fastlane 2.240.1 → 2.241.0

data/sigh/lib/assets/resign.sh

@@ -321,6 +321,23 @@ else
     error "Error: Only can resign .app files and .ipa files."
 fi
 
+# Stop if a symbolic link resolves outside the temporary directory: later steps write through such links.
+# Resolved with the cd -P and pwd -P builtins, as realpath and readlink -f are missing on older macOS.
+TEMP_DIR_PHYSICAL="$(cd -P "$TEMP_DIR" && pwd -P)"
+checkStatus
+while IFS= read -d '' -r link; do
+    target="$(readlink "$link")"
+    [[ "$target" == /* ]] || target="$(dirname "$link")/$target"
+    if [ -d "$target" ]; then
+        resolved="$(cd -P "$target" 2>/dev/null && pwd -P)"
+    else
+        resolved="$(cd -P "$(dirname "$target")" 2>/dev/null && pwd -P)/$(basename "$target")"
+    fi
+    if [[ "$resolved" != "$TEMP_DIR_PHYSICAL" && "$resolved" != "$TEMP_DIR_PHYSICAL"/* ]]; then
+        error "Error: '${link#"$TEMP_DIR"/}' is a symbolic link to '$(readlink "$link")', outside of '$ORIGINAL_FILE'. Remove it before resigning."
+    fi
+done < <(find "$TEMP_DIR" -type l -print0)
+
 # check the keychain
 if [ "${KEYCHAIN}" != "" ]; then
     security list-keychains -s "$KEYCHAIN"

data/sigh/lib/sigh/local_manage.rb

@@ -134,7 +134,7 @@ module Sigh
 
       profiles = []
       profile_paths.each do |profile_path|
-        profile = Plist.parse_xml(`security cms -D -i '#{profile_path}' 2> /dev/null`) # /dev/null: https://github.com/fastlane/fastlane/issues/6387
+        profile = FastlaneCore::ProvisioningProfile.parse(profile_path)
         profile['Path'] = profile_path
         profiles << profile
       end

data/sigh/lib/sigh/options.rb

@@ -63,6 +63,11 @@ module Sigh
                                      code_gen_sensitive: true,
                                      default_value: CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier),
                                      default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :offline_profile,
+                                     env_name: "SIGH_OFFLINE_PROFILE",
+                                     description: "Enable profile with 'Offline Support' (7 day validity). Requires Apple ID login, not supported with App Store Connect API key authentication",
+                                     is_string: false,
+                                     default_value: false),
 
         # App Store Connect API
         FastlaneCore::ConfigItem.new(key: :api_key_path,

data/sigh/lib/sigh/resign.rb

@@ -45,10 +45,10 @@ module Sigh
       entitlements = "-e #{entitlements.shellescape}" if entitlements
 
       provisioning_options = create_provisioning_options(provisioning_profiles)
-      version = "-n #{version}" if version
+      version = "-n #{version.shellescape}" if version
       display_name = "-d #{display_name.shellescape}" if display_name
-      short_version = "--short-version #{short_version}" if short_version
-      bundle_version = "--bundle-version #{bundle_version}" if bundle_version
+      short_version = "--short-version #{short_version.shellescape}" if short_version
+      bundle_version = "--bundle-version #{bundle_version.shellescape}" if bundle_version
       verbose = "-v" if FastlaneCore::Globals.verbose?
       bundle_id = "-b '#{new_bundle_id}'" if new_bundle_id
       use_app_entitlements_flag = "--use-app-entitlements" if use_app_entitlements

data/sigh/lib/sigh/runner.rb

@@ -34,6 +34,10 @@ module Sigh
         UI.message("Successfully logged in")
       end
 
+      if Sigh.config[:offline_profile] && !Spaceship::ConnectAPI.token.nil?
+        UI.user_error!("The 'offline_profile' option requires logging in with an Apple ID. Apple's App Store Connect API (API key authentication) does not support the 'Offline Support' profile setting")
+      end
+
       profiles = [] if Sigh.config[:skip_fetch_profiles]
       profiles ||= fetch_profiles # download the profile if it's there
 
@@ -185,7 +189,8 @@ module Sigh
         profile_type: profile_type,
         bundle_id_id: bundle_id.id,
         certificate_ids: certificates_to_use.map(&:id),
-        device_ids: devices_to_use.map(&:id)
+        device_ids: devices_to_use.map(&:id),
+        is_offline_profile: Sigh.config[:offline_profile]
       )
 
       profile

data/snapshot/lib/snapshot/page.html.erb

@@ -96,38 +96,38 @@
       <button class="tabLink" onclick="openTab(event, 'byScreen')">By Screen</button>
     </div>
     <div id="byLanguage" class="tabContent"><h1 class="tabTitle">By Language:</h1><% image_counter = 0 %><% @data_by_language.each do |language, content| %>
-      <h2 id="<%= language %>"><%= language %></h2>
+      <h2 id="<%= ERB::Util.h(language) %>"><%= ERB::Util.h(language) %></h2>
       <hr>
       <table><% content.each do |device_name, screens| %>
         <tr>
           <th colspan="<%= screens.count %>">
-            <a id="<%= language %>-<%= device_name %>" class="deviceName" href="#<%= language %>-<%= device_name %>"><%= device_name %></a>
+            <a id="<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>" class="deviceName" href="#<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>"><%= ERB::Util.h(device_name) %></a>
           </th>
         </tr>
         <tr><% screens.each do |screen_path| %><% next if screen_path.include?"_framed.png" %>
           <td><% image_counter += 1 %>
-            <a href="<%= screen_path %>" target="_blank" class="screenshotLink">
-              <img class="screenshot" src="<%= screen_path %>" style="width: 100%;" alt="<%= language %> <%= device_name %>" data-tab="1" data-counter="<%= image_counter %>">
+            <a href="<%= ERB::Util.h(screen_path) %>" target="_blank" class="screenshotLink">
+              <img class="screenshot" src="<%= ERB::Util.h(screen_path) %>" style="width: 100%;" alt="<%= ERB::Util.h(language) %> <%= ERB::Util.h(device_name) %>" data-tab="1" data-counter="<%= image_counter %>">
             </a>
           </td><% end %>
         </tr><% end %>
       </table><% end %>
     </div>
     <div id="byScreen" class="tabContent"><h1 class="tabTitle">By Screen:</h1><% image_counter = 0 %><% @data_by_screen.each do |screen, content| %>
-      <h2 id="<%= screen %>" class="screen"><%= screen %></h2>
+      <h2 id="<%= ERB::Util.h(screen) %>" class="screen"><%= ERB::Util.h(screen) %></h2>
       <hr>
       <table><% content.each do |device_name, screens| %>
         <tr>
           <th colspan="<%= screens.count %>">
-            <a id="<%= screen %>-<%= device_name %>" class="deviceName" href="#<%= screen %>-<%= device_name %>"><%= device_name %></a>
+            <a id="<%= ERB::Util.h(screen) %>-<%= ERB::Util.h(device_name) %>" class="deviceName" href="#<%= ERB::Util.h(screen) %>-<%= ERB::Util.h(device_name) %>"><%= ERB::Util.h(device_name) %></a>
           </th>
         </tr>
         <tr><% screens.each do |language, screen_path| %><% next if screen_path.include?"_framed.png" %>
           <td><% image_counter += 1 %>
-            <a href="<%= screen_path %>" target="_blank" class="screenshotLink">
-              <img class="screenshot" src="<%= screen_path %>" style="width: 100%;" alt="<%= language %> <%= device_name %>" data-tab="2" data-counter="<%= image_counter %>">
+            <a href="<%= ERB::Util.h(screen_path) %>" target="_blank" class="screenshotLink">
+              <img class="screenshot" src="<%= ERB::Util.h(screen_path) %>" style="width: 100%;" alt="<%= ERB::Util.h(language) %> <%= ERB::Util.h(device_name) %>" data-tab="2" data-counter="<%= image_counter %>">
             </a>
-            <div class="caption"><%= language %></div>
+            <div class="caption"><%= ERB::Util.h(language) %></div>
           </td><% end %>
         </tr><% end %>
       </table><% end %>
@@ -222,9 +222,14 @@
           imageDisplay.alt             = img.alt;
           imageDisplay.dataset.counter = img.dataset.counter;
 
-          imageInfo.innerHTML          = '<h3>'+img.alt+'</h3>';
-          imageInfo.innerHTML         += decodeURI(img.src.split("/").pop());
-          imageInfo.innerHTML         += '<br />'+tmpImg.height+'&times;'+tmpImg.width+'px';
+          // textContent, not innerHTML: file names must not be interpreted as HTML
+          var imageTitle               = document.createElement('h3');
+          imageTitle.textContent       = img.alt;
+          imageInfo.textContent        = '';
+          imageInfo.appendChild(imageTitle);
+          imageInfo.appendChild(document.createTextNode(decodeURI(img.src.split("/").pop())));
+          imageInfo.appendChild(document.createElement('br'));
+          imageInfo.appendChild(document.createTextNode(tmpImg.height+'\u00d7'+tmpImg.width+'px'));
 
           overlay.style.display        = "block";
         });

data/snapshot/lib/snapshot/reports_generator.rb

@@ -51,7 +51,7 @@ module Snapshot
 
       export_path = File.expand_path(export_path)
       UI.success("Successfully created HTML file with an overview of all the screenshots: '#{export_path}'")
-      system("open '#{export_path}'") unless Snapshot.config[:skip_open_summary]
+      system("open", export_path) unless Snapshot.config[:skip_open_summary]
     end
 
     def xcode_8_and_below_device_name_mappings

data/snapshot/lib/snapshot/simulator_launchers/simulator_launcher_base.rb

@@ -82,7 +82,7 @@ module Snapshot
       unless launcher_config.headless
         simulator_path = File.join(Helper.xcode_path, 'Applications', 'Simulator.app')
         device_udid = TestCommandGenerator.device_udid(device_types.first)
-        command = "open -a #{simulator_path} -g"
+        command = "open -a #{simulator_path.shellescape} -g"
         command += " --args -CurrentDeviceUDID #{device_udid}" if device_udid
         Helper.backticks(command, print: FastlaneCore::Globals.verbose?)
       end

data/snapshot/lib/snapshot.rb

@@ -1,8 +1,6 @@
 require_relative 'snapshot/runner'
 require_relative 'snapshot/reports_generator'
 require_relative 'snapshot/detect_values'
-require_relative 'snapshot/screenshot_flatten'
-require_relative 'snapshot/screenshot_rotate'
 require_relative 'snapshot/dependency_checker'
 require_relative 'snapshot/latest_os_version'
 require_relative 'snapshot/test_command_generator'

data/spaceship/README.md

@@ -27,8 +27,7 @@ Get in contact with the creators on Twitter: [@FastlaneTools](https://twitter.co
     <a href="#whats-spaceship">Why?</a> &bull;
     <a href="#usage">Usage</a> &bull;
     <a href="#installation">Installation</a> &bull;
-    <a href="#technical-details">Technical Details</a> &bull;
-    <a href="#need-help">Need help?</a>
+    <a href="#technical-details">Technical Details</a>
 </p>
 
 -------
@@ -165,7 +164,7 @@ _spaceship_ does a lot of magic to get everything working so neatly:
 - **Multiple Spaceship**: You can launch multiple _spaceships_ with different Apple accounts to do things like syncing the registered devices.
 
 # Code of Conduct
-Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/CODE_OF_CONDUCT.md).
+Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/docs/CODE_OF_CONDUCT.md).
 
 # License
 This project is licensed under the terms of the MIT license. See the LICENSE file.

data/spaceship/lib/spaceship/base.rb

@@ -224,7 +224,9 @@ module Spaceship
     # The initialize method accepts a parsed response from Apple and sets all
     # attributes that are defined by `attr_mapping`
     #
-    # Do not override `initialize` in your own models.
+    # Do not override `initialize` in your own models, use `setup` instead. An
+    # override that has to take a value Apple's response does not carry must call
+    # `super`, or `attr_mapping`, `raw_data`, `client` and `setup` are all skipped.
     def initialize(attrs = {}, existing_client = nil)
       attrs.each do |key, val|
         self.send("#{key}=", val) if respond_to?("#{key}=")

data/spaceship/lib/spaceship/client.rb

@@ -605,16 +605,14 @@ module Spaceship
       # Now we know if the login is successful or if we need to do 2 factor
 
       case response.status
-      when 403
-        raise InvalidUserCredentialsError.new, "Invalid username and password combination. Used '#{user}' as the username."
       when 200
-        fetch_olympus_session
+        fetch_olympus_session_after_signin
         return response
       when 409
         # 2 step/factor is enabled for this account, first handle that
         handle_two_step_or_factor(response)
         # and then get the olympus session
-        fetch_olympus_session
+        fetch_olympus_session_after_signin
         return true
       else
         if (response.body || "").include?('invalid="true"')
@@ -692,6 +690,16 @@ module Spaceship
       return Spaceship::Hashcash.make(bits: bits, challenge: challenge)
     end
 
+    # Apple accepts a stale key for the sign in and 2FA, and only refuses the
+    # session afterwards, with a 401 that says nothing about the key.
+    def fetch_olympus_session_after_signin
+      fetch_olympus_session
+    rescue UnauthorizedAccessError
+      raise unless service_key_from_cache?
+
+      raise UnauthorizedAccessError.new, "App Store Connect refused the session after signing in. The App Store Connect API key came from the cache at #{itc_service_key_path} and may be stale: delete that file and try again."
+    end
+
     # Get the `itctx` from the new (22nd May 2017) API endpoint "olympus"
     # Update (29th March 2019) olympus migrates to new appstoreconnect API
     def fetch_olympus_session
@@ -721,58 +729,59 @@ module Spaceship
       exit(has_valid_session)
     end
 
-    # <tmpdir>/spaceship_itc_service_key.txt
-    #
-    # Dir.tmpdir rather than a literal "/tmp", for the same reason as #logger,
-    # and here the failure was worse than a missing file: itc_service_key
-    # rescues everything, so the write failing on Windows was reported as an
-    # App Store Connect outage. See #30198.
-    #
-    # On macOS this is also per user, so a cache written by one user no longer
-    # blocks another.
+    # <fastlane_user_dir>/spaceship_itc_service_key.txt: per user, and kept between
+    # runs. Dir.tmpdir (#30197) is shared by every user on Linux, and a literal
+    # "/tmp" is not a directory on Windows.
     def itc_service_key_path
-      File.join(Dir.tmpdir, "spaceship_itc_service_key.txt")
+      File.join(fastlane_user_dir, "spaceship_itc_service_key.txt")
     end
 
+    # Read on every login from GET /logout -> 302 Location: .../signout?widgetKey=<key>.
+    # A stale key only fails after 2FA, so the cache is just a fallback. See fastlane#30291.
     def itc_service_key
       return @service_key if @service_key
 
-      # Check if we have a local cache of the key. Reading it is best effort:
-      # an unreadable cache is a reason to fetch the key again, not to fail.
-      begin
-        return File.read(itc_service_key_path) if File.exist?(itc_service_key_path)
-      rescue SystemCallError => ex
-        logger.warn("Could not read the cached App Store Connect API key: #{ex.message}")
+      key = fetch_service_key_from_signout
+      if key.nil?
+        cached = cached_service_key
+        return @service_key = cached if cached
+
+        key = fetch_service_key_from_olympus
       end
 
-      @service_key = fetch_service_key
+      cache_service_key(key)
+      @service_key = key
+    end
 
-      # Cache the key locally. Best effort as well: having the key and failing
-      # to save it is not a reason to fail the login. See fastlane#30198.
-      begin
-        File.write(itc_service_key_path, @service_key)
-      rescue SystemCallError => ex
-        logger.warn("Could not cache the App Store Connect API key at #{itc_service_key_path}: #{ex.message}")
-      end
+    def service_key_from_cache?
+      @service_key_from_cache == true
+    end
+
+    # Reading the cache is best effort: an unreadable cache is a reason to
+    # fetch the key again, not to fail.
+    def cached_service_key
+      return nil unless File.exist?(itc_service_key_path)
 
-      return @service_key
+      key = File.read(itc_service_key_path)
+      @service_key_from_cache = true
+      logger.warn("Using the cached App Store Connect API key from #{itc_service_key_path}")
+      key
+    rescue SystemCallError => ex
+      logger.warn("Could not read the cached App Store Connect API key: #{ex.message}")
+      nil
     end
 
-    # Two sources, because the one this used to rely on is gone.
-    #
-    # App Store Connect's sign out route answers with a redirect that carries
-    # the key its own front end is using:
-    #
-    #   GET /logout -> 302 Location: .../appleauth/signout?widgetKey=<key>&...
-    #
-    # That is preferred over the olympus endpoint below, which Apple removed in
-    # September 2026 and which now answers 404. See fastlane#30199. The olympus
-    # call is kept as a fallback in case it comes back, since it is the source
-    # Apple documented rather than one scraped out of a redirect.
-    def fetch_service_key
-      key = fetch_service_key_from_signout
-      return key if key
+    # Best effort as well: having the key and failing to save it is not a reason
+    # to fail the login. See fastlane#30198.
+    def cache_service_key(key)
+      File.write(itc_service_key_path, key)
+    rescue SystemCallError => ex
+      logger.warn("Could not cache the App Store Connect API key: #{ex.message}")
+    end
 
+    # The source Apple documented, removed in September 2026 and answering 404
+    # since. Kept as the last fallback in case it comes back. See fastlane#30199.
+    def fetch_service_key_from_olympus
       # Fixes issue https://github.com/fastlane/fastlane/issues/13281
       # Even though we are using https://appstoreconnect.apple.com, the service key needs to still use a
       # hostname through itunesconnect.apple.com
@@ -830,10 +839,11 @@ module Spaceship
       # said instead of the real cause.
       #
       # Warn rather than debug. This is the source the key normally comes from,
-      # so failing here means the run is about to depend on an endpoint Apple has
-      # already removed once. If the fallback fails too, its message is all the
-      # caller sees, and this line is the half that says why.
-      logger.warn("Could not read the App Store Connect API key from the sign out redirect, falling back to the olympus endpoint: #{ex.message}")
+      # so failing here means the run is about to depend on a cached key that may
+      # be stale, or on an endpoint Apple has already removed once. If the
+      # fallback fails too, its message is all the caller sees, and this line is
+      # the half that says why.
+      logger.warn("Could not read the App Store Connect API key from the sign out redirect, falling back to the cache or the olympus endpoint: #{ex.message}")
       nil
     end
 
@@ -1189,6 +1199,11 @@ module Spaceship
       end
     end
 
+    # signin/init, signin/complete, and the legacy signin
+    def sign_in_request?(response)
+      response.env.url.host == "idmsa.apple.com" && response.env.url.path.start_with?("/appleauth/auth/signin")
+    end
+
     def handle_error(response)
       case response.status
       when 401
@@ -1196,6 +1211,9 @@ module Spaceship
         logger.warn(msg)
         raise UnauthorizedAccessError.new, "Unauthorized Access"
       when 403
+        # A refused sign-in, e.g. a locked Apple ID: like do_sirp, raise what Apple said, which with_retry does not retry. See fastlane#14387.
+        raise UnexpectedResponse, response.body if sign_in_request?(response) && response.body.kind_of?(Hash) && response.body["serviceErrors"]
+
         msg = "Access forbidden"
         logger.warn(msg)
         raise AccessForbiddenError.new, msg

data/spaceship/lib/spaceship/connect_api/models/bundle_id.rb

@@ -81,12 +81,23 @@ module Spaceship
         return resp.to_models.first
       end
 
+      # `patch_bundle_id_capability` patches the wrong resource (bundleIds, with
+      # attributes nested inside a relationship's `data` entry) — invalid JSON:API,
+      # rejected by Apple. This uses the real per-capability endpoints instead:
+      # create to enable, PATCH to update settings, delete to disable.
       def update_capability(capability_type, enabled: false, settings: [], client: nil)
         raise "capability_type is required " if capability_type.nil?
 
         client ||= Spaceship::ConnectAPI
-        resp = client.patch_bundle_id_capability(bundle_id_id: id, seed_id: seed_id, enabled: enabled, capability_type: capability_type, settings: settings)
-        return resp.to_models.first
+        existing = get_capabilities(client: client).find { |capability| capability.is_type?(capability_type) }
+
+        if enabled
+          return create_capability(capability_type, settings: settings, client: client) unless existing
+          return existing.update!(client: client, settings: settings)
+        else
+          existing&.delete!(client: client)
+          return nil
+        end
       end
     end
   end

data/spaceship/lib/spaceship/connect_api/models/bundle_id_capability.rb

@@ -133,6 +133,12 @@ module Spaceship
         client ||= Spaceship::ConnectAPI
         client.delete_bundle_id_capability(bundle_id_capability_id: id)
       end
+
+      def update!(client: nil, enabled: true, settings: [])
+        client ||= Spaceship::ConnectAPI
+        resp = client.patch_bundle_id_capability_configuration(bundle_id_capability_id: id, enabled: enabled, settings: settings)
+        return resp.to_models.first
+      end
     end
   end
 end

data/spaceship/lib/spaceship/connect_api/models/profile.rb

@@ -84,16 +84,18 @@ module Spaceship
         return resps.flat_map(&:to_models)
       end
 
-      def self.create(client: nil, name: nil, profile_type: nil, bundle_id_id: nil, certificate_ids: nil, device_ids: nil)
+      def self.create(client: nil, name: nil, profile_type: nil, bundle_id_id: nil, certificate_ids: nil, device_ids: nil, is_offline_profile: false)
         client ||= Spaceship::ConnectAPI
+        attributes = {
+          name: name,
+          profileType: profile_type
+        }
+        attributes[:isOfflineProfile] = true if is_offline_profile
         resp = client.post_profiles(
           bundle_id_id: bundle_id_id,
           certificates: certificate_ids,
           devices: device_ids,
-          attributes: {
-            name: name,
-            profileType: profile_type
-          }
+          attributes: attributes
         )
         return resp.to_models.first
       end

data/spaceship/lib/spaceship/connect_api/provisioning/provisioning.rb

@@ -3,6 +3,11 @@ require 'spaceship/connect_api/provisioning/client'
 module Spaceship
   class ConnectAPI
     module Provisioning
+      # Raised when a profile with 'Offline Support' is requested while authenticated
+      # with an App Store Connect API key. Apple only exposes the isOfflineProfile
+      # attribute on the Developer Portal endpoint used by Apple ID (web session) logins.
+      class OfflineProfileNotSupportedError < StandardError; end
+
       module API
         module Version
           V1 = "v1"
@@ -84,6 +89,22 @@ module Spaceship
           provisioning_request_client.post("#{Version::V1}/bundleIdCapabilities", body)
         end
 
+        # Modify a Capability Configuration — patches the bundleIdCapability resource
+        # directly (attributes at the top level), not the bundleId it belongs to.
+        def patch_bundle_id_capability_configuration(bundle_id_capability_id:, enabled: false, settings: [])
+          body = {
+            data: {
+              type: "bundleIdCapabilities",
+              id: bundle_id_capability_id,
+              attributes: {
+                enabled: enabled,
+                settings: settings
+              }
+            }
+          }
+          provisioning_request_client.patch("#{Version::V1}/bundleIdCapabilities/#{bundle_id_capability_id}", body)
+        end
+
         def patch_bundle_id_capability(bundle_id_id:, seed_id:, enabled: false, capability_type:, settings: [])
           body = {
             data: {
@@ -222,6 +243,10 @@ module Spaceship
         end
 
         def post_profiles(bundle_id_id: nil, certificates: nil, devices: nil, attributes: {})
+          if attributes[:isOfflineProfile] && !provisioning_request_client.web_session?
+            raise OfflineProfileNotSupportedError, "Profiles with 'Offline Support' (isOfflineProfile) can only be created when logged in with an Apple ID; the App Store Connect API does not support this attribute"
+          end
+
           body = {
             data: {
               attributes: attributes,

data/spaceship/lib/spaceship/du/upload_file.rb

@@ -34,7 +34,7 @@ module Spaceship
       # This will copy the image into the temporary directory to remove the
       # alpha channel there. That's done to not edit the original image.
       def remove_alpha_channel(original)
-        path = File.join(Dir.tmpdir, "#{Digest::MD5.hexdigest(original)}.png")
+        path = File.join(Dir.mktmpdir("spaceship-upload-"), File.basename(original))
         FileUtils.copy(original, path)
         if mac? # sips is only available on macOS
           `sips -s format bmp '#{path}' &> /dev/null` # &> /dev/null since there is warning because of the extension

data/spaceship/lib/spaceship/errors.rb

@@ -86,7 +86,13 @@ module Spaceship
     end
 
     def preferred_error_info
-      return nil unless @error_info.kind_of?(Hash) && @error_info['resultString']
+      return nil unless @error_info.kind_of?(Hash)
+
+      # What Apple's authentication service answers, e.g. on a locked Apple ID
+      service_errors = Array(@error_info['serviceErrors'])
+      return ["Apple provided the following error info:"] + service_errors.map { |error| [error['message'], "(#{error['code']})"].compact.join(" ") } unless service_errors.empty?
+
+      return nil unless @error_info['resultString']
 
       [
         "Apple provided the following error info:",

data/spaceship/lib/spaceship/globals.rb

@@ -7,8 +7,8 @@ module Spaceship
     # if spaceship is run with a FastlaneCore available respect the global state there
     # otherwise fallback to $verbose
     def self.verbose?
-      if Object.const_defined?("FastlaneCore")
-        return FastlaneCore::Globals.verbose? # rubocop:disable Require/MissingRequireStatement
+      if Object.const_defined?("FastlaneCore") && FastlaneCore.const_defined?("Globals")
+        return FastlaneCore::Globals.verbose?
       end
       return $verbose
     end