fastlane-security-patched 2.216.0

data/match/lib/match/commands_generator.rb

@@ -0,0 +1,189 @@
+require 'commander'
+
+require 'fastlane_core/configuration/configuration'
+require 'fastlane_core/ui/help_formatter'
+
+require_relative 'nuke'
+require_relative 'change_password'
+require_relative 'setup'
+require_relative 'runner'
+require_relative 'options'
+require_relative 'migrate'
+require_relative 'importer'
+
+require_relative 'storage'
+require_relative 'encryption'
+
+require_relative 'module'
+
+HighLine.track_eof = false
+
+module Match
+  class CommandsGenerator
+    include Commander::Methods
+
+    def self.start
+      self.new.run
+    end
+
+    def run
+      program :name, 'match'
+      program :version, Fastlane::VERSION
+      program :description, Match::DESCRIPTION
+      program :help, 'Author', 'Felix Krause <match@krausefx.com>'
+      program :help, 'Website', 'https://fastlane.tools'
+      program :help, 'Documentation', 'https://docs.fastlane.tools/actions/match/'
+      program :help_formatter, FastlaneCore::HelpFormatter
+
+      global_option('--verbose') { FastlaneCore::Globals.verbose = true }
+      global_option('--env STRING[,STRING2]', String, 'Add environment(s) to use with `dotenv`')
+
+      command :run do |c|
+        c.syntax = 'fastlane match'
+        c.description = Match::DESCRIPTION
+
+        FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+        c.action do |args, options|
+          if args.count > 0
+            FastlaneCore::UI.user_error!("Please run `fastlane match [type]`, allowed values: development, adhoc, enterprise  or appstore")
+          end
+
+          params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+          params.load_configuration_file("Matchfile")
+          Match::Runner.new.run(params)
+        end
+      end
+
+      Match.environments.each do |type|
+        command type do |c|
+          c.syntax = "fastlane match #{type}"
+          c.description = "Run match for a #{type} provisioning profile"
+
+          FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+          c.action do |args, options|
+            params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+            params.load_configuration_file("Matchfile") # this has to be done *before* overwriting the value
+            params[:type] = type.to_s
+            Match::Runner.new.run(params)
+          end
+        end
+      end
+
+      command :init do |c|
+        c.syntax = 'fastlane match init'
+        c.description = 'Create the Matchfile for you'
+        c.action do |args, options|
+          containing = FastlaneCore::Helper.fastlane_enabled_folder_path
+          is_swift_fastfile = args.include?("swift")
+
+          if is_swift_fastfile
+            path = File.join(containing, "Matchfile.swift")
+          else
+            path = File.join(containing, "Matchfile")
+          end
+
+          if File.exist?(path)
+            FastlaneCore::UI.user_error!("You already have a Matchfile in this directory (#{path})")
+            return 0
+          end
+
+          Match::Setup.new.run(path, is_swift_fastfile: is_swift_fastfile)
+        end
+      end
+
+      command :change_password do |c|
+        c.syntax = 'fastlane match change_password'
+        c.description = 'Re-encrypt all files with a different password'
+
+        FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+        c.action do |args, options|
+          params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+          params.load_configuration_file("Matchfile")
+
+          Match::ChangePassword.update(params: params)
+          UI.success("Successfully changed the password. Make sure to update the password on all your clients and servers by running `fastlane match [environment]`")
+        end
+      end
+
+      command :decrypt do |c|
+        c.syntax = "fastlane match decrypt"
+        c.description = "Decrypts the repository and keeps it on the filesystem"
+
+        FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+        c.action do |args, options|
+          params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+          params.load_configuration_file("Matchfile")
+
+          storage = Storage.from_params(params)
+          storage.download
+
+          encryption = Encryption.for_storage_mode(params[:storage_mode], {
+            git_url: params[:git_url],
+            s3_bucket: params[:s3_bucket],
+            s3_skip_encryption: params[:s3_skip_encryption],
+            working_directory: storage.working_directory
+          })
+          encryption.decrypt_files if encryption
+          UI.success("Repo is at: '#{storage.working_directory}'")
+        end
+      end
+
+      command :import do |c|
+        c.syntax = "fastlane match import"
+        c.description = "Imports certificates and profiles into the encrypted repository"
+
+        FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+        c.action do |args, options|
+          params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+          params.load_configuration_file("Matchfile") # this has to be done *before* overwriting the value
+          Match::Importer.new.import_cert(params)
+        end
+      end
+
+      command :migrate do |c|
+        c.syntax = "fastlane match migrate"
+        c.description = "Migrate from one storage backend to another one"
+
+        FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+        c.action do |args, options|
+          params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+          Match::Migrate.new.migrate(params)
+        end
+      end
+
+      command "nuke" do |c|
+        # We have this empty command here, since otherwise the normal `match` command will be executed
+        c.syntax = "fastlane match nuke"
+        c.description = "Delete all certificates and provisioning profiles from the Apple Dev Portal"
+        c.action do |args, options|
+          FastlaneCore::UI.user_error!("Please run `fastlane match nuke [type], allowed values: development, distribution and enterprise. For the 'adhoc' type, please use 'distribution' instead.")
+        end
+      end
+
+      ["development", "distribution", "enterprise"].each do |type|
+        command "nuke #{type}" do |c|
+          c.syntax = "fastlane match nuke #{type}"
+          c.description = "Delete all certificates and provisioning profiles from the Apple Dev Portal of the type #{type}"
+
+          FastlaneCore::CommanderGenerator.new.generate(Match::Options.available_options, command: c)
+
+          c.action do |args, options|
+            params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+            params.load_configuration_file("Matchfile")
+            Match::Nuke.new.run(params, type: type.to_s)
+          end
+        end
+      end
+
+      default_command(:run)
+
+      run!
+    end
+  end
+end

data/match/lib/match/encryption/interface.rb

@@ -0,0 +1,17 @@
+module Match
+  module Encryption
+    class Interface
+      # Call this method to trigger the actual
+      # encryption
+      def encrypt_files(password: nil)
+        not_implemented(__method__)
+      end
+
+      # Call this method to trigger the actual
+      # decryption
+      def decrypt_files
+        not_implemented(__method__)
+      end
+    end
+  end
+end

data/match/lib/match/encryption/openssl.rb

@@ -0,0 +1,163 @@
+require 'base64'
+require 'openssl'
+require 'securerandom'
+require 'security'
+require 'shellwords'
+
+require_relative '../change_password'
+require_relative '../module'
+
+module Match
+  module Encryption
+    class OpenSSL < Interface
+      attr_accessor :keychain_name
+
+      attr_accessor :working_directory
+
+      def self.configure(params)
+        return self.new(
+          keychain_name: params[:keychain_name],
+          working_directory: params[:working_directory]
+        )
+      end
+
+      # @param keychain_name: The identifier used to store the passphrase in the Keychain
+      # @param working_directory: The path to where the certificates are stored
+      def initialize(keychain_name: nil, working_directory: nil)
+        self.keychain_name = keychain_name
+        self.working_directory = working_directory
+      end
+
+      def encrypt_files(password: nil)
+        files = []
+        password ||= fetch_password!
+        iterate(self.working_directory) do |current|
+          files << current
+          encrypt_specific_file(path: current, password: password)
+          UI.success("🔒  Encrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔒  Successfully encrypted certificates repo")
+        return files
+      end
+
+      def decrypt_files
+        files = []
+        password = fetch_password!
+        iterate(self.working_directory) do |current|
+          files << current
+          begin
+            decrypt_specific_file(path: current, password: password)
+          rescue => ex
+            UI.verbose(ex.to_s)
+            UI.error("Couldn't decrypt the repo, please make sure you enter the right password!")
+            UI.user_error!("Invalid password passed via 'MATCH_PASSWORD'") if ENV["MATCH_PASSWORD"]
+            clear_password
+            self.decrypt_files # Call itself
+            return
+          end
+          UI.success("🔓  Decrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔓  Successfully decrypted certificates repo")
+        return files
+      end
+
+      def store_password(password)
+        Security::InternetPassword.add(server_name(self.keychain_name), "", password)
+      end
+
+      # removes the password from the keychain again
+      def clear_password
+        Security::InternetPassword.delete(server: server_name(self.keychain_name))
+      end
+
+      private
+
+      def iterate(source_path)
+        Dir[File.join(source_path, "**", "*.{cer,p12,mobileprovision,provisionprofile}")].each do |path|
+          next if File.directory?(path)
+          yield(path)
+        end
+      end
+
+      # server name used for accessing the macOS keychain
+      def server_name(keychain_name)
+        ["match", keychain_name].join("_")
+      end
+
+      # Access the MATCH_PASSWORD, either from ENV variable, Keychain or user input
+      def fetch_password!
+        password = ENV["MATCH_PASSWORD"]
+        unless password
+          item = Security::InternetPassword.find(server: server_name(self.keychain_name))
+          password = item.password if item
+        end
+
+        unless password
+          if !UI.interactive?
+            UI.error("Neither the MATCH_PASSWORD environment variable nor the local keychain contained a password.")
+            UI.error("Bailing out instead of asking for a password, since this is non-interactive mode.")
+            UI.user_error!("Try setting the MATCH_PASSWORD environment variable, or temporarily enable interactive mode to store a password.")
+          else
+            UI.important("Enter the passphrase that should be used to encrypt/decrypt your certificates")
+            UI.important("This passphrase is specific per repository and will be stored in your local keychain")
+            UI.important("Make sure to remember the password, as you'll need it when you run match on a different machine")
+            password = FastlaneCore::Helper.ask_password(message: "Passphrase for Match storage: ", confirm: true)
+            store_password(password)
+          end
+        end
+
+        return password
+      end
+
+      # We encrypt with MD5 because that was the most common default value in older fastlane versions which used the local OpenSSL installation
+      # A more secure key and IV generation is needed in the future
+      # IV should be randomly generated and provided unencrypted
+      # salt should be randomly generated and provided unencrypted (like in the current implementation)
+      # key should be generated with OpenSSL::KDF::pbkdf2_hmac with properly chosen parameters
+      # Short explanation about salt and IV: https://stackoverflow.com/a/1950674/6324550
+      def encrypt_specific_file(path: nil, password: nil)
+        UI.user_error!("No password supplied") if password.to_s.strip.length == 0
+
+        data_to_encrypt = File.binread(path)
+        salt = SecureRandom.random_bytes(8)
+
+        # The :: is important, as there is a name clash
+        cipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        cipher.encrypt
+        cipher.pkcs5_keyivgen(password, salt, 1, "MD5")
+        encrypted_data = "Salted__" + salt + cipher.update(data_to_encrypt) + cipher.final
+
+        File.write(path, Base64.encode64(encrypted_data))
+      rescue FastlaneCore::Interface::FastlaneError
+        raise
+      rescue => error
+        UI.error(error.to_s)
+        UI.crash!("Error encrypting '#{path}'")
+      end
+
+      # The encryption parameters in this implementations reflect the old behavior which depended on the users' local OpenSSL version
+      # 1.0.x OpenSSL and earlier versions use MD5, 1.1.0c and newer uses SHA256, we try both before giving an error
+      def decrypt_specific_file(path: nil, password: nil, hash_algorithm: "MD5")
+        stored_data = Base64.decode64(File.read(path))
+        salt = stored_data[8..15]
+        data_to_decrypt = stored_data[16..-1]
+
+        decipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        decipher.decrypt
+        decipher.pkcs5_keyivgen(password, salt, 1, hash_algorithm)
+
+        decrypted_data = decipher.update(data_to_decrypt) + decipher.final
+
+        File.binwrite(path, decrypted_data)
+      rescue => error
+        fallback_hash_algorithm = "SHA256"
+        if hash_algorithm != fallback_hash_algorithm
+          decrypt_specific_file(path: path, password: password, hash_algorithm: fallback_hash_algorithm)
+        else
+          UI.error(error.to_s)
+          UI.crash!("Error decrypting '#{path}'")
+        end
+      end
+    end
+  end
+end

data/match/lib/match/encryption.rb

@@ -0,0 +1,52 @@
+require_relative 'encryption/interface'
+require_relative 'encryption/openssl'
+
+module Match
+  module Encryption
+    class << self
+      def backends
+        @backends ||= {
+          "git" => lambda { |params|
+            # OpenSSL is storage agnostic so this maps git_url
+            # to keychain_name for the name of the keychain entry
+            params[:keychain_name] = params[:git_url]
+            return Encryption::OpenSSL.configure(params)
+          },
+          "google_cloud" => lambda { |params|
+            return nil
+          },
+          "s3" => lambda { |params|
+            params[:keychain_name] = params[:s3_bucket]
+            return params[:s3_skip_encryption] ? nil : Encryption::OpenSSL.configure(params)
+          },
+          "gitlab_secure_files" => lambda { |params|
+            return nil
+          }
+        }
+      end
+
+      def register_backend(type: nil, encryption_class: nil, &configurator)
+        UI.user_error!("No type specified for encryption backend") if type.nil?
+
+        normalized_name = type.to_s
+        UI.message("Replacing Match::Encryption backend for type '#{normalized_name}'") if backends.include?(normalized_name)
+
+        if configurator
+          @backends[normalized_name] = configurator
+        elsif encryption_class
+          @backends[normalized_name] = ->(params) { return encryption_class.configure(params) }
+        else
+          UI.user_error!("Specify either a `encryption_class` or a configuration block when registering a encryption backend")
+        end
+      end
+
+      # Returns the class to be used for a given `storage_mode`
+      def for_storage_mode(storage_mode, params)
+        configurator = backends[storage_mode.to_s]
+        return configurator.call(params) if configurator
+
+        UI.user_error!("No encryption backend for storage mode '#{storage_mode}'")
+      end
+    end
+  end
+end

data/match/lib/match/generator.rb

@@ -0,0 +1,124 @@
+require_relative 'module'
+
+module Match
+  # Generate missing resources
+  class Generator
+    def self.generate_certificate(params, cert_type, working_directory, specific_cert_type: nil)
+      require 'cert/runner'
+      require 'cert/options'
+
+      output_path = File.join(working_directory, "certs", cert_type.to_s)
+
+      # Mapping match option to cert option for "Developer ID Application"
+      if cert_type.to_sym == :developer_id_application
+        specific_cert_type = cert_type.to_s
+      end
+
+      platform = params[:platform]
+      if platform.to_s == :catalyst.to_s
+        platform = :macos.to_s
+      end
+
+      arguments = FastlaneCore::Configuration.create(Cert::Options.available_options, {
+        platform: platform,
+        development: params[:type] == "development",
+        type: specific_cert_type,
+        generate_apple_certs: params[:generate_apple_certs],
+        output_path: output_path,
+        force: true, # we don't need a certificate without its private key, we only care about a new certificate
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key],
+        username: params[:username],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        keychain_path: FastlaneCore::Helper.keychain_path(params[:keychain_name]),
+        keychain_password: params[:keychain_password],
+        skip_set_partition_list: params[:skip_set_partition_list]
+      })
+
+      Cert.config = arguments
+
+      begin
+        cert_path = Cert::Runner.new.launch
+      rescue => ex
+        if ex.to_s.include?("You already have a current")
+          UI.user_error!("Could not create a new certificate as you reached the maximum number of certificates for this account. You can use the `fastlane match nuke` command to revoke your existing certificates. More information https://docs.fastlane.tools/actions/match/")
+        else
+          raise ex
+        end
+      end
+
+      # We don't care about the signing request
+      Dir[File.join(working_directory, "**", "*.certSigningRequest")].each { |path| File.delete(path) }
+
+      # we need to return the path
+      # Inside this directory, there is the `.p12` file and the `.cer` file with the same name, but different extension
+      return cert_path
+    end
+
+    # @return (String) The UUID of the newly generated profile
+    def self.generate_provisioning_profile(params: nil, prov_type: nil, certificate_id: nil, app_identifier: nil, force: true, working_directory: nil)
+      require 'sigh/manager'
+      require 'sigh/options'
+
+      prov_type = Match.profile_type_sym(params[:type])
+
+      names = ["match", profile_type_name(prov_type), app_identifier]
+
+      if params[:platform].to_s != :ios.to_s # For ios we do not include the platform for backwards compatibility
+        names << params[:platform]
+      end
+
+      if params[:profile_name].to_s.empty?
+        profile_name = names.join(" ")
+      else
+        profile_name = params[:profile_name]
+      end
+
+      values = {
+        app_identifier: app_identifier,
+        output_path: File.join(working_directory, "profiles", prov_type.to_s),
+        username: params[:username],
+        force: force,
+        cert_id: certificate_id,
+        provisioning_name: profile_name,
+        ignore_profiles_with_different_name: true,
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        template_name: params[:template_name],
+        fail_on_name_taken: params[:fail_on_name_taken],
+        include_all_certificates: params[:include_all_certificates],
+        include_mac_in_profiles: params[:include_mac_in_profiles],
+      }
+
+      values[:platform] = params[:platform]
+
+      # These options are all conflicting so can only set one
+      if params[:type] == "developer_id"
+        values[:developer_id] = true
+      elsif prov_type == :adhoc
+        values[:adhoc] = true
+      elsif prov_type == :development
+        values[:development] = true
+      end
+
+      arguments = FastlaneCore::Configuration.create(Sigh::Options.available_options, values)
+
+      Sigh.config = arguments
+      path = Sigh::Manager.start
+      return path
+    end
+
+    # @return the name of the provisioning profile type
+    def self.profile_type_name(type)
+      return "Direct" if type == :developer_id
+      return "Development" if type == :development
+      return "AdHoc" if type == :adhoc
+      return "AppStore" if type == :appstore
+      return "InHouse" if type == :enterprise
+      return "Unknown"
+    end
+  end
+end

data/match/lib/match/importer.rb

@@ -0,0 +1,138 @@
+require_relative 'spaceship_ensure'
+require_relative 'encryption'
+require_relative 'storage'
+require_relative 'module'
+require_relative 'generator'
+require 'fastlane_core/provisioning_profile'
+require 'fileutils'
+
+module Match
+  class Importer
+    def import_cert(params, cert_path: nil, p12_path: nil, profile_path: nil)
+      # Get and verify cert, p12 and profiles path
+      cert_path = ensure_valid_file_path(cert_path, "Certificate", ".cer")
+      p12_path = ensure_valid_file_path(p12_path, "Private key", ".p12")
+      profile_path = ensure_valid_file_path(profile_path, "Provisioning profile", ".mobileprovision or .provisionprofile", optional: true)
+
+      # Storage
+      storage = Storage.from_params(params)
+      storage.download
+
+      # Encryption
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        s3_bucket: params[:s3_bucket],
+        s3_skip_encryption: params[:s3_skip_encryption],
+        working_directory: storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+      UI.success("Repo is at: '#{storage.working_directory}'")
+
+      # Map match type into Spaceship::ConnectAPI::Certificate::CertificateType
+      cert_type = Match.cert_type_sym(params[:type])
+
+      case cert_type
+      when :development
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT
+        ].join(',')
+      when :distribution, :enterprise
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DISTRIBUTION
+        ].join(',')
+      when :developer_id_application
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_APPLICATION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_APPLICATION_G2
+        ].join(',')
+      when :mac_installer_distribution
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_INSTALLER_DISTRIBUTION
+        ].join(',')
+      when :developer_id_installer
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_INSTALLER
+        ].join(',')
+      else
+        UI.user_error!("Cert type '#{cert_type}' is not supported")
+      end
+
+      prov_type = Match.profile_type_sym(params[:type])
+      output_dir_certs = File.join(storage.prefixed_working_directory, "certs", cert_type.to_s)
+      output_dir_profiles = File.join(storage.prefixed_working_directory, "profiles", prov_type.to_s)
+
+      should_skip_certificate_matching = params[:skip_certificate_matching]
+      # In case there is no access to Apple Developer portal but we have the certificates, keys and profiles
+      if should_skip_certificate_matching
+        cert_name = File.basename(cert_path, ".*")
+        p12_name = File.basename(p12_path, ".*")
+
+        # Make dir if doesn't exist
+        FileUtils.mkdir_p(output_dir_certs)
+        dest_cert_path = File.join(output_dir_certs, "#{cert_name}.cer")
+        dest_p12_path = File.join(output_dir_certs, "#{p12_name}.p12")
+      else
+        if (api_token = Spaceship::ConnectAPI::Token.from(hash: params[:api_key], filepath: params[:api_key_path]))
+          UI.message("Creating authorization token for App Store Connect API")
+          Spaceship::ConnectAPI.token = api_token
+        elsif !Spaceship::ConnectAPI.token.nil?
+          UI.message("Using existing authorization token for App Store Connect API")
+        else
+          UI.message("Login to App Store Connect (#{params[:username]})")
+          Spaceship::ConnectAPI.login(params[:username], use_portal: true, use_tunes: false, portal_team_id: params[:team_id], team_name: params[:team_name])
+        end
+
+        # Need to get the cert id by comparing base64 encoded cert content with certificate content from the API responses
+        certs = Spaceship::ConnectAPI::Certificate.all(filter: { certificateType: certificate_type })
+
+        # Base64 encode contents to find match from API to find a cert ID
+        cert_contents_base_64 = Base64.strict_encode64(File.binread(cert_path))
+        matching_cert = certs.find do |cert|
+          cert.certificate_content == cert_contents_base_64
+        end
+
+        UI.user_error!("This certificate cannot be imported - the certificate contents did not match with any available on the Developer Portal") if matching_cert.nil?
+
+        # Make dir if doesn't exist
+        FileUtils.mkdir_p(output_dir_certs)
+        dest_cert_path = File.join(output_dir_certs, "#{matching_cert.id}.cer")
+        dest_p12_path = File.join(output_dir_certs, "#{matching_cert.id}.p12")
+      end
+
+      files_to_commit = [dest_cert_path, dest_p12_path]
+
+      # Copy files
+      IO.copy_stream(cert_path, dest_cert_path)
+      IO.copy_stream(p12_path, dest_p12_path)
+      unless profile_path.nil?
+        FileUtils.mkdir_p(output_dir_profiles)
+        bundle_id = FastlaneCore::ProvisioningProfile.bundle_id(profile_path)
+        profile_extension = FastlaneCore::ProvisioningProfile.profile_extension(profile_path)
+        profile_type_name = Match::Generator.profile_type_name(prov_type)
+        dest_profile_path = File.join(output_dir_profiles, "#{profile_type_name}_#{bundle_id}#{profile_extension}")
+        files_to_commit.push(dest_profile_path)
+        IO.copy_stream(profile_path, dest_profile_path)
+      end
+
+      # Encrypt and commit
+      encryption.encrypt_files if encryption
+      storage.save_changes!(files_to_commit: files_to_commit)
+    ensure
+      storage.clear_changes if storage
+    end
+
+    def ensure_valid_file_path(file_path, file_description, file_extension, optional: false)
+      optional_file_message = optional ? " or leave empty to skip this file" : ""
+      file_path ||= UI.input("#{file_description} (#{file_extension}) path#{optional_file_message}:")
+
+      file_path = File.absolute_path(file_path) unless file_path == ""
+      file_path = File.exist?(file_path) ? file_path : nil
+      UI.user_error!("#{file_description} does not exist at path: #{file_path}") unless !file_path.nil? || optional
+      file_path
+    end
+  end
+end