Skip to content

Commit f534697

Browse files
radareradare
committed
Update and document rcodesign support
1 parent 55e6dd6 commit f534697

File tree

3 files changed

+341
-55
lines changed

3 files changed

+341
-55
lines changed

‎README.rcodesign.md‎

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
# Using applesign with rcodesign
2+
3+
This document explains how to use applesign with [rcodesign](https://github.com/indygreg/apple-platform-rs), a pure Rust implementation of Apple code signing that works on Linux, Windows, and macOS.
4+
5+
## Overview
6+
7+
rcodesign is an open-source alternative to Apple's native `codesign` tool that provides:
8+
- Cross-platform code signing (Linux, Windows, macOS)
9+
- Pure Rust implementation (no Apple dependencies)
10+
- Support for Mach-O binaries, app bundles, installers, and disk images
11+
- Notarization support
12+
13+
## Installation
14+
15+
### Install rcodesign
16+
17+
#### Option 1: Using GitHub Action (Recommended for CI)
18+
```yaml
19+
- name: Setup rcodesign
20+
uses: ./.github/actions/action-setup-rcodesign
21+
with:
22+
github-token: ${{ secrets.GITHUB_TOKEN }}
23+
version: "0.22.0"
24+
```
25+
26+
#### Option 2: Manual Installation
27+
```bash
28+
# Download from releases
29+
curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/0.22.0/apple-codesign-0.22.0-x86_64-apple-darwin.tar.gz | tar xz
30+
sudo mv rcodesign /usr/local/bin/
31+
32+
# Or install from source
33+
cargo install --git https://github.com/indygreg/apple-platform-rs --bin rcodesign apple-codesign
34+
```
35+
36+
### Install applesign
37+
```bash
38+
npm install -g applesign
39+
```
40+
41+
## Usage
42+
43+
### Basic Usage with rcodesign
44+
45+
```bash
46+
# Use rcodesign instead of Apple's codesign
47+
applesign --codesign-tool=rcodesign -m embedded.mobileprovision target.ipa
48+
49+
# With explicit certificate file
50+
applesign --codesign-tool=rcodesign -i /path/to/certificate.p12 -m embedded.mobileprovision target.ipa
51+
52+
# With PEM certificate
53+
applesign --codesign-tool=rcodesign -i /path/to/certificate.pem -m embedded.mobileprovision target.ipa
54+
```
55+
56+
### Certificate Formats
57+
58+
rcodesign supports multiple certificate formats:
59+
60+
#### P12 Certificate (Recommended)
61+
```bash
62+
applesign --codesign-tool=rcodesign -i /path/to/developer.p12 -m embedded.mobileprovision target.ipa
63+
```
64+
65+
#### PEM Certificate
66+
```bash
67+
applesign --codesign-tool=rcodesign -i /path/to/developer.pem -m embedded.mobileprovision target.ipa
68+
```
69+
70+
#### Certificate Fingerprint
71+
```bash
72+
applesign --codesign-tool=rcodesign -i "SHA256:ABC123..." -m embedded.mobileprovision target.ipa
73+
```
74+
75+
### Advanced Options
76+
77+
```bash
78+
# Clone entitlements from provisioning profile
79+
applesign --codesign-tool=rcodesign -c -m embedded.mobileprovision target.ipa
80+
81+
# Custom entitlements file
82+
applesign --codesign-tool=rcodesign -e custom.entitlements -m embedded.mobileprovision target.ipa
83+
84+
# Remove WatchApp and plugins
85+
applesign --codesign-tool=rcodesign -w -p -m embedded.mobileprovision target.ipa
86+
87+
# Verify after signing
88+
applesign --codesign-tool=rcodesign -v -m embedded.mobileprovision target.ipa
89+
90+
# Debug mode
91+
applesign --codesign-tool=rcodesign -d debug.json -m embedded.mobileprovision target.ipa
92+
```
93+
94+
## Certificate Preparation
95+
96+
### Converting from Apple Keychain to P12
97+
```bash
98+
# Export certificate from keychain
99+
security find-certificate -c "iPhone Developer" -p > devcert.pem
100+
security find-certificate -c "iPhone Developer" -c > devcert.key
101+
102+
# Convert to P12
103+
openssl pkcs12 -export -inkey devcert.key -in devcert.pem -out developer.p12
104+
```
105+
106+
### Converting from Apple Keychain to PEM
107+
```bash
108+
# Export certificate and key
109+
security find-certificate -c "iPhone Developer" -p > certificate.pem
110+
security find-certificate -c "iPhone Developer" -c > private-key.pem
111+
112+
# Combine into single PEM
113+
cat certificate.pem private-key.pem > developer.pem
114+
```
115+
116+
## Differences from Apple codesign
117+
118+
### Key Differences
119+
120+
1. **No Keychain Integration**: rcodesign doesn't use macOS keychain directly
121+
2. **Cross-Platform**: Works on Linux and Windows, not just macOS
122+
3. **Certificate Format**: Supports PEM and P12 files directly
123+
4. **No Notarization Integration**: Separate notarization step required
124+
125+
### Limitations
126+
127+
- No automatic certificate discovery from keychain
128+
- Must specify certificate file explicitly
129+
- Some advanced codesign flags may not be supported
130+
- Keychain-related options are ignored
131+
132+
## Troubleshooting
133+
134+
### Common Issues
135+
136+
#### "Certificate not found"
137+
```bash
138+
# Ensure certificate file exists and is readable
139+
ls -la /path/to/certificate.p12
140+
141+
# Try with absolute path
142+
applesign --codesign-tool=rcodesign -i /full/path/to/certificate.p12 -m embedded.mobileprovision target.ipa
143+
```
144+
145+
#### "Invalid certificate format"
146+
```bash
147+
# Verify certificate format
148+
file /path/to/certificate.p12
149+
# Should show: data
150+
151+
# For PEM files
152+
file /path/to/certificate.pem
153+
# Should show: ASCII text
154+
```
155+
156+
#### "rcodesign not found"
157+
```bash
158+
# Check if rcodesign is in PATH
159+
which rcodesign
160+
161+
# Or use full path
162+
applesign --codesign-tool=/usr/local/bin/rcodesign -m embedded.mobileprovision target.ipa
163+
```
164+
165+
### Debug Mode
166+
167+
Enable debug mode to see detailed rcodesign commands:
168+
```bash
169+
applesign --codesign-tool=rcodesign -d debug.json -m embedded.mobileprovision target.ipa
170+
```
171+
172+
## CI/CD Integration
173+
174+
### GitHub Actions Example
175+
```yaml
176+
name: Sign with rcodesign
177+
on: [push]
178+
179+
jobs:
180+
sign:
181+
runs-on: ubuntu-latest
182+
steps:
183+
- uses: actions/checkout@v2
184+
185+
- name: Setup Node.js
186+
uses: actions/setup-node@v2
187+
with:
188+
node-version: '18'
189+
190+
- name: Install applesign
191+
run: npm install -g applesign
192+
193+
- name: Setup rcodesign
194+
uses: ./.github/actions/action-setup-rcodesign
195+
with:
196+
github-token: ${{ secrets.GITHUB_TOKEN }}
197+
198+
- name: Sign IPA
199+
env:
200+
CERTIFICATE: ${{ secrets.DEVELOPER_CERTIFICATE }}
201+
run: |
202+
echo "$CERTIFICATE" | base64 -d > developer.p12
203+
applesign --codesign-tool=rcodesign -i developer.p12 -m embedded.mobileprovision target.ipa
204+
```
205+
206+
### Docker Example
207+
```dockerfile
208+
FROM ubuntu:22.04
209+
210+
# Install dependencies
211+
RUN apt-get update && apt-get install -y \
212+
nodejs \
213+
npm \
214+
curl \
215+
unzip
216+
217+
# Install rcodesign
218+
RUN curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz | tar xz \
219+
&& mv rcodesign /usr/local/bin/
220+
221+
# Install applesign
222+
RUN npm install -g applesign
223+
224+
WORKDIR /app
225+
COPY . .
226+
227+
# Sign application
228+
CMD applesign --codesign-tool=rcodesign -i certificate.p12 -m embedded.mobileprovision app.ipa
229+
```
230+
231+
## Migration from Apple codesign
232+
233+
### Before (Apple codesign)
234+
```bash
235+
applesign -i "iPhone Developer: John Doe (ABC123DEF)" -m embedded.mobileprovision target.ipa
236+
```
237+
238+
### After (rcodesign)
239+
```bash
240+
# Step 1: Export certificate to P12 (one-time)
241+
security find-certificate -c "iPhone Developer: John Doe (ABC123DEF)" -p > cert.pem
242+
security find-certificate -c "iPhone Developer: John Doe (ABC123DEF)" -c > key.pem
243+
openssl pkcs12 -export -inkey key.pem -in cert.pem -out developer.p12
244+
245+
# Step 2: Use with rcodesign
246+
applesign --codesign-tool=rcodesign -i developer.p12 -m embedded.mobileprovision target.ipa
247+
```
248+
249+
## Additional Resources
250+
251+
- [rcodesign Documentation](https://gregoryszorc.com/docs/apple-codesign/main/)
252+
- [apple-platform-rs GitHub](https://github.com/indygreg/apple-platform-rs)
253+
- [applesign GitHub](https://github.com/nowsecure/node-applesign)
254+
- [Apple Code Signing Guide](https://developer.apple.com/support/code-signing/)
255+
256+
## Contributing
257+
258+
To contribute to rcodesign integration in applesign:
259+
260+
1. Test with different certificate formats
261+
2. Report issues with rcodesign compatibility
262+
3. Submit pull requests for additional rcodesign features
263+
4. Update documentation for new use cases
264+
265+
## License
266+
267+
This integration follows the same MIT license as applesign. rcodesign is licensed under MPL-2.0.

‎index.ts‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -647,15 +647,25 @@ class Applesign {
647647
res = await tools.pseudoSign(entitlements, file);
648648
} else {
649649
const keychain = getKeychain();
650-
res = await tools.codesign(identity, entitlements, keychain, file, this.config.codeSign);
650+
res = await tools.codesign(
651+
identity,
652+
entitlements,
653+
keychain,
654+
file,
655+
this.config.codeSign,
656+
);
651657
if (res.code !== 0 && codesignHasFailed(config, res.code, res.stderr)) {
652-
return this.emit('end', res.stderr);
658+
return this.emit("end", res.stderr);
653659
}
654660
}
655661
this.emit("message", "Signed " + file);
656662
if (config.verifyTwice) {
657663
this.emit("message", "Verify " + file);
658-
const res = await tools.verifyCodesign(file, config.keychain);
664+
const res = await tools.verifyCodesign(
665+
file,
666+
this.config.keychain,
667+
this.config.codeSign,
668+
);
659669
if (res.code !== 0) {
660670
const type = config.ignoreVerificationErrors ? "warning" : "error";
661671
return this.emit(type, res.stderr);
@@ -760,7 +770,7 @@ class Applesign {
760770
await this.signFile(lib);
761771
if (this.config.verify) {
762772
this.emit("message", "Verifying " + lib);
763-
await tools.verifyCodesign(lib);
773+
await tools.verifyCodesign(lib, undefined, this.config.codeSign);
764774
}
765775
}
766776
};

0 commit comments

Comments
 (0)