+
## Overview
8+
9+
rcodesign is an open-source alternative to Apple's native `codesign` tool that
10+
provides:
11+
12+
- Cross-platform code signing (Linux, Windows, macOS)
13+
- Pure Rust implementation (no Apple dependencies)
14+
- Support for Mach-O binaries, app bundles, installers, and disk images
15+
- Notarization support
16+
17+
## Installation
18+
19+
### Install rcodesign
20+
21+
#### Option 1: Using GitHub Action (Recommended for CI)
22+
23+
```yaml
24+
- name: Setup rcodesign
25+
uses: ./.github/actions/action-setup-rcodesign
26+
with:
27+
github-token: ${{ secrets.GITHUB_TOKEN }}
28+
version: "0.22.0"
29+
```
30+
31+
#### Option 2: Manual Installation
32+
33+
```bash
34+
# Download from releases
35+
curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/0.22.0/apple-codesign-0.22.0-x86_64-apple-darwin.tar.gz | tar xz
36+
sudo mv rcodesign /usr/local/bin/
37+
38+
# Or install from source
39+
cargo install --git https://github.com/indygreg/apple-platform-rs --bin rcodesign apple-codesign
40+
```
41+
42+
### Install applesign
43+
44+
```bash
45+
npm install -g applesign
46+
```
47+
48+
## Usage
49+
50+
### Basic Usage with rcodesign
51+
52+
```bash
53+
# Use rcodesign instead of Apple's codesign
54+
applesign --codesign-tool=rcodesign -m embedded.mobileprovision target.ipa
55+
56+
# With explicit certificate file
57+
applesign --codesign-tool=rcodesign -i /path/to/certificate.p12 -m embedded.mobileprovision target.ipa
58+
59+
# With PEM certificate
60+
applesign --codesign-tool=rcodesign -i /path/to/certificate.pem -m embedded.mobileprovision target.ipa
61+
```
62+
63+
### Certificate Formats
64+
65+
rcodesign supports multiple certificate formats:
66+
67+
#### P12 Certificate (Recommended)
68+
69+
```bash
70+
applesign --codesign-tool=rcodesign -i /path/to/developer.p12 -m embedded.mobileprovision target.ipa
71+
```
72+
73+
#### PEM Certificate
74+
75+
```bash
76+
applesign --codesign-tool=rcodesign -i /path/to/developer.pem -m embedded.mobileprovision target.ipa
77+
```
78+
79+
#### Certificate Fingerprint
80+
81+
```bash
82+
applesign --codesign-tool=rcodesign -i "SHA256:ABC123..." -m embedded.mobileprovision target.ipa
83+
```
84+
85+
### Advanced Options
86+
87+
```bash
88+
# Clone entitlements from provisioning profile
89+
applesign --codesign-tool=rcodesign -c -m embedded.mobileprovision target.ipa
90+
91+
# Custom entitlements file
92+
applesign --codesign-tool=rcodesign -e custom.entitlements -m embedded.mobileprovision target.ipa
93+
94+
# Remove WatchApp and plugins
95+
applesign --codesign-tool=rcodesign -w -p -m embedded.mobileprovision target.ipa
96+
97+
# Verify after signing
98+
applesign --codesign-tool=rcodesign -v -m embedded.mobileprovision target.ipa
99+
100+
# Debug mode
101+
applesign --codesign-tool=rcodesign -d debug.json -m embedded.mobileprovision target.ipa
102+
```
103+
104+
## Certificate Preparation
105+
106+
### Converting from Apple Keychain to P12
107+
108+
```bash
109+
# Export certificate from keychain
110+
security find-certificate -c "iPhone Developer" -p > devcert.pem
111+
security find-certificate -c "iPhone Developer" -c > devcert.key
112+
113+
# Convert to P12
114+
openssl pkcs12 -export -inkey devcert.key -in devcert.pem -out developer.p12
115+
```
116+
117+
### Converting from Apple Keychain to PEM
118+
119+
```bash
120+
# Export certificate and key
121+
security find-certificate -c "iPhone Developer" -p > certificate.pem
122+
security find-certificate -c "iPhone Developer" -c > private-key.pem
123+
124+
# Combine into single PEM
125+
cat certificate.pem private-key.pem > developer.pem
126+
```
127+
128+
## Differences from Apple codesign
129+
130+
### Key Differences
131+
132+
1. **No Keychain Integration**: rcodesign doesn't use macOS keychain directly
133+
2. **Cross-Platform**: Works on Linux and Windows, not just macOS
134+
3. **Certificate Format**: Supports PEM and P12 files directly
135+
4. **No Notarization Integration**: Separate notarization step required
136+
137+
### Limitations
138+
139+
- No automatic certificate discovery from keychain
140+
- Must specify certificate file explicitly
141+
- Some advanced codesign flags may not be supported
142+
- Keychain-related options are ignored
143+
144+
## Troubleshooting
145+
146+
### Common Issues
147+
148+
#### "Certificate not found"
149+
150+
```bash
151+
# Ensure certificate file exists and is readable
152+
ls -la /path/to/certificate.p12
153+
154+
# Try with absolute path
155+
applesign --codesign-tool=rcodesign -i /full/path/to/certificate.p12 -m embedded.mobileprovision target.ipa
156+
```
157+
158+
#### "Invalid certificate format"
159+
160+
```bash
161+
# Verify certificate format
162+
file /path/to/certificate.p12
163+
# Should show: data
164+
165+
# For PEM files
166+
file /path/to/certificate.pem
167+
# Should show: ASCII text
168+
```
169+
170+
#### "rcodesign not found"
171+
172+
```bash
173+
# Check if rcodesign is in PATH
174+
which rcodesign
175+
176+
# Or use full path
177+
applesign --codesign-tool=/usr/local/bin/rcodesign -m embedded.mobileprovision target.ipa
178+
```
179+
180+
### Debug Mode
181+
182+
Enable debug mode to see detailed rcodesign commands:
183+
184+
```bash
185+
applesign --codesign-tool=rcodesign -d debug.json -m embedded.mobileprovision target.ipa
186+
```
187+
188+
## CI/CD Integration
189+
190+
### GitHub Actions Example
191+
192+
```yaml
193+
name: Sign with rcodesign
194+
on: [push]
195+
196+
jobs:
197+
sign:
198+
runs-on: ubuntu-latest
199+
steps:
200+
- uses: actions/checkout@v2
201+
202+
- name: Setup Node.js
203+
uses: actions/setup-node@v2
204+
with:
205+
node-version: "18"
206+
207+
- name: Install applesign
208+
run: npm install -g applesign
209+
210+
- name: Setup rcodesign
211+
uses: ./.github/actions/action-setup-rcodesign
212+
with:
213+
github-token: ${{ secrets.GITHUB_TOKEN }}
214+
215+
- name: Sign IPA
216+
env:
217+
CERTIFICATE: ${{ secrets.DEVELOPER_CERTIFICATE }}
218+
run: |
219+
echo "$CERTIFICATE" | base64 -d > developer.p12
220+
applesign --codesign-tool=rcodesign -i developer.p12 -m embedded.mobileprovision target.ipa
221+
```
222+
223+
### Docker Example
224+
225+
```dockerfile
226+
FROM ubuntu:22.04
227+
228+
# Install dependencies
229+
RUN apt-get update && apt-get install -y \
230+
nodejs \
231+
npm \
232+
curl \
233+
unzip
234+
235+
# Install rcodesign
236+
RUN curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz | tar xz \
237+
&& mv rcodesign /usr/local/bin/
238+
239+
# Install applesign
240+
RUN npm install -g applesign
241+
242+
WORKDIR /app
243+
COPY . .
244+
245+
# Sign application
246+
CMD applesign --codesign-tool=rcodesign -i certificate.p12 -m embedded.mobileprovision app.ipa
247+
```
248+
249+
## Migration from Apple codesign
250+
251+
### Before (Apple codesign)
252+
253+
```bash
254+
applesign -i "iPhone Developer: John Doe (ABC123DEF)" -m embedded.mobileprovision target.ipa
255+
```
256+
257+
### After (rcodesign)
258+
259+
```bash
260+
# Step 1: Export certificate to P12 (one-time)
261+
security find-certificate -c "iPhone Developer: John Doe (ABC123DEF)" -p > cert.pem
262+
security find-certificate -c "iPhone Developer: John Doe (ABC123DEF)" -c > key.pem
263+
openssl pkcs12 -export -inkey key.pem -in cert.pem -out developer.p12
264+
265+
# Step 2: Use with rcodesign
266+
applesign --codesign-tool=rcodesign -i developer.p12 -m embedded.mobileprovision target.ipa
267+
```
268+
269+
## Additional Resources
270+
271+
- [rcodesign Documentation](https://gregoryszorc.com/docs/apple-codesign/main/)
272+
- [apple-platform-rs GitHub](https://github.com/indygreg/apple-platform-rs)
273+
- [applesign GitHub](https://github.com/nowsecure/node-applesign)
274+
- [Apple Code Signing Guide](https://developer.apple.com/support/code-signing/)
275+
276+
## Contributing
277+
278+
To contribute to rcodesign integration in applesign:
279+
280+
1. Test with different certificate formats
281+
2. Report issues with rcodesign compatibility
282+
3. Submit pull requests for additional rcodesign features
283+
4. Update documentation for new use cases
284+
285+
## License
286+
287+
This integration follows the same MIT license as applesign. rcodesign is
288+
licensed under MPL-2.0.

‎index.ts‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -647,15 +647,25 @@ class Applesign {
647647
res = await tools.pseudoSign(entitlements, file);
648648
} else {
649649
const keychain = getKeychain();
650-
res = await tools.codesign(identity, entitlements, keychain, file, this.config.codeSign);
650+
res = await tools.codesign(
651+
identity,
652+
entitlements,
653+
keychain,
654+
file,
655+
this.config.codeSign,
656+
);
651657
if (res.code !== 0 && codesignHasFailed(config, res.code, res.stderr)) {
652-
return this.emit('end', res.stderr);
658+
return this.emit("end", res.stderr);
653659
}
654660
}
655661
this.emit("message", "Signed " + file);
656662
if (config.verifyTwice) {
657663
this.emit("message", "Verify " + file);
658-
const res = await tools.verifyCodesign(file, config.keychain);
664+
const res = await tools.verifyCodesign(
665+
file,
666+
this.config.keychain,
667+
this.config.codeSign,
668+
);
659669
if (res.code !== 0) {
660670
const type = config.ignoreVerificationErrors ? "warning" : "error";
661671
return this.emit(type, res.stderr);
@@ -760,7 +770,7 @@ class Applesign {
760770
await this.signFile(lib);
761771
if (this.config.verify) {
762772
this.emit("message", "Verifying " + lib);
763-
await tools.verifyCodesign(lib);
773+
await tools.verifyCodesign(lib, undefined, this.config.codeSign);
764774
}
765775
}
766776
};

0 commit comments

Comments
 (0)