fastlane 2.240.1 → 2.241.1

data/spaceship/lib/spaceship/client.rb

@@ -605,16 +605,14 @@ module Spaceship
       # Now we know if the login is successful or if we need to do 2 factor
 
       case response.status
-      when 403
-        raise InvalidUserCredentialsError.new, "Invalid username and password combination. Used '#{user}' as the username."
       when 200
-        fetch_olympus_session
+        fetch_olympus_session_after_signin
         return response
       when 409
         # 2 step/factor is enabled for this account, first handle that
         handle_two_step_or_factor(response)
         # and then get the olympus session
-        fetch_olympus_session
+        fetch_olympus_session_after_signin
         return true
       else
         if (response.body || "").include?('invalid="true"')
@@ -692,6 +690,16 @@ module Spaceship
       return Spaceship::Hashcash.make(bits: bits, challenge: challenge)
     end
 
+    # Apple accepts a stale key for the sign in and 2FA, and only refuses the
+    # session afterwards, with a 401 that says nothing about the key.
+    def fetch_olympus_session_after_signin
+      fetch_olympus_session
+    rescue UnauthorizedAccessError
+      raise unless service_key_from_cache?
+
+      raise UnauthorizedAccessError.new, "App Store Connect refused the session after signing in. The App Store Connect API key came from the cache at #{itc_service_key_path} and may be stale: delete that file and try again."
+    end
+
     # Get the `itctx` from the new (22nd May 2017) API endpoint "olympus"
     # Update (29th March 2019) olympus migrates to new appstoreconnect API
     def fetch_olympus_session
@@ -721,58 +729,59 @@ module Spaceship
       exit(has_valid_session)
     end
 
-    # <tmpdir>/spaceship_itc_service_key.txt
-    #
-    # Dir.tmpdir rather than a literal "/tmp", for the same reason as #logger,
-    # and here the failure was worse than a missing file: itc_service_key
-    # rescues everything, so the write failing on Windows was reported as an
-    # App Store Connect outage. See #30198.
-    #
-    # On macOS this is also per user, so a cache written by one user no longer
-    # blocks another.
+    # <fastlane_user_dir>/spaceship_itc_service_key.txt: per user, and kept between
+    # runs. Dir.tmpdir (#30197) is shared by every user on Linux, and a literal
+    # "/tmp" is not a directory on Windows.
     def itc_service_key_path
-      File.join(Dir.tmpdir, "spaceship_itc_service_key.txt")
+      File.join(fastlane_user_dir, "spaceship_itc_service_key.txt")
     end
 
+    # Read on every login from GET /logout -> 302 Location: .../signout?widgetKey=<key>.
+    # A stale key only fails after 2FA, so the cache is just a fallback. See fastlane#30291.
     def itc_service_key
       return @service_key if @service_key
 
-      # Check if we have a local cache of the key. Reading it is best effort:
-      # an unreadable cache is a reason to fetch the key again, not to fail.
-      begin
-        return File.read(itc_service_key_path) if File.exist?(itc_service_key_path)
-      rescue SystemCallError => ex
-        logger.warn("Could not read the cached App Store Connect API key: #{ex.message}")
+      key = fetch_service_key_from_signout
+      if key.nil?
+        cached = cached_service_key
+        return @service_key = cached if cached
+
+        key = fetch_service_key_from_olympus
       end
 
-      @service_key = fetch_service_key
+      cache_service_key(key)
+      @service_key = key
+    end
 
-      # Cache the key locally. Best effort as well: having the key and failing
-      # to save it is not a reason to fail the login. See fastlane#30198.
-      begin
-        File.write(itc_service_key_path, @service_key)
-      rescue SystemCallError => ex
-        logger.warn("Could not cache the App Store Connect API key at #{itc_service_key_path}: #{ex.message}")
-      end
+    def service_key_from_cache?
+      @service_key_from_cache == true
+    end
+
+    # Reading the cache is best effort: an unreadable cache is a reason to
+    # fetch the key again, not to fail.
+    def cached_service_key
+      return nil unless File.exist?(itc_service_key_path)
 
-      return @service_key
+      key = File.read(itc_service_key_path)
+      @service_key_from_cache = true
+      logger.warn("Using the cached App Store Connect API key from #{itc_service_key_path}")
+      key
+    rescue SystemCallError => ex
+      logger.warn("Could not read the cached App Store Connect API key: #{ex.message}")
+      nil
     end
 
-    # Two sources, because the one this used to rely on is gone.
-    #
-    # App Store Connect's sign out route answers with a redirect that carries
-    # the key its own front end is using:
-    #
-    #   GET /logout -> 302 Location: .../appleauth/signout?widgetKey=<key>&...
-    #
-    # That is preferred over the olympus endpoint below, which Apple removed in
-    # September 2026 and which now answers 404. See fastlane#30199. The olympus
-    # call is kept as a fallback in case it comes back, since it is the source
-    # Apple documented rather than one scraped out of a redirect.
-    def fetch_service_key
-      key = fetch_service_key_from_signout
-      return key if key
+    # Best effort as well: having the key and failing to save it is not a reason
+    # to fail the login. See fastlane#30198.
+    def cache_service_key(key)
+      File.write(itc_service_key_path, key)
+    rescue SystemCallError => ex
+      logger.warn("Could not cache the App Store Connect API key: #{ex.message}")
+    end
 
+    # The source Apple documented, removed in September 2026 and answering 404
+    # since. Kept as the last fallback in case it comes back. See fastlane#30199.
+    def fetch_service_key_from_olympus
       # Fixes issue https://github.com/fastlane/fastlane/issues/13281
       # Even though we are using https://appstoreconnect.apple.com, the service key needs to still use a
       # hostname through itunesconnect.apple.com
@@ -830,10 +839,11 @@ module Spaceship
       # said instead of the real cause.
       #
       # Warn rather than debug. This is the source the key normally comes from,
-      # so failing here means the run is about to depend on an endpoint Apple has
-      # already removed once. If the fallback fails too, its message is all the
-      # caller sees, and this line is the half that says why.
-      logger.warn("Could not read the App Store Connect API key from the sign out redirect, falling back to the olympus endpoint: #{ex.message}")
+      # so failing here means the run is about to depend on a cached key that may
+      # be stale, or on an endpoint Apple has already removed once. If the
+      # fallback fails too, its message is all the caller sees, and this line is
+      # the half that says why.
+      logger.warn("Could not read the App Store Connect API key from the sign out redirect, falling back to the cache or the olympus endpoint: #{ex.message}")
       nil
     end
 
@@ -1189,6 +1199,11 @@ module Spaceship
       end
     end
 
+    # signin/init, signin/complete, and the legacy signin
+    def sign_in_request?(response)
+      response.env.url.host == "idmsa.apple.com" && response.env.url.path.start_with?("/appleauth/auth/signin")
+    end
+
     def handle_error(response)
       case response.status
       when 401
@@ -1196,6 +1211,9 @@ module Spaceship
         logger.warn(msg)
         raise UnauthorizedAccessError.new, "Unauthorized Access"
       when 403
+        # A refused sign-in, e.g. a locked Apple ID: like do_sirp, raise what Apple said, which with_retry does not retry. See fastlane#14387.
+        raise UnexpectedResponse, response.body if sign_in_request?(response) && response.body.kind_of?(Hash) && response.body["serviceErrors"]
+
         msg = "Access forbidden"
         logger.warn(msg)
         raise AccessForbiddenError.new, msg

data/spaceship/lib/spaceship/connect_api/models/app_screenshot_set.rb

@@ -19,6 +19,7 @@ module Spaceship
         APP_IPHONE_61 = "APP_IPHONE_61"
         APP_IPHONE_65 = "APP_IPHONE_65"
         APP_IPHONE_67 = "APP_IPHONE_67"
+        APP_IPHONE_DUO = "APP_IPHONE_DUO"
 
         APP_IPAD_97 = "APP_IPAD_97"
         APP_IPAD_105 = "APP_IPAD_105"
@@ -77,6 +78,7 @@ module Spaceship
           APP_IPHONE_61,
           APP_IPHONE_65,
           APP_IPHONE_67,
+          APP_IPHONE_DUO,
 
           APP_IPAD_97,
           APP_IPAD_105,

data/spaceship/lib/spaceship/connect_api/models/profile.rb

@@ -84,16 +84,18 @@ module Spaceship
         return resps.flat_map(&:to_models)
       end
 
-      def self.create(client: nil, name: nil, profile_type: nil, bundle_id_id: nil, certificate_ids: nil, device_ids: nil)
+      def self.create(client: nil, name: nil, profile_type: nil, bundle_id_id: nil, certificate_ids: nil, device_ids: nil, is_offline_profile: false)
         client ||= Spaceship::ConnectAPI
+        attributes = {
+          name: name,
+          profileType: profile_type
+        }
+        attributes[:isOfflineProfile] = true if is_offline_profile
         resp = client.post_profiles(
           bundle_id_id: bundle_id_id,
           certificates: certificate_ids,
           devices: device_ids,
-          attributes: {
-            name: name,
-            profileType: profile_type
-          }
+          attributes: attributes
         )
         return resp.to_models.first
       end

data/spaceship/lib/spaceship/connect_api/provisioning/provisioning.rb

@@ -3,6 +3,11 @@ require 'spaceship/connect_api/provisioning/client'
 module Spaceship
   class ConnectAPI
     module Provisioning
+      # Raised when a profile with 'Offline Support' is requested while authenticated
+      # with an App Store Connect API key. Apple only exposes the isOfflineProfile
+      # attribute on the Developer Portal endpoint used by Apple ID (web session) logins.
+      class OfflineProfileNotSupportedError < StandardError; end
+
       module API
         module Version
           V1 = "v1"
@@ -222,6 +227,10 @@ module Spaceship
         end
 
         def post_profiles(bundle_id_id: nil, certificates: nil, devices: nil, attributes: {})
+          if attributes[:isOfflineProfile] && !provisioning_request_client.web_session?
+            raise OfflineProfileNotSupportedError, "Profiles with 'Offline Support' (isOfflineProfile) can only be created when logged in with an Apple ID; the App Store Connect API does not support this attribute"
+          end
+
           body = {
             data: {
               attributes: attributes,

data/spaceship/lib/spaceship/du/upload_file.rb

@@ -34,7 +34,7 @@ module Spaceship
       # This will copy the image into the temporary directory to remove the
       # alpha channel there. That's done to not edit the original image.
       def remove_alpha_channel(original)
-        path = File.join(Dir.tmpdir, "#{Digest::MD5.hexdigest(original)}.png")
+        path = File.join(Dir.mktmpdir("spaceship-upload-"), File.basename(original))
         FileUtils.copy(original, path)
         if mac? # sips is only available on macOS
           `sips -s format bmp '#{path}' &> /dev/null` # &> /dev/null since there is warning because of the extension

data/spaceship/lib/spaceship/errors.rb

@@ -86,7 +86,13 @@ module Spaceship
     end
 
     def preferred_error_info
-      return nil unless @error_info.kind_of?(Hash) && @error_info['resultString']
+      return nil unless @error_info.kind_of?(Hash)
+
+      # What Apple's authentication service answers, e.g. on a locked Apple ID
+      service_errors = Array(@error_info['serviceErrors'])
+      return ["Apple provided the following error info:"] + service_errors.map { |error| [error['message'], "(#{error['code']})"].compact.join(" ") } unless service_errors.empty?
+
+      return nil unless @error_info['resultString']
 
       [
         "Apple provided the following error info:",

data/spaceship/lib/spaceship/globals.rb

@@ -7,8 +7,8 @@ module Spaceship
     # if spaceship is run with a FastlaneCore available respect the global state there
     # otherwise fallback to $verbose
     def self.verbose?
-      if Object.const_defined?("FastlaneCore")
-        return FastlaneCore::Globals.verbose? # rubocop:disable Require/MissingRequireStatement
+      if Object.const_defined?("FastlaneCore") && FastlaneCore.const_defined?("Globals")
+        return FastlaneCore::Globals.verbose?
       end
       return $verbose
     end

data/spaceship/lib/spaceship/portal/merchant.rb

@@ -46,7 +46,7 @@ module Spaceship
         # @param mac [Bool] Fetches Mac merchant if true
         # @return (Array) Returns all merchants available for this account
         def all(mac: false)
-          client.merchants(mac: mac).map { |merchant| new(merchant) }
+          client.merchants(mac: mac).map { |merchant| new_with_platform(merchant, mac) }
         end
 
         # Creates a new Merchant on the Apple Dev Portal
@@ -57,7 +57,7 @@ module Spaceship
         # @return (Merchant) The Merchant you just created
         def create!(bundle_id: nil, name: nil, mac: false)
           new_merchant = client.create_merchant!(name, bundle_id, mac: mac)
-          new(new_merchant)
+          new_with_platform(new_merchant, mac)
         end
 
         # Find a specific Merchant ID based on the bundle_id
@@ -68,6 +68,131 @@ module Spaceship
             merchant.bundle_id == bundle_id
           end
         end
+
+        # Apple does not return the platform, so we record the one that was asked for.
+        def new_with_platform(attrs, mac)
+          new(attrs).tap { |merchant| merchant.platform = mac ? 'mac' : 'ios' }
+        end
+        private :new_with_platform
+      end
+
+      # Represents a domain registered to an Apple Pay Merchant ID
+      class Domain < PortalBase
+        # @return (String) The identifier of this domain, provided by the Dev Portal
+        # @example
+        #   "UFVN6788YA"
+        attr_accessor :domain_id
+
+        # @return (String) The domain name you registered
+        # @example
+        #   "krausefx.com"
+        attr_accessor :name
+
+        # @return (String) Status of the domain verification
+        # @example
+        #   "verified"
+        attr_accessor :status
+
+        # @return (String) The URL Apple expects to serve the domain association file
+        # @example
+        #   "https://krausefx.com/.well-known/apple-developer-merchantid-domain-association.txt"
+        attr_accessor :path
+
+        # @return (Bool) Can this domain be verified by the current team?
+        attr_accessor :can_verify
+
+        # @return (String) The date this domain's verification expires
+        # @example
+        #   "2026-10-11"
+        attr_accessor :expiration_date
+
+        # @return (String) A human readable version of the expiration date
+        # @example
+        #   "Oct 11, 2026"
+        attr_accessor :expiration_date_string
+
+        # @return (Spaceship::Portal::Merchant) The merchant this domain is registered to
+        #   This is not part of Apple's response, it gets passed in by whoever fetched the domain
+        attr_accessor :merchant
+
+        attr_mapping(
+          'displayId' => :domain_id,
+          'name' => :name,
+          'status' => :status,
+          'path' => :path,
+          'canVerify' => :can_verify,
+          'expirationDate' => :expiration_date,
+          'expirationDateString' => :expiration_date_string
+        )
+
+        # @param attrs [Hash] The domain attributes as returned by the Dev Portal
+        # @param existing_client [Spaceship::Client] The client to use for requests
+        # @param merchant [Merchant] The merchant this domain is registered to
+        def initialize(attrs = {}, existing_client = nil, merchant: nil)
+          super(attrs, existing_client)
+          @merchant = merchant
+        end
+
+        class << self
+          # @param merchant [Merchant] The merchant to fetch the domains of
+          # @return (Array) Returns all domains registered to the given merchant
+          def all(merchant)
+            client.merchant_domains(merchant.merchant_id, mac: merchant.mac?).map do |domain|
+              new(domain, client, merchant: merchant)
+            end
+          end
+
+          # Registers a new domain for a Merchant ID on the Apple Dev Portal
+          #
+          # @param merchant [Merchant] the merchant to register the domain for
+          # @param domain_name [String] the domain name to register
+          # @return (Domain) The Domain you just registered
+          def create!(merchant: nil, domain_name: nil)
+            new_domain = client.create_merchant_domain!(merchant.merchant_id, domain_name, mac: merchant.mac?)
+            new(new_domain, client, merchant: merchant)
+          end
+
+          # Find a specific domain of a merchant based on the domain name
+          #
+          # @param merchant [Merchant] The merchant to search the domains of
+          # @param name [String] the domain name to look for
+          # @return (Domain) The Domain you're looking for. This is nil if the domain can't be found.
+          def find(merchant, name)
+            all(merchant).find do |domain|
+              domain.name == name
+            end
+          end
+        end
+
+        # Downloads the domain association file for this domain. It has to be
+        # served at `path` before Apple is able to verify the domain
+        #
+        # @return (String) The url-safe base64 encoded contents of the file
+        def verification_file
+          client.merchant_domain_get_verification_file(domain_id, mac: merchant.mac?)
+        end
+
+        # Asks Apple to verify this domain. The `verification_file` has to be
+        # served at `path` before calling this
+        #
+        # @return (Hash) The response of the Dev Portal
+        def verify
+          client.merchant_domain_verify(domain_id, mac: merchant.mac?)
+        end
+
+        # Delete this Domain
+        # @return (Domain) The domain you just deleted
+        def delete!
+          client.delete_merchant_domain!(domain_id, merchant.merchant_id, mac: merchant.mac?)
+          self
+        end
+      end
+
+      # @return (Array of Spaceship::Portal::Merchant::Domain) The domains registered to this merchant
+      def domains
+        @domains ||= client.merchant_domains(merchant_id, mac: mac?).map do |domain|
+          Domain.new(domain, client, merchant: self)
+        end
       end
 
       # Delete this Merchant

data/spaceship/lib/spaceship/portal/portal_client.rb

@@ -1,3 +1,5 @@
+require 'base64'
+
 require_relative '../client'
 
 require_relative 'app'
@@ -344,6 +346,62 @@ module Spaceship
       end
     end
 
+    def merchant_domains(merchant_id, mac: false)
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/listDomainsForMerchant", {
+        merchantId: merchant_id,
+        teamId: team_id
+      })
+      parse_response(r, 'domainList')
+    end
+
+    def merchant_domain_get_verification_file(domain_id, mac: false)
+      r = request(:get, "account/#{platform_slug(mac)}/identifiers/downloadDomainVerificationFile", {
+        teamId: team_id,
+        domainId: domain_id
+      })
+      a = parse_response(r)
+      if r.success? && a.kind_of?(String)
+        begin
+          return a if Base64.urlsafe_decode64(a.delete("\r\n")).include?("Apple Inc.")
+        # if not valid pkcs#7 just fall through
+        rescue ArgumentError
+        end
+      end
+      raise UnexpectedResponse.new, "Couldn't download verification file, got this instead: #{a}"
+    end
+
+    def merchant_domain_verify(domain_id, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/verifyDomain", {
+        domainId: domain_id,
+        teamId: team_id
+      })
+      parse_response(r)
+    end
+
+    def create_merchant_domain!(merchant_id, domain_name, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/registerDomain", {
+        domainName: domain_name,
+        merchantId: merchant_id,
+        teamId: team_id
+      })
+      parse_response(r, 'domainList').first
+    end
+
+    def delete_merchant_domain!(domain_id, merchant_id, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/removeDomain", {
+        merchantId: merchant_id,
+        domainId: domain_id,
+        teamId: team_id
+      })
+      parse_response(r)
+    end
+
     def create_merchant!(name, bundle_id, mac: false)
       ensure_csrf(Spaceship::Portal::Merchant)
 

data/spaceship/lib/spaceship/portal/ui/select_team.rb

@@ -31,7 +31,6 @@ module Spaceship
       #     {...}
       #   ]
 
-      # rubocop:disable Require/MissingRequireStatement
       def self.ci?
         if Object.const_defined?("FastlaneCore") && FastlaneCore.const_defined?("Helper")
           return FastlaneCore::Helper.ci?
@@ -45,7 +44,6 @@ module Spaceship
         end
         return true
       end
-      # rubocop:enable Require/MissingRequireStatement
 
       def select_team(team_id: nil, team_name: nil)
         teams = client.teams

data/spaceship/lib/spaceship/portal/website_push.rb

@@ -48,7 +48,7 @@ module Spaceship
         # @param mac [Bool] Fetches Mac website push if true
         # @return (Array) Returns all website push available for this account
         def all(mac: false)
-          client.website_push(mac: mac).map { |website_push| self.new(website_push) }
+          client.website_push(mac: mac).map { |website_push| new_with_platform(website_push, mac) }
         end
 
         # Creates a new Website Push ID on the Apple Dev Portal
@@ -59,7 +59,7 @@ module Spaceship
         # @return (Website Push) The Website Push you just created
         def create!(bundle_id: nil, name: nil, mac: false)
           new_website_push = client.create_website_push!(name, bundle_id, mac: mac)
-          self.new(new_website_push)
+          new_with_platform(new_website_push, mac)
         end
 
         # Find a specific Website Push ID based on the bundle_id
@@ -70,6 +70,12 @@ module Spaceship
             website_push.bundle_id == bundle_id
           end
         end
+
+        # Apple does not return the platform, so we record the one that was asked for.
+        def new_with_platform(attrs, mac)
+          new(attrs).tap { |website_push| website_push.platform = mac ? 'mac' : 'ios' }
+        end
+        private :new_with_platform
       end
 
       # Delete this Website Push ID.

data/spaceship/lib/spaceship/test_flight/client.rb

@@ -286,28 +286,6 @@ module Spaceship
         handle_response(response)
       end
 
-      ##
-      # @!group AppTestInfo
-      ##
-
-      def get_app_test_info(app_id: nil)
-        assert_required_params(__method__, binding)
-
-        response = request(:get, "providers/#{team_id}/apps/#{app_id}/testInfo")
-        handle_response(response)
-      end
-
-      def put_app_test_info(app_id: nil, app_test_info: nil)
-        assert_required_params(__method__, binding)
-
-        response = request(:put) do |req|
-          req.url("providers/#{team_id}/apps/#{app_id}/testInfo")
-          req.body = app_test_info.to_json
-          req.headers['Content-Type'] = 'application/json'
-        end
-        handle_response(response)
-      end
-
       protected
 
       def handle_response(response)

data/spaceship/lib/spaceship/test_flight.rb

@@ -1,6 +1,5 @@
 require 'spaceship/test_flight/client'
 require 'spaceship/test_flight/base'
-require 'spaceship/test_flight/app_test_info'
 require 'spaceship/test_flight/build'
 require 'spaceship/test_flight/build_trains'
 require 'spaceship/test_flight/beta_review_info'

data/spaceship/lib/spaceship/two_step_or_factor_client.rb

@@ -20,10 +20,21 @@ module Spaceship
       elsif r.body.kind_of?(Hash) && r.body["trustedPhoneNumbers"].kind_of?(Array) && r.body["trustedPhoneNumbers"].first.kind_of?(Hash)
         handle_two_factor(r)
       else
+        raise_two_factor_service_errors!(r.body)
         raise "Although response from Apple indicated activated Two-step Verification or Two-factor Authentication, spaceship didn't know how to handle this response: #{r.body}"
       end
     end
 
+    # Apple answers without any way to verify, e.g. when it cannot send the SMS code (-28248). See fastlane#29443.
+    def raise_two_factor_service_errors!(body)
+      errors = body.kind_of?(Hash) ? Array(body["serviceErrors"]) : []
+      return if errors.empty?
+
+      message = errors.map { |error| "#{error['message']} (#{error['code']})" }.join(" ")
+      message += " This Apple ID has no trusted devices: signing in to it on an Apple device adds one." if body["noTrustedDevices"]
+      raise Tunes::Error.new, "Apple could not start two-factor authentication: #{message}"
+    end
+
     def handle_two_step(response)
       if response.body.fetch("securityCode", {})["tooManyCodesLock"].to_s.length > 0
         raise Tunes::Error.new, "Too many verification codes have been sent. Enter the last code you received, use one of your devices, or try again later."

data/supply/lib/supply/options.rb

@@ -108,6 +108,7 @@ module Supply
                                      conflicting_options: [:issuer, :key, :json_key],
                                      optional: true,
                                      description: "The raw content of a Google credentials JSON file (Application Default, Workload Identity, or Service Account), used to authenticate with Google",
+                                     sensitive: true,
                                      code_gen_sensitive: true,
                                      default_value: CredentialsManager::AppfileConfig.try_fetch_value(:json_key_data_raw),
                                      default_value_dynamic: true,

data/supply/lib/supply.rb

@@ -2,7 +2,6 @@ require 'json'
 require 'supply/options'
 require 'supply/client'
 require 'supply/listing'
-require 'supply/apk_listing'
 require 'supply/image_listing'
 require 'supply/generated_universal_apk'
 require 'supply/release_listing'