fastlane-security-patched 2.216.0

data/match/lib/match/migrate.rb

@@ -0,0 +1,113 @@
+require_relative 'spaceship_ensure'
+require_relative 'encryption'
+require_relative 'storage'
+require_relative 'module'
+require 'fileutils'
+
+module Match
+  class Migrate
+    def migrate(params)
+      loaded_matchfile = params.load_configuration_file("Matchfile")
+
+      ensure_parameters_are_valid(params)
+
+      # We init the Google storage client before the git client
+      # to ask for all the missing inputs *before* cloning the git repo
+      google_cloud_storage = Storage.from_params({
+        storage_mode: "google_cloud",
+        google_cloud_bucket_name: params[:google_cloud_bucket_name],
+        google_cloud_keys_file: params[:google_cloud_keys_file],
+        google_cloud_project_id: params[:google_cloud_project_id]
+      })
+
+      git_storage = Storage.from_params({
+        storage_mode: "git",
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        git_branch: params[:git_branch],
+        clone_branch_directly: params[:clone_branch_directly]
+      })
+      git_storage.download
+
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        s3_bucket: params[:s3_bucket],
+        s3_skip_encryption: params[:s3_skip_encryption],
+        working_directory: git_storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+      UI.success("Decrypted the git repo to '#{git_storage.working_directory}'")
+
+      google_cloud_storage.download
+
+      # Note how we always prefix the path in Google Cloud with the Team ID
+      # while on Git we recommend using the git branch instead. As there is
+      # no concept of branches in Google Cloud Storage (omg thanks), we use
+      # the team id properly
+      spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name], api_token(params))
+      team_id = spaceship.team_id
+
+      if team_id.to_s.empty?
+        UI.user_error!("The `team_id` option is required. fastlane cannot automatically determine portal team id via the App Store Connect API (yet)")
+      else
+        UI.message("Detected team ID '#{team_id}' to use for Google Cloud Storage...")
+      end
+
+      files_to_commit = []
+      Dir.chdir(git_storage.working_directory) do
+        Dir[File.join("**", "*")].each do |current_file|
+          next if File.directory?(current_file)
+
+          to_path = File.join(google_cloud_storage.working_directory, team_id, current_file)
+          FileUtils.mkdir_p(File.expand_path("..", to_path))
+
+          if File.exist?(to_path)
+            UI.user_error!("Looks like file already exists on Google Cloud Storage at path '#{to_path}', stopping the migration process. Please make sure the bucket is empty, or at least doesn't contain any files related to the same Team ID")
+          end
+          FileUtils.cp(current_file, to_path)
+
+          files_to_commit << to_path
+        end
+      end
+
+      google_cloud_storage.save_changes!(files_to_commit: files_to_commit)
+
+      UI.success("Successfully migrated your code signing certificates and provisioning profiles to Google Cloud Storage")
+      UI.success("Make sure to update your configuration to specify the `storage_mode`, as well as the bucket to use.")
+      UI.message("")
+      if loaded_matchfile
+        UI.message("Update your Matchfile at path '#{loaded_matchfile.configfile_path}':")
+        UI.message("")
+        UI.command_output("\t\tstorage_mode \"google_cloud\"")
+        UI.command_output("\t\tgoogle_cloud_bucket_name \"#{google_cloud_storage.bucket_name}\"")
+      else
+        UI.message("Update your Fastfile `match` call to include")
+        UI.message("")
+        UI.command_output("\t\tstorage_mode: \"google_cloud\",")
+        UI.command_output("\t\tgoogle_cloud_bucket_name: \"#{google_cloud_storage.bucket_name}\",")
+      end
+      UI.message("")
+      UI.success("You can also remove the `git_url`, as well as any other git related configurations from your Fastfile and Matchfile")
+      UI.message("")
+      UI.input("Please make sure to read the above and confirm with enter")
+    ensure
+      google_cloud_storage.clear_changes if google_cloud_storage
+      git_storage.clear_changes if git_storage
+    end
+
+    def api_token(params)
+      api_token = Spaceship::ConnectAPI::Token.from(hash: params[:api_key], filepath: params[:api_key_path])
+      return api_token
+    end
+
+    def ensure_parameters_are_valid(params)
+      if params[:readonly]
+        UI.user_error!("`fastlane match migrate` doesn't work in `readonly` mode")
+      end
+
+      if params[:storage_mode] != "git"
+        UI.user_error!("`fastlane match migrate` only allows migration from `git` to `google_cloud` right now, looks like your currently selected `storage_mode` is '#{params[:storage_mode]}'")
+      end
+    end
+  end
+end

data/match/lib/match/module.rb

@@ -0,0 +1,85 @@
+require 'spaceship'
+
+require 'fastlane_core/helper'
+require 'fastlane/boolean'
+
+module Match
+  Helper = FastlaneCore::Helper # you gotta love Ruby: Helper.* should use the Helper class contained in FastlaneCore
+  UI = FastlaneCore::UI
+  Boolean = Fastlane::Boolean
+  ROOT = Pathname.new(File.expand_path('../../..', __FILE__))
+  DESCRIPTION = "Easily sync your certificates and profiles across your team"
+
+  def self.environments
+    return %w(appstore adhoc development enterprise developer_id mac_installer_distribution developer_id_installer)
+  end
+
+  def self.storage_modes
+    return %w(git google_cloud s3 gitlab_secure_files)
+  end
+
+  def self.profile_type_sym(type)
+    return type.to_sym
+  end
+
+  def self.cert_type_sym(type)
+    type = type.to_s
+    return :mac_installer_distribution if type == "mac_installer_distribution"
+    return :developer_id_installer if type == "developer_id_installer"
+    return :developer_id_application if type == "developer_id"
+    return :enterprise if type == "enterprise"
+    return :development if type == "development"
+    return :distribution if ["adhoc", "appstore", "distribution"].include?(type)
+    raise "Unknown cert type: '#{type}'"
+  end
+
+  # Converts provisioning profile type (i.e. development, enterprise) to an array of profile types
+  # That can be used for filtering when using Spaceship::ConnectAPI::Profile API
+  def self.profile_types(prov_type)
+    case prov_type.to_sym
+    when :appstore
+      return [
+        Spaceship::ConnectAPI::Profile::ProfileType::IOS_APP_STORE,
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_APP_STORE,
+        Spaceship::ConnectAPI::Profile::ProfileType::TVOS_APP_STORE,
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_CATALYST_APP_STORE
+      ]
+    when :development
+      return [
+        Spaceship::ConnectAPI::Profile::ProfileType::IOS_APP_DEVELOPMENT,
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_APP_DEVELOPMENT,
+        Spaceship::ConnectAPI::Profile::ProfileType::TVOS_APP_DEVELOPMENT,
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_CATALYST_APP_DEVELOPMENT
+      ]
+    when :enterprise
+      profiles = [
+        Spaceship::ConnectAPI::Profile::ProfileType::IOS_APP_INHOUSE,
+        Spaceship::ConnectAPI::Profile::ProfileType::TVOS_APP_INHOUSE
+      ]
+
+      # As of 2022-06-25, only available with Apple ID auth
+      if Spaceship::ConnectAPI.token
+        UI.important("Skipping #{Spaceship::ConnectAPI::Profile::ProfileType::MAC_APP_INHOUSE} and #{Spaceship::ConnectAPI::Profile::ProfileType::MAC_CATALYST_APP_INHOUSE}... only available with Apple ID auth")
+      else
+        profiles += [
+          Spaceship::ConnectAPI::Profile::ProfileType::MAC_APP_INHOUSE,
+          Spaceship::ConnectAPI::Profile::ProfileType::MAC_CATALYST_APP_INHOUSE
+        ]
+      end
+
+      return profiles
+    when :adhoc
+      return [
+        Spaceship::ConnectAPI::Profile::ProfileType::IOS_APP_ADHOC,
+        Spaceship::ConnectAPI::Profile::ProfileType::TVOS_APP_ADHOC
+      ]
+    when :developer_id
+      return [
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_APP_DIRECT,
+        Spaceship::ConnectAPI::Profile::ProfileType::MAC_CATALYST_APP_DIRECT
+      ]
+    else
+      raise "Unknown provisioning type '#{prov_type}'"
+    end
+  end
+end

data/match/lib/match/nuke.rb

@@ -0,0 +1,400 @@
+require 'terminal-table'
+
+require 'spaceship'
+require 'fastlane_core/provisioning_profile'
+require 'fastlane_core/print_table'
+
+require_relative 'module'
+
+require_relative 'storage'
+require_relative 'encryption'
+
+require 'tempfile'
+require 'base64'
+
+module Match
+  # rubocop:disable Metrics/ClassLength
+  class Nuke
+    attr_accessor :params
+    attr_accessor :type
+
+    attr_accessor :safe_remove_certs
+    attr_accessor :certs
+    attr_accessor :profiles
+    attr_accessor :files
+
+    attr_accessor :storage
+    attr_accessor :encryption
+
+    def run(params, type: nil)
+      self.params = params
+      self.type = type
+
+      update_optional_values_depending_on_storage_type(params)
+
+      spaceship_login
+
+      self.storage = Storage.from_params(params)
+      self.storage.download
+
+      # After the download was complete
+      self.encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        s3_bucket: params[:s3_bucket],
+        s3_skip_encryption: params[:s3_skip_encryption],
+        working_directory: storage.working_directory
+      })
+      self.encryption.decrypt_files if self.encryption
+
+      had_app_identifier = self.params.fetch(:app_identifier, ask: false)
+      self.params[:app_identifier] = '' # we don't really need a value here
+      FastlaneCore::PrintTable.print_values(config: params,
+                                         hide_keys: [:app_identifier],
+                                             title: "Summary for match nuke #{Fastlane::VERSION}")
+
+      self.safe_remove_certs = params[:safe_remove_certs] || false
+
+      prepare_list
+      filter_by_cert
+      print_tables
+
+      if params[:readonly]
+        UI.user_error!("`fastlane match nuke` doesn't delete anything when running with --readonly enabled")
+      end
+
+      if (self.certs + self.profiles + self.files).count > 0
+        unless params[:skip_confirmation]
+          UI.error("---")
+          remove_or_revoke_message = self.safe_remove_certs ? "remove" : "revoke"
+          UI.error("Are you sure you want to completely delete and #{remove_or_revoke_message} all the")
+          UI.error("certificates and delete provisioning profiles listed above? (y/n)")
+          UI.error("Warning: By nuking distribution, both App Store and Ad Hoc profiles will be deleted") if type == "distribution"
+          UI.error("Warning: The :app_identifier value will be ignored - this will delete all profiles for all your apps!") if had_app_identifier
+          UI.error("---")
+          print_safe_remove_certs_hint
+        end
+        if params[:skip_confirmation] || UI.confirm("Do you really want to nuke everything listed above?")
+          nuke_it_now!
+          UI.success("Successfully cleaned your account ♻️")
+        else
+          UI.success("Cancelled nuking #thanks 🏠 👨 ‍👩 ‍👧")
+        end
+      else
+        UI.success("No relevant certificates or provisioning profiles found, nothing to nuke here :)")
+      end
+    ensure
+      self.storage.clear_changes if self.storage
+    end
+
+    # Be smart about optional values here
+    # Depending on the storage mode, different values are required
+    def update_optional_values_depending_on_storage_type(params)
+      if params[:storage_mode] != "git"
+        params.option_for_key(:git_url).optional = true
+      end
+    end
+
+    def spaceship_login
+      if (api_token = Spaceship::ConnectAPI::Token.from(hash: params[:api_key], filepath: params[:api_key_path]))
+        UI.message("Creating authorization token for App Store Connect API")
+        Spaceship::ConnectAPI.token = api_token
+      elsif !Spaceship::ConnectAPI.token.nil?
+        UI.message("Using existing authorization token for App Store Connect API")
+      else
+        Spaceship::ConnectAPI.login(params[:username], use_portal: true, use_tunes: false, portal_team_id: params[:team_id], team_name: params[:team_name])
+      end
+
+      if Spaceship::ConnectAPI.client.in_house? && (type == "distribution" || type == "enterprise")
+        UI.error("---")
+        UI.error("⚠️ Warning: This seems to be an Enterprise account!")
+        unless self.safe_remove_certs
+          UI.error("By nuking your account's distribution, all your apps deployed via ad-hoc will stop working!") if type == "distribution"
+          UI.error("By nuking your account's enterprise, all your in-house apps will stop working!") if type == "enterprise"
+        end
+        UI.error("---")
+        print_safe_remove_certs_hint
+        UI.user_error!("Enterprise account nuke cancelled") unless UI.confirm("Do you really want to nuke your Enterprise account?")
+      end
+    end
+
+    # Collect all the certs/profiles
+    def prepare_list
+      UI.message("Fetching certificates and profiles...")
+      cert_type = Match.cert_type_sym(type)
+      cert_types = [cert_type]
+
+      prov_types = []
+      prov_types = [:development] if cert_type == :development
+      prov_types = [:appstore, :adhoc, :developer_id] if cert_type == :distribution
+      prov_types = [:enterprise] if cert_type == :enterprise
+
+      # Get all iOS and macOS profile
+      self.profiles = []
+      prov_types.each do |prov_type|
+        types = Match.profile_types(prov_type)
+        self.profiles += Spaceship::ConnectAPI::Profile.all(filter: { profileType: types.join(",") }, includes: "certificates")
+      end
+
+      # Gets the main and additional cert types
+      cert_types += (params[:additional_cert_types] || []).map do |ct|
+        Match.cert_type_sym(ct)
+      end
+
+      # Gets all the certs form the cert types
+      self.certs = []
+      self.certs += cert_types.map do |ct|
+        certificate_type(ct).flat_map do |cert|
+          Spaceship::ConnectAPI::Certificate.all(filter: { certificateType: cert })
+        end
+      end.flatten
+
+      # Finds all the .cer and .p12 files in the file storage
+      certs = []
+      keys = []
+      cert_types.each do |ct|
+        certs += self.storage.list_files(file_name: ct.to_s, file_ext: "cer")
+        keys += self.storage.list_files(file_name: ct.to_s, file_ext: "p12")
+      end
+
+      # Finds all the iOS and macOS profiles in the file storage
+      profiles = []
+      prov_types.each do |prov_type|
+        profiles += self.storage.list_files(file_name: prov_type.to_s, file_ext: "mobileprovision")
+        profiles += self.storage.list_files(file_name: prov_type.to_s, file_ext: "provisionprofile")
+      end
+
+      self.files = certs + keys + profiles
+    end
+
+    def filter_by_cert
+      # Force will continue to revoke and delete all certificates and profiles
+      return if self.params[:force] || !UI.interactive?
+      return if self.certs.count < 2
+
+      # Print table showing certificates that can be revoked
+      puts("")
+      rows = self.certs.each_with_index.collect do |cert, i|
+        cert_expiration = cert.expiration_date.nil? ? "Unknown" : Time.parse(cert.expiration_date).strftime("%Y-%m-%d")
+        [i + 1, cert.name, cert.id, cert.class.to_s.split("::").last, cert_expiration]
+      end
+      puts(Terminal::Table.new({
+        title: "Certificates that can be #{removed_or_revoked_message}".green,
+        headings: ["Option", "Name", "ID", "Type", "Expires"],
+        rows: FastlaneCore::PrintTable.transform_output(rows)
+      }))
+      puts("")
+
+      UI.important("By default, all listed certificates and profiles will be nuked")
+      if UI.confirm("Do you want to only nuke specific certificates and their associated profiles?")
+        input_indexes = UI.input("Enter the \"Option\" number(s) from the table above? (comma-separated)").split(',')
+
+        # Get certificates from option indexes
+        self.certs = input_indexes.map do |index|
+          self.certs[index.to_i - 1]
+        end.compact
+
+        if self.certs.empty?
+          UI.user_error!("No certificates were selected based on option number(s) entered")
+        end
+
+        # Do profile selection logic
+        cert_ids = self.certs.map(&:id)
+        self.profiles = self.profiles.select do |profile|
+          profile_cert_ids = profile.certificates.map(&:id)
+          (cert_ids & profile_cert_ids).any?
+        end
+
+        # Do file selection logic
+        self.files = self.files.select do |f|
+          found = false
+
+          ext = File.extname(f)
+          filename = File.basename(f, ".*")
+
+          # Attempt to find cert based on filename
+          if ext == ".cer" || ext == ".p12"
+            found ||= self.certs.any? do |cert|
+              filename == cert.id.to_s
+            end
+          end
+
+          # Attempt to find profile matched on UUIDs in profile
+          if ext == ".mobileprovision" || ext == ".provisionprofile"
+            storage_uuid = FastlaneCore::ProvisioningProfile.uuid(f)
+
+            found ||= self.profiles.any? do |profile|
+              tmp_file = Tempfile.new
+              tmp_file.write(Base64.decode64(profile.profile_content))
+              tmp_file.close
+
+              # Compare profile uuid in storage to profile uuid on developer portal
+              portal_uuid = FastlaneCore::ProvisioningProfile.uuid(tmp_file.path)
+              storage_uuid == portal_uuid
+            end
+          end
+
+          found
+        end
+      end
+    end
+
+    # Print tables to ask the user
+    def print_tables
+      puts("")
+      if self.certs.count > 0
+        rows = self.certs.collect do |cert|
+          cert_expiration = cert.expiration_date.nil? ? "Unknown" : Time.parse(cert.expiration_date).strftime("%Y-%m-%d")
+          [cert.name, cert.id, cert.class.to_s.split("::").last, cert_expiration]
+        end
+        puts(Terminal::Table.new({
+          title: "Certificates that are going to be #{removed_or_revoked_message}".green,
+          headings: ["Name", "ID", "Type", "Expires"],
+          rows: FastlaneCore::PrintTable.transform_output(rows)
+        }))
+        puts("")
+      end
+
+      if self.profiles.count > 0
+        rows = self.profiles.collect do |p|
+          status = p.valid? ? p.profile_state.green : p.profile_state.red
+
+          # Expires is sometimes nil
+          expires = p.expiration_date ? Time.parse(p.expiration_date).strftime("%Y-%m-%d") : nil
+          [p.name, p.id, status, p.profile_type, expires]
+        end
+        puts(Terminal::Table.new({
+          title: "Provisioning Profiles that are going to be revoked".green,
+          headings: ["Name", "ID", "Status", "Type", "Expires"],
+          rows: FastlaneCore::PrintTable.transform_output(rows)
+        }))
+        puts("")
+      end
+
+      if self.files.count > 0
+        rows = self.files.collect do |f|
+          components = f.split(File::SEPARATOR)[-3..-1]
+
+          # from "...1o7xtmh/certs/distribution/8K38XUY3AY.cer" to "distribution cert"
+          file_type = components[0..1].reverse.join(" ")[0..-2]
+
+          [file_type, components[2]]
+        end
+
+        puts(Terminal::Table.new({
+          title: "Files that are going to be deleted".green + "\n" + self.storage.human_readable_description,
+          headings: ["Type", "File Name"],
+          rows: rows
+        }))
+        puts("")
+      end
+    end
+
+    def nuke_it_now!
+      UI.header("Deleting #{self.profiles.count} provisioning profiles...") unless self.profiles.count == 0
+      self.profiles.each do |profile|
+        UI.message("Deleting profile '#{profile.name}' (#{profile.id})...")
+        begin
+          profile.delete!
+        rescue => ex
+          UI.message(ex.to_s)
+        end
+        UI.success("Successfully deleted profile")
+      end
+
+      removing_or_revoking_message = self.safe_remove_certs ? "Removing" : "Revoking"
+      UI.header("#{removing_or_revoking_message} #{self.certs.count} certificates...") unless self.certs.count == 0
+      self.certs.each do |cert|
+        if self.safe_remove_certs
+          UI.message("Certificate '#{cert.name}' (#{cert.id}) will be removed from repository without revoking it")
+          next
+        end
+
+        UI.message("Revoking certificate '#{cert.name}' (#{cert.id})...")
+        begin
+          cert.delete!
+        rescue => ex
+          UI.message(ex.to_s)
+        end
+        UI.success("Successfully deleted certificate")
+      end
+
+      files_to_delete = delete_files! if self.files.count > 0
+      files_to_delete ||= []
+
+      self.encryption.encrypt_files if self.encryption
+
+      if files_to_delete.count > 0
+        # Now we need to save all this to the storage too, if needed
+        message = ["[fastlane]", "Nuked", "files", "for", type.to_s].join(" ")
+        self.storage.save_changes!(files_to_commit: [],
+                                   files_to_delete: files_to_delete,
+                                   custom_message: message)
+      else
+        UI.message("Your storage had no files to be deleted. This happens when you run `nuke` with an empty storage. Nothing to be worried about!")
+      end
+    end
+
+    private
+
+    def delete_files!
+      UI.header("Deleting #{self.files.count} files from the storage...")
+
+      return self.files.collect do |file|
+        UI.message("Deleting file '#{File.basename(file)}'...")
+
+        # Check if the profile is installed on the local machine
+        if file.end_with?("mobileprovision")
+          parsed = FastlaneCore::ProvisioningProfile.parse(file)
+          uuid = parsed["UUID"]
+          path = Dir[File.join(FastlaneCore::ProvisioningProfile.profiles_path, "#{uuid}.mobileprovision")].last
+          File.delete(path) if path
+        end
+
+        File.delete(file)
+        UI.success("Successfully deleted file")
+
+        file
+      end
+    end
+
+    # The kind of certificate we're interested in
+    def certificate_type(type)
+      case type.to_sym
+      when :mac_installer_distribution
+        return [
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_INSTALLER_DISTRIBUTION
+        ]
+      when :distribution
+        return [
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DISTRIBUTION
+        ]
+      when :development
+        return [
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT
+        ]
+      when :enterprise
+        return [
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION
+        ]
+      else
+        raise "Unknown type '#{type}'"
+      end
+    end
+
+    # Helpers for `safe_remove_certs`
+    def print_safe_remove_certs_hint
+      return if self.safe_remove_certs
+      UI.important("Hint: You can use --safe_remove_certs option to remove certificates")
+      UI.important("from repository without revoking them.")
+    end
+
+    def removed_or_revoked_message
+      self.safe_remove_certs ? "removed" : "revoked"
+    end
+  end
+  # rubocop:disable Metrics/ClassLength
+end