fastlane 2.238.0 → 2.240.0

data/fastlane/swift/GymfileProtocol.swift

@@ -152,6 +152,9 @@ public protocol GymfileProtocol: AnyObject {
     /// Skips resolution of Swift Package Manager dependencies
     var skipPackageDependenciesResolution: Bool { get }
 
+    /// Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually
+    var disallowXcodebuildSettingsLookup: Bool { get }
+
     /// Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild
     var disablePackageAutomaticUpdates: Bool { get }
 
@@ -369,6 +372,10 @@ public extension GymfileProtocol {
         return false
     }
 
+    var disallowXcodebuildSettingsLookup: Bool {
+        return false
+    }
+
     var disablePackageAutomaticUpdates: Bool {
         return false
     }
@@ -392,4 +399,4 @@ public extension GymfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.155]
+// FastlaneRunnerAPIVersion [0.9.157]

data/fastlane/swift/Matchfile.swift

@@ -17,4 +17,4 @@ public class Matchfile: MatchfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.238.0
+// Generated with fastlane 2.240.0

data/fastlane/swift/MatchfileProtocol.swift

@@ -413,4 +413,4 @@ public extension MatchfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.149]
+// FastlaneRunnerAPIVersion [0.9.151]

data/fastlane/swift/Precheckfile.swift

@@ -17,4 +17,4 @@ public class Precheckfile: PrecheckfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.238.0
+// Generated with fastlane 2.240.0

data/fastlane/swift/PrecheckfileProtocol.swift

@@ -84,4 +84,4 @@ public extension PrecheckfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.148]
+// FastlaneRunnerAPIVersion [0.9.150]

data/fastlane/swift/Scanfile.swift

@@ -17,4 +17,4 @@ public class Scanfile: ScanfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.238.0
+// Generated with fastlane 2.240.0

data/fastlane/swift/ScanfileProtocol.swift

@@ -230,6 +230,9 @@ public protocol ScanfileProtocol: AnyObject {
     /// Skips resolution of Swift Package Manager dependencies
     var skipPackageDependenciesResolution: Bool { get }
 
+    /// Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually
+    var disallowXcodebuildSettingsLookup: Bool { get }
+
     /// Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild
     var disablePackageAutomaticUpdates: Bool { get }
 
@@ -554,6 +557,10 @@ public extension ScanfileProtocol {
         return false
     }
 
+    var disallowXcodebuildSettingsLookup: Bool {
+        return false
+    }
+
     var disablePackageAutomaticUpdates: Bool {
         return false
     }
@@ -581,4 +588,4 @@ public extension ScanfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.160]
+// FastlaneRunnerAPIVersion [0.9.162]

data/fastlane/swift/Screengrabfile.swift

@@ -17,4 +17,4 @@ public class Screengrabfile: ScreengrabfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.238.0
+// Generated with fastlane 2.240.0

data/fastlane/swift/ScreengrabfileProtocol.swift

@@ -161,4 +161,4 @@ public extension ScreengrabfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.150]
+// FastlaneRunnerAPIVersion [0.9.152]

data/fastlane/swift/Snapshotfile.swift

@@ -17,4 +17,4 @@ public class Snapshotfile: SnapshotfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.238.0
+// Generated with fastlane 2.240.0

data/fastlane/swift/SnapshotfileProtocol.swift

@@ -125,6 +125,9 @@ public protocol SnapshotfileProtocol: AnyObject {
     /// Skips resolution of Swift Package Manager dependencies
     var skipPackageDependenciesResolution: Bool { get }
 
+    /// Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually
+    var disallowXcodebuildSettingsLookup: Bool { get }
+
     /// Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild
     var disablePackageAutomaticUpdates: Bool { get }
 
@@ -327,6 +330,10 @@ public extension SnapshotfileProtocol {
         return false
     }
 
+    var disallowXcodebuildSettingsLookup: Bool {
+        return false
+    }
+
     var disablePackageAutomaticUpdates: Bool {
         return false
     }
@@ -378,4 +385,4 @@ public extension SnapshotfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.144]
+// FastlaneRunnerAPIVersion [0.9.146]

data/fastlane_core/lib/fastlane_core/fastlane_pty.rb

@@ -30,6 +30,11 @@ module FastlaneCore
       require 'pty'
       # this forces the PTY flush - fixes #21792
       command = ENV['FASTLANE_EXEC_FLUSH_PTY_WORKAROUND'] ? "#{original_command};" : original_command
+      # The status is produced in the ensure below and read after the block. It
+      # travels in a local rather than in $?, which is a thread global: anything
+      # that runs a subprocess in between overwrites it, and nothing writes it at
+      # all when the wait does not happen. See fastlane#30188.
+      status = nil
       PTY.spawn(command) do |command_stdout, command_stdin, pid|
         begin
           yield(command_stdout, command_stdin, pid)
@@ -42,20 +47,28 @@ module FastlaneCore
           command_stdin.close
           command_stdout.close
           begin
-            Process.wait(pid)
-          rescue Errno::ECHILD, PTY::ChildExited
-            # The process might have exited.
+            _pid, status = Process.wait2(pid)
+          rescue PTY::ChildExited => e
+            # The pty saw the child go before we asked for it. The exception
+            # carries the status we were about to wait for.
+            status = e.status
+          rescue Errno::ECHILD
+            # Something else reaped it, so there is nothing left to ask for. $?
+            # may still hold it, and may just as easily hold someone else's.
           end
         end
       end
-      status = self.process_status
+      status ||= self.process_status
+      # Better a plain error than a NoMethodError raised from inside the handler
+      # that exists to report the failure, which is what nil used to produce.
+      raise StandardError, "Could not determine the exit status of the command" if status.nil?
       raise StandardError, "Process crashed" if status.signaled?
       status.exitstatus
     rescue StandardError => e
       # Wrapping any error in FastlanePtyError to allow callers to see and use
-      # $?.exitstatus that would usually get returned
-      status = self.process_status
-      raise FastlanePtyError.new(e, status.exitstatus || e.exit_status, status)
+      # the exit status that would usually get returned
+      status ||= self.process_status
+      raise FastlanePtyError.new(e, status&.exitstatus || e.exit_status, status)
     end
 
     def self.spawn_with_popen(command, &block)

data/fastlane_core/lib/fastlane_core/ipa_file_analyser.rb

@@ -55,7 +55,7 @@ module FastlaneCore
     end
 
     def self.fetch_info_plist_with_rubyzip(path)
-      Zip::File.open(path, "rb") do |zipfile|
+      Zip::File.open(path) do |zipfile|
         file = zipfile.glob('**/Payload/*.app/Info.plist').first
         return nil unless file
         zipfile.read(file)

data/fastlane_core/lib/fastlane_core/itunes_transporter.rb

@@ -35,7 +35,7 @@ module FastlaneCore
 
     private_constant :ERROR_REGEX, :WARNING_REGEX, :OUTPUT_REGEX, :RETURN_VALUE_REGEX, :SKIP_ERRORS
 
-    def build_download_command(username, password, apple_id, destination = "/tmp", provider_short_name = "", jwt = nil)
+    def build_download_command(username, password, apple_id, destination = Dir.tmpdir, provider_short_name = "", jwt = nil)
       not_implemented(__method__)
     end
 
@@ -43,11 +43,11 @@ module FastlaneCore
       not_implemented(__method__)
     end
 
-    def build_upload_command(username, password, source = "/tmp", options = {})
+    def build_upload_command(username, password, source = Dir.tmpdir, options = {})
       not_implemented(__method__)
     end
 
-    def build_verify_command(username, password, source = "/tmp", provider_short_name = "", **kwargs)
+    def build_verify_command(username, password, source = Dir.tmpdir, provider_short_name = "", **kwargs)
       not_implemented(__method__)
     end
 
@@ -291,6 +291,7 @@ module FastlaneCore
 
       @errors << "The call to the altool completed with a non-zero exit status: #{exit_status}. This indicates a failure." unless exit_status.zero?
       @errors << "-1 indicates altool exited abnormally; try retrying (see https://github.com/fastlane/fastlane/issues/21535)" if exit_status == -1
+      @errors.clear if @all_lines.any? { |line| line.include?("UPLOAD SUCCEEDED with no errors") }
 
       unless @errors.empty? || @all_lines.empty?
         @all_lines.each do |line|
@@ -319,7 +320,7 @@ module FastlaneCore
       end
     end
 
-    def build_upload_command(username, password, source = "/tmp", options = {})
+    def build_upload_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       provider_public_id = options.fetch(:provider_public_id, "")
       jwt = options[:jwt]
@@ -351,11 +352,11 @@ module FastlaneCore
       ].compact.join(' ')
     end
 
-    def build_download_command(username, password, apple_id, destination = "/tmp", provider_short_name = "", jwt = nil)
+    def build_download_command(username, password, apple_id, destination = Dir.tmpdir, provider_short_name = "", jwt = nil)
       raise "This feature has not been implemented yet with altool for Xcode 14"
     end
 
-    def build_verify_command(username, password, source = "/tmp", options = {})
+    def build_verify_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       provider_public_id = options.fetch(:provider_public_id, "")
       api_key = options[:api_key]
@@ -442,7 +443,7 @@ module FastlaneCore
       end
     end
 
-    def build_upload_command(username, password, source = "/tmp", options = {})
+    def build_upload_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       jwt = options[:jwt]
       api_key = options[:api_key]
@@ -458,7 +459,7 @@ module FastlaneCore
       ].compact.join(' ')
     end
 
-    def build_download_command(username, password, apple_id, destination = "/tmp", provider_short_name = "", jwt = nil)
+    def build_download_command(username, password, apple_id, destination = Dir.tmpdir, provider_short_name = "", jwt = nil)
       [
         '"' + Helper.transporter_path + '"',
         "-m lookupMetadata",
@@ -477,7 +478,7 @@ module FastlaneCore
       ].compact.join(' ')
     end
 
-    def build_verify_command(username, password, source = "/tmp", options = {})
+    def build_verify_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       jwt = options[:jwt]
       [
@@ -568,7 +569,7 @@ module FastlaneCore
       end
     end
 
-    def build_upload_command(username, password, source = "/tmp", options = {})
+    def build_upload_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       jwt = options[:jwt]
       api_key = options[:api_key]
@@ -607,7 +608,7 @@ module FastlaneCore
       end
     end
 
-    def build_verify_command(username, password, source = "/tmp", options = {})
+    def build_verify_command(username, password, source = Dir.tmpdir, options = {})
       provider_short_name = options.fetch(:provider_short_name, "")
       jwt = options[:jwt]
       credential_params = build_credential_params(username, password, jwt, nil, is_default_itms_on_xcode_11?)
@@ -641,7 +642,7 @@ module FastlaneCore
       end
     end
 
-    def build_download_command(username, password, apple_id, destination = "/tmp", provider_short_name = "", jwt = nil)
+    def build_download_command(username, password, apple_id, destination = Dir.tmpdir, provider_short_name = "", jwt = nil)
       credential_params = build_credential_params(username, password, jwt, nil, is_default_itms_on_xcode_11?)
       if is_default_itms_on_xcode_11?
         [
@@ -793,7 +794,9 @@ module FastlaneCore
     # @raise [Deliver::TransporterTransferError] when something went wrong
     #   when transferring
     def download(app_id, dir = nil)
-      dir ||= "/tmp"
+      # Dir.tmpdir, not a literal "/tmp": the transporter chdirs into this
+      # directory, and "/tmp" is not one on Windows. See fastlane#30184.
+      dir ||= Dir.tmpdir
 
       password_placeholder = @jwt.nil? ? 'YourPassword' : nil
       jwt_placeholder = @jwt.nil? ? nil : 'YourJWT'

data/fastlane_core/lib/fastlane_core/project.rb

@@ -412,6 +412,16 @@ module FastlaneCore
     # @param [String] The key of which we want the value for (e.g. "PRODUCT_NAME")
     def build_settings(key: nil, optional: true)
       unless @build_settings
+        if (disallowed_by = xcodebuild_settings_lookup_disallowed_by)
+          message = "Could not read the '#{key}' build setting: fetching build settings by running" \
+            " `xcodebuild -showBuildSettings` is disallowed by #{disallowed_by}."
+          trigger = caller.find { |frame| !frame.start_with?(__FILE__) }
+          message += "\nThe build setting lookup was triggered by: #{trigger}" if trigger
+          message += "\nTo fix this, manually specify the option whose automatic detection required the '#{key}' build setting," \
+            " or disable #{disallowed_by} to allow fastlane to fetch it automatically."
+          UI.user_error!(message)
+        end
+
         if is_workspace
           if schemes.count == 0
             UI.user_error!("Could not find any schemes for Xcode workspace at path '#{self.path}'. Please make sure that the schemes you want to use are marked as `Shared` from Xcode.")
@@ -563,5 +573,14 @@ module FastlaneCore
     def automated_scheme_selection?
       FastlaneCore::Env.truthy?("AUTOMATED_SCHEME_SELECTION")
     end
+
+    # Returns a description of what disallowed fetching build settings via the
+    # (potentially slow on large projects) `xcodebuild -showBuildSettings` command,
+    # or nil if the lookup is allowed
+    def xcodebuild_settings_lookup_disallowed_by
+      return "the FASTLANE_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP environment variable" if FastlaneCore::Env.truthy?("FASTLANE_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP")
+      return "the `disallow_xcodebuild_settings_lookup` option" if options[:disallow_xcodebuild_settings_lookup]
+      nil
+    end
   end
 end

data/gym/lib/gym/options.rb

@@ -321,6 +321,11 @@ module Gym
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "GYM_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "GYM_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",

data/match/lib/match/nuke.rb

@@ -341,9 +341,9 @@ module Match
     def filter_profiles_and_files_by_selected_certificates
       # Do profile selection logic
       cert_ids = self.certs.map { |cert| cert.id.to_s }
-      self.profiles = self.profiles.reject do |profile|
+      self.profiles = self.profiles.select do |profile|
         profile_cert_ids = profile.certificates.map { |cert| cert.id.to_s }
-        (cert_ids & profile_cert_ids).empty?
+        cert_ids.intersect?(profile_cert_ids)
       end
 
       profile_uuids = self.profiles.map do |profile|

data/match/lib/match/storage/git_storage.rb

@@ -117,13 +117,10 @@ module Match
                                             print_command: FastlaneCore::Globals.verbose?)
           end
         rescue
-          UI.error("Error cloning certificates repo, please make sure you have read access to the repository you want to use")
           if self.branch && self.clone_branch_directly
             UI.error("You passed '#{self.branch}' as branch in combination with the `clone_branch_directly` flag. Please remove `clone_branch_directly` flag on the first run for _match_ to create the branch.")
           end
-          UI.error("Run the following command manually to make sure you're properly authenticated:")
-          UI.command(command)
-          UI.user_error!("Error cloning certificates git repo, please make sure you have access to the repository - see instructions above")
+          UI.user_error!("Error cloning certificates repo, please make sure you have read access to the repository you want to use")
         end
 
         add_user_config(self.git_full_name, self.git_user_email)

data/match/lib/match/storage/google_cloud_storage.rb

@@ -82,7 +82,12 @@ module Match
         if self.google_cloud_keys_file.to_s.length > 0
           # Extract the Project ID from the `JSON` file
           # so the user doesn't have to provide it manually
-          keys_file_content = JSON.parse(File.read(self.google_cloud_keys_file))
+          begin
+            keys_file_content = JSON.parse(File.read(self.google_cloud_keys_file))
+          rescue JSON::ParserError
+            # Don't dump secret into logs in case a secret (p8) is passed. See fastlane/fastlane#21017
+            UI.user_error!("Provided keys file on path #{File.expand_path(self.google_cloud_keys_file)} is not a valid JSON file")
+          end
           if google_cloud_project_id.to_s.length > 0 && google_cloud_project_id != keys_file_content["project_id"]
             UI.important("The google_cloud_keys_file's project ID ('#{keys_file_content['project_id']}') doesn't match the google_cloud_project_id ('#{google_cloud_project_id}'). This may be the wrong keys file.")
           end

data/pem/lib/pem/manager.rb

@@ -20,7 +20,7 @@ module PEM
           remaining_days = (existing_certificate.expires - Time.now) / 60 / 60 / 24
 
           display_platform = ''
-          unless PEM.config[:website_push]
+          unless PEM.config[:website_push] || PEM.config[:voip_push]
             display_platform = "#{PEM.config[:platform]} "
           end
 
@@ -94,6 +94,8 @@ module PEM
       def certificate
         if PEM.config[:website_push]
           Spaceship.certificate.website_push
+        elsif PEM.config[:voip_push]
+          Spaceship.certificate.voip_push
         else
           platform = PEM.config[:platform]
           UI.user_error!('platform parameter is unspecified.') unless platform
@@ -123,6 +125,8 @@ module PEM
           'development'
         elsif PEM.config[:website_push]
           'website'
+        elsif PEM.config[:voip_push]
+          'voip'
         else
           'production'
         end

data/pem/lib/pem/options.rb

@@ -30,6 +30,12 @@ module PEM
                                      is_string: false,
                                      conflicting_options: [:development],
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :voip_push,
+                                     env_name: "PEM_VOIP_PUSH",
+                                     description: "Create a VoIP Services certificate",
+                                     is_string: false,
+                                     conflicting_options: [:development, :website_push],
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :generate_p12,
                                      env_name: "PEM_GENERATE_P12_FILE",
                                      description: "Generate a p12 file additionally to a PEM file",

data/pilot/lib/pilot/build_manager.rb

@@ -296,6 +296,9 @@ module Pilot
 
       # Handle beta app clip invocations
       update_app_clip_invocations(options: options, build: build)
+
+      # Handle routing app coverage file
+      update_routing_app_coverage(options)
     end
 
     def self.truncate_changelog(changelog)
@@ -679,6 +682,35 @@ module Pilot
         end
       end
     end
+
+    def update_routing_app_coverage(options)
+      # Skip logic entirely if no coverage file passed. So status-quo stays the same.
+      return unless options[:routing_app_coverage_file]
+
+      # We can only attach a coverage file to build upload - so pick the most recent edit.
+      platform = Spaceship::ConnectAPI::Platform.map(fetch_app_platform)
+      version = app.get_edit_app_store_version(platform: platform)
+      unless version
+        UI.important("Skipping upload of routing app coverage file - could not find an editable app store version")
+        return
+      end
+
+      routing_app_coverage =
+        begin
+          version.fetch_routing_app_coverage
+        rescue => error
+          UI.important("Error fetching routing app coverage - #{error.message}")
+          nil
+        end
+
+      if routing_app_coverage
+        UI.message("Removing previous routing app coverage file from App Store Connect")
+        routing_app_coverage.delete!
+      end
+
+      UI.message("Uploading routing app coverage file to App Store Connect")
+      version.upload_routing_app_coverage(path: options[:routing_app_coverage_file])
+    end
   end
   # rubocop:enable Metrics/ClassLength
 end

data/pilot/lib/pilot/options.rb

@@ -201,6 +201,14 @@ module Pilot
                                      optional: true,
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :routing_app_coverage_file,
+                                     env_name: "PILOT_ROUTING_APP_COVERAGE_FILE",
+                                     description: "Path to the routing app coverage file (`.geojson`) that is required for routing apps. It will be uploaded to the editable App Store version of the app",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Could not find routing app coverage file at path '#{File.expand_path(value)}'") unless File.exist?(value)
+                                       UI.user_error!("Routing app coverage file must be a .geojson file") unless File.extname(value).casecmp(".geojson").zero?
+                                     end),
 
         # distribution
         FastlaneCore::ConfigItem.new(key: :distribute_only,

data/scan/lib/scan/options.rb

@@ -527,6 +527,11 @@ module Scan
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "SCAN_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "SCAN_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",

data/sigh/lib/assets/resign.sh

@@ -665,9 +665,18 @@ function resign {
         # Get the old and the new team ID
         # Old team ID is not part of app entitlements, have to get it from old embedded provisioning profile
         security cms -D -i "$TEMP_DIR/old-embedded.mobileprovision" > "$TEMP_DIR/old-embedded-profile.plist"
-        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist")
+        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist" 2>/dev/null)
+        if [ "$OLD_TEAM_ID" == "" ]; then
+            OLD_TEAM_ID="$OLD_APP_ID"
+        fi
         # New team ID is part of profile entitlements
-        NEW_TEAM_ID=$(PlistBuddy -c "Print com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+        NEW_TEAM_ID=$(PlistBuddy -c "Print :com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" 2>/dev/null | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+        if [ "$NEW_TEAM_ID" == "" ]; then
+            NEW_TEAM_ID="$TEAM_IDENTIFIER"
+        fi
+        if [ "$NEW_TEAM_ID" == "" ]; then
+            NEW_TEAM_ID="$NEW_APP_ID"
+        fi
 
         log "Patching profile entitlements with values from app entitlements"
         PATCHED_ENTITLEMENTS="$TEMP_DIR/patchedEntitlements"
@@ -866,13 +875,16 @@ function resign {
         OLD_BUNDLE_ID="$(PlistBuddy -c "Print :CFBundleIdentifier" "$TEMP_DIR/oldInfo.plist")"
         NEW_BUNDLE_ID="$(bundle_id_for_provision "$NEW_PROVISION")"
         log "Replacing old bundle ID '$OLD_BUNDLE_ID' with new bundle ID '$NEW_BUNDLE_ID' in patched entitlements"
-        # Note: ideally we'd match against the opening <string> tag too, but this isn't possible
-        # because $OLD_BUNDLE_ID and $NEW_BUNDLE_ID do not include the team ID prefix which is
-        # present in the entitlements file.
-        # e.g. <string>AB1GP98Q19.com.example.foo</string>
-        #         vs
-        #      com.example.foo
-        /usr/bin/sed -i .bak "s!${OLD_BUNDLE_ID}</string>!${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        # Anchor the replacement to OLD_TEAM_ID prefix, app group prefix, or the opening <string> tag
+        # so that if NEW_BUNDLE_ID contains OLD_BUNDLE_ID as a suffix (e.g. enterprise.com.example.foo),
+        # the already-correct values (like <TEAM_ID>.enterprise.com.example.foo) do not have their
+        # suffix duplicated.
+        ESCAPED_OLD_BUNDLE_ID="${OLD_BUNDLE_ID//./\\.}"
+        if [ -n "$OLD_TEAM_ID" ] && [ -n "$NEW_TEAM_ID" ]; then
+            /usr/bin/sed -i .bak "s!<string>${OLD_TEAM_ID}\.${ESCAPED_OLD_BUNDLE_ID}</string>!<string>${NEW_TEAM_ID}.${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        fi
+        /usr/bin/sed -i .bak "s!<string>group\.${ESCAPED_OLD_BUNDLE_ID}</string>!<string>group.${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        /usr/bin/sed -i .bak "s!<string>${ESCAPED_OLD_BUNDLE_ID}</string>!<string>${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
 
         log "Resigning application using certificate: '$CERTIFICATE'"
         log "and patched entitlements:"

data/snapshot/lib/snapshot/options.rb

@@ -268,6 +268,11 @@ module Snapshot
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "SNAPSHOT_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "SNAPSHOT_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",