fastlane-plugin-voip_push_certificate 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b816333567b5063e96d1581ed6cf42362824ae82ec9783cccc09ab1c6efa8578
+  data.tar.gz: 8f0fc9c35319c303b6d1ee8041ac18063157a19250b4e333330db038cc20f8cc
+SHA512:
+  metadata.gz: 7a2cdc229c63491b18f06539c66c2a038114c0748bb3985b08489f5d9f4993bbd27218e81c47c584a01043566bbd33d59e16285bf31fd8a96c38257b18666c1e
+  data.tar.gz: 2fb9a43b615924d7c3c2adf9f1045a25766de244bd45363d7cee98618ce1c4d465a6c3c5cc23285fa9bb37f943d044546e63c5312971877cf767f33076c4a585

data/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0]
+
+### Added
+
+- `get_voip_push_certificate` action, creating and renewing Apple VoIP Services push
+  certificates through Spaceship's Developer Portal API.
+- Writes `.pem` and `.p12` files, with optional `.pkey` and raw DER `.cer` output.
+- `active_days_limit` (default 30) and `force` options controlling when an existing
+  certificate is renewed, matching the behaviour of `get_push_certificate`.
+- `revoke_existing` option, disabled by default, to revoke the matching certificate
+  before creating a new one.
+- `bag_attributes` option, writing the `.pem` with OpenSSL `friendlyName` and
+  `localKeyID` headers for push providers that require that format.
+- Generated paths exposed through the lane context as
+  `VOIP_PUSH_CERTIFICATE_{PEM,P12,PKEY,CER}_PATH`.
+
+[Unreleased]: https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate/releases/tag/v0.1.0

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Rafael Ferreira <rafinha951026@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,138 @@
+# fastlane-plugin-voip_push_certificate
+
+[![Test](https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate/actions/workflows/test.yml/badge.svg)](https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate/actions/workflows/test.yml)
+
+Create and renew Apple **VoIP Services** push certificates (the certificate type PushKit
+requires) from a fastlane lane.
+
+fastlane's built-in [`get_push_certificate`](https://docs.fastlane.tools/actions/get_push_certificate/)
+(`pem`) handles development, production and website push certificates, but not VoIP ones.
+This plugin fills that gap using the same Spaceship APIs, so it behaves the way you already
+expect `pem` to behave.
+
+## Getting Started
+
+Requires Ruby 3.1 or newer.
+
+Add the plugin to your project:
+
+```bash
+fastlane add_plugin voip_push_certificate
+```
+
+Or, to use it straight from source without installing the gem, add this to your `fastlane/Pluginfile`:
+
+```ruby
+gem 'fastlane-plugin-voip_push_certificate', git: 'https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate'
+```
+
+## Usage
+
+```ruby
+lane :renew_voip do
+  get_voip_push_certificate(
+    app_identifier: "com.example.app",
+    output_path: "./certs"
+  )
+end
+```
+
+By default this creates `voip_com.example.app.pem` and `voip_com.example.app.p12` (plus the
+private key) in `output_path`, but **only if** the current certificate expires within 30 days.
+Otherwise it logs how long the existing one is still valid and does nothing.
+
+The action returns the path to the generated `.pem`, or `nil` when the existing certificate
+was kept. All generated paths are also exposed through the lane context:
+
+```ruby
+lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_PEM_PATH]
+lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_P12_PATH]
+lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_PKEY_PATH]
+lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_CER_PATH]
+```
+
+## Options
+
+| Option | Type | Default | Description |
+| --- | --- | --- | --- |
+| `app_identifier` | String | from `Appfile` | The bundle identifier of your app |
+| `username` | String | from `Appfile` | Your Apple ID username |
+| `team_id` | String | from `Appfile` | Developer Portal team ID, if you're in multiple teams |
+| `team_name` | String | from `Appfile` | Developer Portal team name, if you're in multiple teams |
+| `active_days_limit` | Integer | `30` | Renew only if the current certificate expires within this many days |
+| `force` | Boolean | `false` | Create a new certificate even if the current one is still valid |
+| `revoke_existing` | Boolean | `false` | Revoke the matching certificate before creating a new one. See the warning below |
+| `generate_p12` | Boolean | `true` | Also write a `.p12` file |
+| `p12_password` | String | none | Password for the `.p12` file |
+| `save_private_key` | Boolean | `true` | Also write the private key as a `.pkey` file |
+| `save_cer` | Boolean | `false` | Also write the raw DER certificate as a `.cer` file |
+| `bag_attributes` | Boolean | `false` | Write the `.pem` with OpenSSL bag attributes. See below |
+| `pem_name` | String | `voip_<app_identifier>` | Base file name for the generated files |
+| `output_path` | String | `.` | Directory to write the certificates into |
+
+Every option also has an environment variable, e.g. `VOIP_PUSH_CERTIFICATE_APP_IDENTIFIER`.
+
+## Things worth knowing
+
+### There is no development/production distinction
+
+Apple issues a single VoIP Services certificate that is valid for **both** the sandbox and the
+production APNs environments. That is why, unlike `get_push_certificate`, this action has no
+`development` option.
+
+### Revoking is opt-in, on purpose
+
+Apple allows at most two active VoIP certificates per App ID. When that limit is reached the
+action fails with an explanation rather than revoking anything, because revoking a certificate
+**immediately** stops every push provider still using it, including your production one.
+
+Set `revoke_existing: true` only when you are sure nothing depends on the old certificate:
+
+```ruby
+get_voip_push_certificate(
+  app_identifier: "com.example.app",
+  force: true,
+  revoke_existing: true
+)
+```
+
+### The `bag_attributes` option
+
+Some push providers reject a plain concatenated PEM and expect the format that
+`openssl pkcs12 -nodes` produces, with `friendlyName` and `localKeyID` headers around each
+block. If yours does, set `bag_attributes: true`. The default (`false`) matches what
+`get_push_certificate` writes: the certificate followed by the private key, nothing else.
+
+### Authentication
+
+This uses Spaceship's Apple Developer Portal API, which needs an Apple ID and password:
+
+```bash
+export FASTLANE_USER="you@example.com"
+export FASTLANE_PASSWORD="…"
+```
+
+Two-factor authentication is supported through fastlane's usual session mechanism
+(`FASTLANE_SESSION`, `fastlane spaceauth`).
+
+**App Store Connect API keys are not supported.** Apple's App Store Connect API does not cover
+push certificates, so the portal API is the only option. This is a limitation of Apple's API,
+not of this plugin. `get_push_certificate` has exactly the same constraint.
+
+## Running tests
+
+```bash
+bundle install
+bundle exec rake
+```
+
+## Relationship to fastlane
+
+This is an unofficial plugin and is not affiliated with fastlane or Apple. Adding VoIP support
+to `pem` itself has been requested since 2017 in
+[fastlane/fastlane#8145](https://github.com/fastlane/fastlane/issues/8145); if it ever lands
+upstream, this plugin will be deprecated in favour of it.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/lib/fastlane/plugin/voip_push_certificate/actions/get_voip_push_certificate_action.rb

@@ -0,0 +1,193 @@
+require 'fastlane/action'
+require 'fastlane_core/configuration/config_item'
+require 'credentials_manager/appfile_config'
+require_relative '../helper/voip_push_certificate_helper'
+
+module Fastlane
+  module Actions
+    module SharedValues
+      VOIP_PUSH_CERTIFICATE_PEM_PATH = :VOIP_PUSH_CERTIFICATE_PEM_PATH
+      VOIP_PUSH_CERTIFICATE_P12_PATH = :VOIP_PUSH_CERTIFICATE_P12_PATH
+      VOIP_PUSH_CERTIFICATE_PKEY_PATH = :VOIP_PUSH_CERTIFICATE_PKEY_PATH
+      VOIP_PUSH_CERTIFICATE_CER_PATH = :VOIP_PUSH_CERTIFICATE_CER_PATH
+    end
+
+    class GetVoipPushCertificateAction < Action
+      def self.run(params)
+        paths = Helper::VoipPushCertificateHelper.new(params).run
+        return nil if paths.nil?
+
+        Actions.lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_PEM_PATH] = paths[:pem]
+        Actions.lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_P12_PATH] = paths[:p12]
+        Actions.lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_PKEY_PATH] = paths[:pkey]
+        Actions.lane_context[SharedValues::VOIP_PUSH_CERTIFICATE_CER_PATH] = paths[:cer]
+
+        paths[:pem]
+      end
+
+      def self.description
+        "Create and renew Apple VoIP Services push certificates"
+      end
+
+      def self.details
+        [
+          "Generates an Apple *VoIP Services* push certificate (the certificate type used by PushKit)",
+          "and writes it to disk as `.pem`, `.p12` and, optionally, `.cer`.",
+          "",
+          "fastlane's built-in `get_push_certificate` covers development, production and website push",
+          "certificates, but not VoIP ones. This plugin fills that gap using the same Spaceship APIs.",
+          "",
+          "Apple issues a single VoIP Services certificate that works for both the sandbox and the",
+          "production APNs environments, so there is no `development` option here.",
+          "",
+          "By default an existing certificate is never revoked: if the app already has two active VoIP",
+          "certificates the action fails with an explanation. Set `revoke_existing` to true only if you",
+          "are sure no push provider still depends on the old certificate.",
+          "",
+          "Authentication goes through Spaceship's Apple Developer Portal API, which requires an Apple ID",
+          "and password (`FASTLANE_USER` / `FASTLANE_PASSWORD`) plus 2FA. App Store Connect API keys are",
+          "not supported for push certificates by Apple's portal API."
+        ].join("\n")
+      end
+
+      def self.return_value
+        "The path to the generated .pem file, or nil when the existing certificate was still valid and was kept"
+      end
+
+      def self.output
+        [
+          ['VOIP_PUSH_CERTIFICATE_PEM_PATH', 'The path to the generated .pem file'],
+          ['VOIP_PUSH_CERTIFICATE_P12_PATH', 'The path to the generated .p12 file'],
+          ['VOIP_PUSH_CERTIFICATE_PKEY_PATH', 'The path to the generated private key'],
+          ['VOIP_PUSH_CERTIFICATE_CER_PATH', 'The path to the generated .cer file']
+        ]
+      end
+
+      def self.authors
+        ["Rafael Ferreira"]
+      end
+
+      def self.example_code
+        [
+          'get_voip_push_certificate',
+          'get_voip_push_certificate(
+            app_identifier: "com.example.app",
+            output_path: "./certs"
+          )',
+          '# Renew even if the current certificate is still valid for a long time
+          get_voip_push_certificate(
+            app_identifier: "com.example.app",
+            force: true,
+            revoke_existing: true
+          )'
+        ]
+      end
+
+      def self.category
+        :push
+      end
+
+      def self.available_options
+        user = CredentialsManager::AppfileConfig.try_fetch_value(:apple_dev_portal_id)
+        user ||= CredentialsManager::AppfileConfig.try_fetch_value(:apple_id)
+
+        [
+          FastlaneCore::ConfigItem.new(key: :app_identifier,
+                                       short_option: "-a",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_APP_IDENTIFIER",
+                                       description: "The bundle identifier of your app",
+                                       code_gen_sensitive: true,
+                                       default_value: CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier),
+                                       default_value_dynamic: true),
+          FastlaneCore::ConfigItem.new(key: :username,
+                                       short_option: "-u",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_USERNAME",
+                                       description: "Your Apple ID username",
+                                       default_value: user,
+                                       default_value_dynamic: true),
+          FastlaneCore::ConfigItem.new(key: :team_id,
+                                       short_option: "-b",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_TEAM_ID",
+                                       description: "The ID of your Developer Portal team if you're in multiple teams",
+                                       code_gen_sensitive: true,
+                                       default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_id),
+                                       default_value_dynamic: true,
+                                       optional: true,
+                                       verify_block: proc do |value|
+                                         ENV["FASTLANE_TEAM_ID"] = value.to_s
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :team_name,
+                                       short_option: "-l",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_TEAM_NAME",
+                                       description: "The name of your Developer Portal team if you're in multiple teams",
+                                       code_gen_sensitive: true,
+                                       default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_name),
+                                       default_value_dynamic: true,
+                                       optional: true,
+                                       verify_block: proc do |value|
+                                         ENV["FASTLANE_TEAM_NAME"] = value.to_s
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :active_days_limit,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_ACTIVE_DAYS_LIMIT",
+                                       description: "If the current certificate is active for less than this number of days, generate a new one",
+                                       default_value: 30,
+                                       type: Integer,
+                                       verify_block: proc do |value|
+                                         UI.user_error!("Value of active_days_limit must be a positive integer") unless value.kind_of?(Integer) && value > 0
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :force,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_FORCE",
+                                       description: "Create a new certificate, even if the current one is active for more than `active_days_limit` days",
+                                       type: Boolean,
+                                       default_value: false),
+          FastlaneCore::ConfigItem.new(key: :revoke_existing,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_REVOKE_EXISTING",
+                                       description: "Revoke the matching existing certificate before creating a new one. This immediately breaks any push provider still using it",
+                                       type: Boolean,
+                                       default_value: false),
+          FastlaneCore::ConfigItem.new(key: :generate_p12,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_GENERATE_P12_FILE",
+                                       description: "Generate a p12 file additionally to the PEM file",
+                                       type: Boolean,
+                                       default_value: true),
+          FastlaneCore::ConfigItem.new(key: :p12_password,
+                                       short_option: "-p",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_P12_PASSWORD",
+                                       sensitive: true,
+                                       description: "The password that is used for your p12 file",
+                                       optional: true),
+          FastlaneCore::ConfigItem.new(key: :save_private_key,
+                                       short_option: "-s",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_SAVE_PRIVATE_KEY",
+                                       description: "Set to save the private RSA key as a separate .pkey file",
+                                       type: Boolean,
+                                       default_value: true),
+          FastlaneCore::ConfigItem.new(key: :save_cer,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_SAVE_CER",
+                                       description: "Additionally save the raw DER certificate as a .cer file",
+                                       type: Boolean,
+                                       default_value: false),
+          FastlaneCore::ConfigItem.new(key: :bag_attributes,
+                                       env_name: "VOIP_PUSH_CERTIFICATE_BAG_ATTRIBUTES",
+                                       description: "Write the .pem with OpenSSL bag attributes (friendlyName / localKeyID), mimicking the output of `openssl pkcs12 -nodes`. Some push providers require this format",
+                                       type: Boolean,
+                                       default_value: false),
+          FastlaneCore::ConfigItem.new(key: :pem_name,
+                                       short_option: "-o",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_PEM_NAME",
+                                       description: "The base file name of the generated files. Defaults to `voip_<app_identifier>`",
+                                       optional: true),
+          FastlaneCore::ConfigItem.new(key: :output_path,
+                                       short_option: "-e",
+                                       env_name: "VOIP_PUSH_CERTIFICATE_OUTPUT_PATH",
+                                       description: "The path to a directory in which all certificates and private keys should be stored",
+                                       default_value: ".")
+        ]
+      end
+
+      def self.is_supported?(platform)
+        [:ios].include?(platform)
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/voip_push_certificate/helper/voip_push_certificate_helper.rb

@@ -0,0 +1,178 @@
+require 'fastlane_core/ui/ui'
+require 'spaceship'
+require 'openssl'
+require 'fileutils'
+require 'pathname'
+
+module Fastlane
+  UI = FastlaneCore::UI unless Fastlane.const_defined?(:UI)
+
+  module Helper
+    # Creates and renews Apple "VoIP Services" push certificates. Apple issues a single
+    # VoIP certificate valid for both the sandbox and the production APNs environments,
+    # so there is no development/production distinction here.
+    class VoipPushCertificateHelper
+      CERTIFICATE_LABEL = "VoIP Services".freeze
+
+      def initialize(params)
+        @params = params
+      end
+
+      # @return [Hash, nil] paths of the generated files, or nil when the existing
+      #   certificate is still valid and no new one was created.
+      def run
+        login
+
+        existing = existing_certificate
+        if existing
+          days = remaining_days(existing)
+          UI.message("Existing VoIP Services certificate for '#{existing.owner_name}' is valid for #{days.round} more days.")
+          return nil if keep_existing?(days)
+
+          revoke!(existing) if @params[:revoke_existing]
+        end
+
+        create_certificate
+      end
+
+      private
+
+      def app_identifier
+        @params[:app_identifier]
+      end
+
+      def login
+        UI.message("Starting login with user '#{@params[:username]}'")
+        Spaceship.login(@params[:username], nil)
+        Spaceship.client.select_team
+        UI.message("Successfully logged in")
+      end
+
+      # `Spaceship.certificate.voip_push` resolves to
+      # `Spaceship::Portal::Certificate::VoipPush` through Spaceship's method_missing.
+      def certificate_class
+        Spaceship.certificate.voip_push
+      end
+
+      def existing_certificate
+        certificate_class.all.sort { |x, y| y.expires <=> x.expires }.detect do |cert|
+          cert.owner_name == app_identifier
+        end
+      end
+
+      def remaining_days(certificate)
+        (certificate.expires - Time.now) / 60 / 60 / 24
+      end
+
+      def keep_existing?(days)
+        return false if days <= @params[:active_days_limit]
+
+        if @params[:force]
+          UI.success("You already have an existing VoIP certificate, but a new one will be created since the `force` option has been set.")
+          return false
+        end
+
+        UI.success("You already have a VoIP certificate, which is active for more than #{@params[:active_days_limit]} more days. No need to create a new one.")
+        UI.success("If you still want to create a new one, use the `force` option.")
+        true
+      end
+
+      def revoke!(certificate)
+        UI.important("Revoking the existing VoIP Services certificate for '#{certificate.owner_name}' (expires #{certificate.expires}).")
+        UI.important("Any push provider still using that certificate will stop being able to send VoIP pushes.")
+        certificate.revoke!
+        UI.success("Revoked the previous certificate.")
+      end
+
+      def create_certificate
+        verify_app_exists!
+        UI.important("Creating a new VoIP Services certificate for app '#{app_identifier}'.")
+
+        csr, pkey = Spaceship.certificate.create_certificate_signing_request
+
+        begin
+          certificate = certificate_class.create!(csr: csr, bundle_id: app_identifier)
+        rescue StandardError => e
+          if e.to_s.include?("You already have a current")
+            UI.message(e.to_s)
+            UI.user_error!("You already have 2 active VoIP Services certificates for '#{app_identifier}'. " \
+                           "Revoke one in the Apple Developer Portal, or re-run with `revoke_existing: true` " \
+                           "to let this action revoke the matching one for you.")
+          else
+            raise e
+          end
+        end
+
+        write_files(certificate.download, pkey)
+      end
+
+      # `create!` already raises when the bundle id is unknown, but it does so from
+      # deep inside Spaceship. Failing early gives a much clearer message.
+      def verify_app_exists!
+        app = Spaceship.app.find(app_identifier)
+        UI.user_error!("Could not find an App ID for '#{app_identifier}' in the Apple Developer Portal.") unless app
+        UI.message("Found app '#{app.name}' for bundle id '#{app_identifier}'")
+      end
+
+      def write_files(x509_certificate, pkey)
+        output_path = File.expand_path(@params[:output_path])
+        FileUtils.mkdir_p(output_path)
+
+        filename_base = @params[:pem_name] || "voip_#{app_identifier}"
+        filename_base = File.basename(filename_base, ".pem")
+
+        paths = {}
+
+        if @params[:save_private_key]
+          paths[:pkey] = File.join(output_path, "#{filename_base}.pkey")
+          File.write(paths[:pkey], pkey.to_pem)
+          UI.message("Private key: ".green + Pathname.new(paths[:pkey]).realpath.to_s)
+        end
+
+        if @params[:save_cer]
+          paths[:cer] = File.join(output_path, "#{filename_base}.cer")
+          File.binwrite(paths[:cer], x509_certificate.to_der)
+          UI.message("Certificate (DER): ".green + Pathname.new(paths[:cer]).realpath.to_s)
+        end
+
+        if @params[:generate_p12]
+          paths[:p12] = File.join(output_path, "#{filename_base}.p12")
+          p12_password = @params[:p12_password] == "" ? nil : @params[:p12_password]
+          p12 = OpenSSL::PKCS12.create(p12_password, friendly_name, pkey, x509_certificate)
+          File.binwrite(paths[:p12], p12.to_der)
+          UI.message("p12 certificate: ".green + Pathname.new(paths[:p12]).realpath.to_s)
+        end
+
+        paths[:pem] = File.join(output_path, "#{filename_base}.pem")
+        File.write(paths[:pem], pem_contents(x509_certificate, pkey))
+        UI.message("PEM: ".green + Pathname.new(paths[:pem]).realpath.to_s)
+
+        paths
+      end
+
+      def friendly_name
+        "#{CERTIFICATE_LABEL}: #{app_identifier}"
+      end
+
+      def pem_contents(x509_certificate, pkey)
+        return x509_certificate.to_pem + pkey.to_pem unless @params[:bag_attributes]
+
+        header = "Bag Attributes\n    " \
+                 "friendlyName: #{friendly_name}\n    " \
+                 "localKeyID: #{local_key_id(pkey)} \n"
+
+        "#{header}subject=#{x509_certificate.subject}\n" \
+          "issuer=#{x509_certificate.issuer}\n" \
+          "#{x509_certificate.to_pem.strip}\n" \
+          "#{header}Key Attributes: <No Attributes>\n" \
+          "#{pkey.to_pem.strip}\n"
+      end
+
+      # Mimics the localKeyID that `openssl pkcs12 -nodes` writes: the SHA1 digest
+      # of the DER-encoded public key, as space separated uppercase hex bytes.
+      def local_key_id(pkey)
+        OpenSSL::Digest::SHA1.digest(pkey.public_key.to_der).bytes.map { |byte| format("%02X", byte) }.join(" ")
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/voip_push_certificate/version.rb

@@ -0,0 +1,5 @@
+module Fastlane
+  module VoipPushCertificate
+    VERSION = "0.1.0"
+  end
+end

data/lib/fastlane/plugin/voip_push_certificate.rb

@@ -0,0 +1,16 @@
+require 'fastlane/plugin/voip_push_certificate/version'
+
+module Fastlane
+  module VoipPushCertificate
+    # Return all .rb files inside the "actions" and "helper" directory
+    def self.all_classes
+      Dir[File.expand_path('**/{actions,helper}/*.rb', File.dirname(__FILE__))]
+    end
+  end
+end
+
+# By default we want to import all available actions and helpers
+# A plugin can contain any number of actions and plugins
+Fastlane::VoipPushCertificate.all_classes.each do |current|
+  require current
+end

metadata

@@ -0,0 +1,50 @@
+--- !ruby/object:Gem::Specification
+name: fastlane-plugin-voip_push_certificate
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Rafael Ferreira
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-25 00:00:00.000000000 Z
+dependencies: []
+description:
+email: rafinha951026@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/fastlane/plugin/voip_push_certificate.rb
+- lib/fastlane/plugin/voip_push_certificate/actions/get_voip_push_certificate_action.rb
+- lib/fastlane/plugin/voip_push_certificate/helper/voip_push_certificate_helper.rb
+- lib/fastlane/plugin/voip_push_certificate/version.rb
+homepage: https://github.com/Rafinha-rf/fastlane-plugin-voip_push_certificate
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Create and renew Apple VoIP Services push certificates
+test_files: []