fastlane 2.241.0 → 2.241.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 696cd16eb3defc78305bdebccbc787402841c1105199cfd437d15f019e617024
-  data.tar.gz: ab772bcd92b21da5da03746f3e7bdab86e60f5ff6771696e2beb5cbd5c673b4d
+  metadata.gz: de93b89428a3de2726024a5c924723c7fcb3f3096402884e4139749e8d22cb39
+  data.tar.gz: 25aa9615e76bb0f0e503ebf6cad2170178938f249027994b8b463ce45bd94403
 SHA512:
-  metadata.gz: fb16eaacf91b754e72424d9780054f13b49040aadb738c86746dba6fa75ff3e275af98621aeda98794b47a1a3ad982d91071b6c9b1642da7e243a0d187a86739
-  data.tar.gz: e116e4c1c5f59831e65a20e676f9f8735807ae86929efb06bc5d97d97e11182361ea2d783c9da2ced56276f6d2183bfbfd863e5fcb7e7add57f5f1961543e84f
+  metadata.gz: a3ae511471c7729e7854ac3aa91ea06d2ceb306e87b7e968aab9be77ce05d0ba6e3b127e3e720598380084686158c2b40b2e587cf78d402b5ec1a6aebcf4e42c
+  data.tar.gz: 84016a1687602afdde1ab12f6c6dacb1f22550c6ab3c3724e79638435dea908cdcf58735519523ba670074190caddb6bb4b0fb792c359b56b181751acb0347eb

data/README.md

@@ -36,17 +36,23 @@ If the above doesn't help, please [submit an issue](https://github.com/fastlane/
 </a>
 <h4 align='center'><a href='https://twitter.com/Sujan'>Jan Piotrowski</a></h4>
 </td>
-<td id='jérôme-lacoste'>
-<a href='https://github.com/lacostej'>
-<img src='https://github.com/lacostej.png?size=200' width='140'>
+<td id='connor-tumbleson'>
+<a href='https://github.com/ibotpeaches'>
+<img src='https://github.com/ibotpeaches.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/lacostej'>Jérôme Lacoste</a></h4>
+<h4 align='center'><a href='https://twitter.com/ibotpeaches'>Connor Tumbleson</a></h4>
 </td>
-<td id='joshua-liebowitz'>
-<a href='https://github.com/taquitos'>
-<img src='https://github.com/taquitos.png?size=200' width='140'>
+<td id='olivier-halligon'>
+<a href='https://github.com/AliSoftware'>
+<img src='https://github.com/AliSoftware.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/taquitos'>Joshua Liebowitz</a></h4>
+<h4 align='center'><a href='https://twitter.com/aligatr'>Olivier Halligon</a></h4>
+</td>
+<td id='felix-krause'>
+<a href='https://github.com/KrauseFx'>
+<img src='https://github.com/KrauseFx.png?size=200' width='140'>
+</a>
+<h4 align='center'><a href='https://twitter.com/KrauseFx'>Felix Krause</a></h4>
 </td>
 <td id='josh-holtz'>
 <a href='https://github.com/joshdholtz'>
@@ -54,31 +60,25 @@ If the above doesn't help, please [submit an issue](https://github.com/fastlane/
 </a>
 <h4 align='center'><a href='https://twitter.com/joshdholtz'>Josh Holtz</a></h4>
 </td>
-<td id='stefan-natchev'>
-<a href='https://github.com/snatchev'>
-<img src='https://github.com/snatchev.png?size=200' width='140'>
-</a>
-<h4 align='center'><a href='https://twitter.com/snatchev'>Stefan Natchev</a></h4>
-</td>
 </tr>
 <tr>
-<td id='olivier-halligon'>
-<a href='https://github.com/AliSoftware'>
-<img src='https://github.com/AliSoftware.png?size=200' width='140'>
+<td id='joshua-liebowitz'>
+<a href='https://github.com/taquitos'>
+<img src='https://github.com/taquitos.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/aligatr'>Olivier Halligon</a></h4>
+<h4 align='center'><a href='https://twitter.com/taquitos'>Joshua Liebowitz</a></h4>
 </td>
-<td id='felix-krause'>
-<a href='https://github.com/KrauseFx'>
-<img src='https://github.com/KrauseFx.png?size=200' width='140'>
+<td id='jérôme-lacoste'>
+<a href='https://github.com/lacostej'>
+<img src='https://github.com/lacostej.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/KrauseFx'>Felix Krause</a></h4>
+<h4 align='center'><a href='https://twitter.com/lacostej'>Jérôme Lacoste</a></h4>
 </td>
-<td id='connor-tumbleson'>
-<a href='https://github.com/ibotpeaches'>
-<img src='https://github.com/ibotpeaches.png?size=200' width='140'>
+<td id='stefan-natchev'>
+<a href='https://github.com/snatchev'>
+<img src='https://github.com/snatchev.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/ibotpeaches'>Connor Tumbleson</a></h4>
+<h4 align='center'><a href='https://twitter.com/snatchev'>Stefan Natchev</a></h4>
 </td>
 <td id='roger-oba'>
 <a href='https://github.com/rogerluan'>
@@ -95,23 +95,23 @@ _fastlane_ wouldn't be what it is today without the countless hours these former
 
 <p id='alumni'>
 <a href='https://github.com/endocrimes'>Danielle Tomlinson</a>,
+<a href='https://github.com/max-ott'>Max Ott</a>,
 <a href='https://github.com/crazymanish'>Manish Rathi</a>,
+<a href='https://github.com/lucgrabowski'>Łukasz Grabowski</a>,
+<a href='https://github.com/mollyIV'>Daniel Jankowski</a>,
 <a href='https://github.com/ainame'>Satoshi Namai</a>,
-<a href='https://github.com/giginet'>Kohki Miki</a>,
+<a href='https://github.com/getaaron'>Aaron Brager</a>,
+<a href='https://github.com/jdee'>Jimmy Dee</a>,
+<a href='https://github.com/revolter'>Iulian Onofrei</a>,
+<a href='https://github.com/mgrebenets'>Maksym Grebenets</a>,
+<a href='https://github.com/armcburney'>Andrew McBurney</a>,
 <a href='https://github.com/lmirosevic'>Luka Mirosevic</a>,
+<a href='https://github.com/milch'>Manu Wallner</a>,
 <a href='https://github.com/minuscorp'>Jorge Revuelta H</a>,
-<a href='https://github.com/mollyIV'>Daniel Jankowski</a>,
-<a href='https://github.com/armcburney'>Andrew McBurney</a>,
-<a href='https://github.com/max-ott'>Max Ott</a>,
-<a href='https://github.com/lucgrabowski'>Łukasz Grabowski</a>,
 <a href='https://github.com/matthewellis'>Matthew Ellis</a>,
-<a href='https://github.com/jdee'>Jimmy Dee</a>,
-<a href='https://github.com/nafu'>Fumiya Nakamura</a>,
 <a href='https://github.com/hjanuschka'>Helmut Januschka</a>,
-<a href='https://github.com/milch'>Manu Wallner</a>,
-<a href='https://github.com/getaaron'>Aaron Brager</a>,
-<a href='https://github.com/mgrebenets'>Maksym Grebenets</a>,
-<a href='https://github.com/revolter'>Iulian Onofrei</a>
+<a href='https://github.com/nafu'>Fumiya Nakamura</a>,
+<a href='https://github.com/giginet'>Kohki Miki</a>
 </p>
 <!-- team:end -->
 

data/deliver/lib/deliver/app_screenshot.rb

@@ -19,6 +19,7 @@ module Deliver
       DisplayType::APP_IPHONE_61 => "iPhone 14 Pro",
       DisplayType::APP_IPHONE_65 => "iPhone XS Max",
       DisplayType::APP_IPHONE_67 => "iPhone 14 Pro Max",
+      DisplayType::APP_IPHONE_DUO => "iPhone Duo",
       DisplayType::APP_IPAD_97 => "iPad",
       DisplayType::APP_IPAD_105 => "iPad 10.5",
       DisplayType::APP_IPAD_PRO_3GEN_11 => "iPad 11",
@@ -100,6 +101,13 @@ module Deliver
         [960, 600],
         [960, 640]
       ],
+      # iPhone Duo outer and inner displays
+      DisplayType::APP_IPHONE_DUO => [
+        [1398, 2034],
+        [2034, 1398],
+        [2007, 2853],
+        [2853, 2007]
+      ],
       DisplayType::APP_IPAD_97 => [
         [1024, 748],
         [1024, 768],

data/fastlane/lib/fastlane/commands_generator.rb

@@ -144,11 +144,16 @@ module Fastlane
         c.option('-s', '--stay_alive', 'Keeps socket server up even after error or disconnects, requires CTRL-C to kill.')
         c.option('-c seconds', '--connection_timeout', 'Sets connection established timeout')
         c.option('-p port', '--port', "Sets the port on localhost for the socket connection")
+        c.option('--token_file path', "File holding the token every command must carry (default: FASTLANE_SOCKET_SERVER_TOKEN_FILE)")
         c.action do |args, options|
           default_connection_timeout = 5
           stay_alive = options.stay_alive || false
           connection_timeout = options.connection_timeout || default_connection_timeout
           port = options.port || 2000
+          token_file = options.token_file || ENV["FASTLANE_SOCKET_SERVER_TOKEN_FILE"]
+          token = File.read(token_file).strip if token_file
+          UI.user_error!("The token file #{token_file} is empty") if token_file && token.empty?
+          UI.important("No --token_file given: any local process that connects first can run actions") unless token
 
           if stay_alive && options.connection_timeout.nil?
             UI.important("stay_alive is set, but the connection timeout is not, this will give you #{default_connection_timeout} seconds to (re)connect")
@@ -162,7 +167,8 @@ module Fastlane
             command_executor: command_executor,
             connection_timeout: connection_timeout,
             stay_alive: stay_alive,
-            port: port
+            port: port,
+            token: token
           )
           result = server.start
           UI.success("Result: #{result}") if result

data/fastlane/lib/fastlane/server/socket_server.rb

@@ -3,6 +3,7 @@ require 'fastlane/server/command_parser.rb'
 require 'fastlane/server/json_return_value_processor.rb'
 require 'socket'
 require 'json'
+require 'openssl'
 
 module Fastlane
   class SocketServer
@@ -20,7 +21,8 @@ module Fastlane
       return_value_processor: nil,
       connection_timeout: 5,
       stay_alive: false,
-      port: 2000
+      port: 2000,
+      token: nil
     )
       if return_value_processor.nil?
         return_value_processor = JSONReturnValueProcessor.new
@@ -31,6 +33,8 @@ module Fastlane
       @connection_timeout = connection_timeout.to_i
       @stay_alive = stay_alive
       @port = port.to_i
+      # When set, every command must carry it: the runner reads it from a file only this user can read
+      @token = token
     end
 
     # this is the public API, don't call anything else
@@ -78,6 +82,11 @@ module Fastlane
     end
 
     def parse_and_execute_command(command_string: nil)
+      unless token_matches?(command_string)
+        UI.error("Refusing a command without this run's token: it does not come from the FastlaneRunner fastlane started")
+        return COMMAND_EXECUTION_STATE[:error]
+      end
+
       command = CommandParser.parse(json: command_string)
       case command
       when ControlCommand
@@ -137,15 +146,17 @@ module Fastlane
     end
 
     def listen
-      @server = TCPServer.open('localhost', @port) # Socket to listen on port 2000
-      UI.verbose("Waiting for #{@connection_timeout} seconds for a connection from FastlaneRunner")
+      @servers = listening_sockets
+      @port = @servers.first.local_address.ip_port
+      UI.verbose("Waiting for #{@connection_timeout} seconds for a connection from FastlaneRunner on port #{@port}")
 
-      # set thread local to ready so we can check it
+      # set thread locals so the caller can tell the runner where to connect
+      Thread.current[:port] = @port
       Thread.current[:ready] = true
       @client = nil
       begin
         Timeout.timeout(@connection_timeout) do
-          @client = @server.accept # Wait for a client to connect
+          @client = accept_first_connection
         end
       rescue Timeout::Error
         UI.user_error!("fastlane failed to receive a connection from the FastlaneRunner binary after #{@connection_timeout} seconds, shutting down")
@@ -166,8 +177,47 @@ module Fastlane
       @client.close
       @client = nil
 
-      @server.close
-      @server = nil
+      close_servers
+    end
+
+    # A socket on every address localhost resolves to. The runner connects to
+    # `localhost` and tries those addresses in turn, so another process listening
+    # on one this server did not take would receive its commands.
+    def listening_sockets
+      # Port 0: a free port, the same on every address
+      return Socket.tcp_server_sockets('localhost', 0) if @port.zero?
+
+      sockets = []
+      Addrinfo.getaddrinfo('localhost', @port, nil, :STREAM).uniq(&:ip_address).each do |address|
+        sockets << address.listen
+      rescue SystemCallError => e
+        sockets.each(&:close)
+        UI.user_error!("fastlane could not listen on #{address.inspect_sockaddr} for the FastlaneRunner binary: #{e.message}")
+      end
+      sockets
+    end
+
+    # The first connection on any of the sockets. They are closed once it is
+    # accepted, so nothing else can connect while the runner is talking to us.
+    def accept_first_connection
+      ready, = IO.select(@servers)
+      ready.first.accept.first
+    ensure
+      close_servers
+    end
+
+    def token_matches?(command_string)
+      return true if @token.nil?
+
+      token = JSON.parse(command_string)['token']
+      token.kind_of?(String) && OpenSSL.secure_compare(token, @token)
+    rescue JSON::ParserError, TypeError
+      false
+    end
+
+    def close_servers
+      (@servers || []).each { |server| server.close unless server.closed? }
+      @servers = nil
     end
 
     # record fastlane action command and then execute it

data/fastlane/lib/fastlane/swift_lane_manager.rb

@@ -1,10 +1,12 @@
 require_relative 'lane_manager_base.rb'
 require_relative 'swift_runner_upgrader.rb'
+require 'securerandom'
+require 'tmpdir'
 
 module Fastlane
   class SwiftLaneManager < LaneManagerBase
     # The runner protocol version this fastlane ships, see main.swift
-    RUNNER_PROTOCOL_VERSION = 1
+    RUNNER_PROTOCOL_VERSION = 2
     RUNNER_PROTOCOL_VERSION_REGEX = /FastlaneRunnerProtocolVersion \[(\d+)\]/
 
     # @param lane_name The name of the lane to execute
@@ -31,15 +33,25 @@ module Fastlane
 
         self.ensure_runner_built!
         self.warn_if_runner_outdated
-        swift_server_port ||= 2000
-        socket_thread = self.start_socket_thread(port: swift_server_port)
-        sleep(0.250) while socket_thread[:ready].nil?
+        # A secret only this user can read, which the runner sends back with every command
+        token_dir = Dir.mktmpdir('fastlane-runner')
+        token_file = File.join(token_dir, 'token')
+        token = SecureRandom.hex(32)
+        File.write(token_file, token, perm: 0o600)
+        token = nil unless self.runner_sends_token?
+        # Port 0 lets the server pick a free port, which no other process can take beforehand
+        socket_thread = self.start_socket_thread(port: swift_server_port || 0, token: token)
+        sleep(0.250) while socket_thread[:ready].nil? && socket_thread.alive?
+        # The thread ended without listening: join raises its error rather than waiting forever
+        socket_thread.join unless socket_thread[:ready]
         # wait on socket_thread to be in ready state, then start the runner thread
-        self.cruise_swift_lane_in_thread(lane, parameters, swift_server_port)
+        self.cruise_swift_lane_in_thread(lane, parameters, socket_thread[:port], token_file)
 
         socket_thread.value
       rescue Exception => ex # rubocop:disable Lint/RescueException
         e = ex
+      ensure
+        FileUtils.remove_entry(token_dir) if token_dir
       end
       # If we have a thread exception, drop that in the exception
       # won't ever have a situation where e is non-nil, and socket_thread[:exception] is also non-nil
@@ -84,14 +96,14 @@ module Fastlane
       end
     end
 
-    def self.cruise_swift_lane_in_thread(lane, parameters = nil, swift_server_port)
+    def self.cruise_swift_lane_in_thread(lane, parameters = nil, swift_server_port, token_file)
       if parameters.nil?
         parameters = {}
       end
 
       parameter_string = ""
       parameters.each do |key, value|
-        parameter_string += " #{key} #{value}"
+        parameter_string += " #{key.to_s.shellescape} #{value.to_s.shellescape}"
       end
 
       if FastlaneCore::Globals.verbose?
@@ -99,13 +111,16 @@ module Fastlane
       end
 
       parameter_string += " swiftServerPort #{swift_server_port}"
+      parameter_string += " swiftServerTokenFile #{token_file.shellescape}"
+
+      command = "#{FastlaneCore::FastlaneFolder.swift_runner_path.shellescape} lane #{lane.to_s.shellescape}#{parameter_string}"
 
       return Thread.new do
         if FastlaneCore::Globals.verbose?
-          return_value = Actions.sh(%(#{FastlaneCore::FastlaneFolder.swift_runner_path} lane #{lane}#{parameter_string}))
+          return_value = Actions.sh(command)
           UI.message("runner output: ".yellow + return_value)
         else
-          Actions.sh(%(#{FastlaneCore::FastlaneFolder.swift_runner_path} lane #{lane}#{parameter_string} > /dev/null))
+          Actions.sh("#{command} > /dev/null")
         end
       end
     end
@@ -223,13 +238,13 @@ module Fastlane
       return project_modified
     end
 
-    def self.start_socket_thread(port: nil)
+    def self.start_socket_thread(port: nil, token: nil)
       require 'fastlane/server/socket_server'
       require 'fastlane/server/socket_server_action_command_executor'
 
       return Thread.new do
         command_executor = SocketServerActionCommandExecutor.new
-        server = Fastlane::SocketServer.new(command_executor: command_executor, port: port)
+        server = Fastlane::SocketServer.new(command_executor: command_executor, port: port, token: token)
         server.start
       end
     end
@@ -245,6 +260,12 @@ module Fastlane
       UI.important("Your FastlaneRunner is outdated for this version of fastlane. Run a lane outside CI, without `disable_runner_upgrades`, to update it, then commit the changes.")
     end
 
+    # Runners from protocol version 2 send the run's token with every command; older ones get warn_if_runner_outdated.
+    # Version 1 was released before the token existed.
+    def self.runner_sends_token?
+      runner_protocol_version >= 2
+    end
+
     def self.ensure_runner_built!
       UI.verbose("Checking for new user-provided tool configuration files")
       # if self.link_user_configs_to_project returns true, that means we need to rebuild the runner

data/fastlane/lib/fastlane/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
-  VERSION = '2.241.0'.freeze
+  VERSION = '2.241.2'.freeze
   SUMMARY = "The easiest way to build and release mobile apps.".freeze
   DESCRIPTION = "The easiest way to automate beta deployments and releases for your iOS and Android apps".freeze
   MINIMUM_XCODE_RELEASE = "7.0".freeze

data/fastlane/swift/ArgumentProcessor.swift

@@ -11,6 +11,10 @@
 import Foundation
 
 struct ArgumentProcessor {
+    /// The secret fastlane wrote to a file only this user can read: sent with every command so that
+    /// fastlane can tell this runner from another process that connected to its port
+    static var serverToken: String?
+
     let args: [RunnerArgument]
     let currentLane: String
     let commandTimeout: Int
@@ -33,6 +37,10 @@ struct ArgumentProcessor {
 
         port = UInt32(fastlaneArgsMinusLanes.first(where: { $0.name == "swiftServerPort" })?.value ?? "") ?? 2000
 
+        if let tokenFile = fastlaneArgsMinusLanes.first(where: { $0.name == "swiftServerTokenFile" })?.value {
+            ArgumentProcessor.serverToken = (try? String(contentsOfFile: tokenFile, encoding: .utf8))?.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+
         // Configure logMode since we might need to use it before we finish parsing
         if let logModeArg = potentialLogMode.first {
             let logModeString = logModeArg.value
@@ -74,7 +82,7 @@ struct ArgumentProcessor {
     func laneParameters() -> [String: String] {
         let laneParametersArgs = args.filter { arg in
             let lowercasedName = arg.name.lowercased()
-            return lowercasedName != "timeoutseconds" && lowercasedName != "lane" && lowercasedName != "logmode"
+            return lowercasedName != "timeoutseconds" && lowercasedName != "lane" && lowercasedName != "logmode" && lowercasedName != "swiftservertokenfile"
         }
         var laneParameters = [String: String]()
         for arg in laneParametersArgs {
@@ -86,4 +94,4 @@ struct ArgumentProcessor {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.2]
+// FastlaneRunnerAPIVersion [0.9.3]

data/fastlane/swift/Deliverfile.swift

@@ -17,4 +17,4 @@ public class Deliverfile: DeliverfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/DeliverfileProtocol.swift

@@ -539,4 +539,4 @@ public extension DeliverfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.156]
+// FastlaneRunnerAPIVersion [0.9.158]

data/fastlane/swift/Fastlane.swift

@@ -3437,8 +3437,6 @@ public func createAppOnManagedPlayStore(jsonKey: OptionalConfigValue<String?> =
 
  - parameters:
    - username: Your Apple ID Username
-   - apiKeyPath: Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)
-   - apiKey: Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-hash-option)
    - appIdentifier: App Identifier (Bundle ID, e.g. com.krausefx.app)
    - bundleIdentifierSuffix: App Identifier Suffix (Ignored if App Identifier does not end with .*)
    - appName: App Name
@@ -3463,8 +3461,6 @@ public func createAppOnManagedPlayStore(jsonKey: OptionalConfigValue<String?> =
  For more information about _produce_, visit its documentation page: [https://docs.fastlane.tools/actions/produce/](https://docs.fastlane.tools/actions/produce/).
  */
 public func createAppOnline(username: String,
-                            apiKeyPath: OptionalConfigValue<String?> = .fastlaneDefault(nil),
-                            apiKey: OptionalConfigValue<[String: Any]?> = .fastlaneDefault(nil),
                             appIdentifier: String,
                             bundleIdentifierSuffix: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                             appName: String,
@@ -3485,8 +3481,6 @@ public func createAppOnline(username: String,
                             itcTeamName: OptionalConfigValue<String?> = .fastlaneDefault(nil))
 {
     let usernameArg = RubyCommand.Argument(name: "username", value: username, type: nil)
-    let apiKeyPathArg = apiKeyPath.asRubyArgument(name: "api_key_path", type: nil)
-    let apiKeyArg = apiKey.asRubyArgument(name: "api_key", type: nil)
     let appIdentifierArg = RubyCommand.Argument(name: "app_identifier", value: appIdentifier, type: nil)
     let bundleIdentifierSuffixArg = bundleIdentifierSuffix.asRubyArgument(name: "bundle_identifier_suffix", type: nil)
     let appNameArg = RubyCommand.Argument(name: "app_name", value: appName, type: nil)
@@ -3506,8 +3500,6 @@ public func createAppOnline(username: String,
     let itcTeamIdArg = RubyCommand.Argument(name: "itc_team_id", value: itcTeamId, type: nil)
     let itcTeamNameArg = itcTeamName.asRubyArgument(name: "itc_team_name", type: nil)
     let array: [RubyCommand.Argument?] = [usernameArg,
-                                          apiKeyPathArg,
-                                          apiKeyArg,
                                           appIdentifierArg,
                                           bundleIdentifierSuffixArg,
                                           appNameArg,
@@ -8437,8 +8429,6 @@ public func println(message: OptionalConfigValue<String?> = .fastlaneDefault(nil
 
  - parameters:
    - username: Your Apple ID Username
-   - apiKeyPath: Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)
-   - apiKey: Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-hash-option)
    - appIdentifier: App Identifier (Bundle ID, e.g. com.krausefx.app)
    - bundleIdentifierSuffix: App Identifier Suffix (Ignored if App Identifier does not end with .*)
    - appName: App Name
@@ -8463,8 +8453,6 @@ public func println(message: OptionalConfigValue<String?> = .fastlaneDefault(nil
  For more information about _produce_, visit its documentation page: [https://docs.fastlane.tools/actions/produce/](https://docs.fastlane.tools/actions/produce/).
  */
 public func produce(username: String,
-                    apiKeyPath: OptionalConfigValue<String?> = .fastlaneDefault(nil),
-                    apiKey: OptionalConfigValue<[String: Any]?> = .fastlaneDefault(nil),
                     appIdentifier: String,
                     bundleIdentifierSuffix: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                     appName: String,
@@ -8485,8 +8473,6 @@ public func produce(username: String,
                     itcTeamName: OptionalConfigValue<String?> = .fastlaneDefault(nil))
 {
     let usernameArg = RubyCommand.Argument(name: "username", value: username, type: nil)
-    let apiKeyPathArg = apiKeyPath.asRubyArgument(name: "api_key_path", type: nil)
-    let apiKeyArg = apiKey.asRubyArgument(name: "api_key", type: nil)
     let appIdentifierArg = RubyCommand.Argument(name: "app_identifier", value: appIdentifier, type: nil)
     let bundleIdentifierSuffixArg = bundleIdentifierSuffix.asRubyArgument(name: "bundle_identifier_suffix", type: nil)
     let appNameArg = RubyCommand.Argument(name: "app_name", value: appName, type: nil)
@@ -8506,8 +8492,6 @@ public func produce(username: String,
     let itcTeamIdArg = RubyCommand.Argument(name: "itc_team_id", value: itcTeamId, type: nil)
     let itcTeamNameArg = itcTeamName.asRubyArgument(name: "itc_team_name", type: nil)
     let array: [RubyCommand.Argument?] = [usernameArg,
-                                          apiKeyPathArg,
-                                          apiKeyArg,
                                           appIdentifierArg,
                                           bundleIdentifierSuffixArg,
                                           appNameArg,
@@ -12621,7 +12605,7 @@ public func updateProjectProvisioning(xcodeproj: OptionalConfigValue<String?> =
                                       targetFilter: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                                       buildConfigurationFilter: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                                       buildConfiguration: OptionalConfigValue<String?> = .fastlaneDefault(nil),
-                                      certificate: String = "/var/folders/36/tjdph2t965j8snz9_vkdnw0r0000gn/T/AppleIncRootCertificate.cer",
+                                      certificate: String = "/var/folders/n6/hn37q6pj7sj_9dmqqc2113800000gn/T/AppleIncRootCertificate.cer",
                                       codeSigningIdentity: OptionalConfigValue<String?> = .fastlaneDefault(nil))
 {
     let xcodeprojArg = xcodeproj.asRubyArgument(name: "xcodeproj", type: nil)
@@ -14261,4 +14245,4 @@ public let snapshotfile: Snapshotfile = .init()
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.209]
+// FastlaneRunnerAPIVersion [0.9.211]

data/fastlane/swift/Gymfile.swift

@@ -17,4 +17,4 @@ public class Gymfile: GymfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/GymfileProtocol.swift

@@ -399,4 +399,4 @@ public extension GymfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.159]
+// FastlaneRunnerAPIVersion [0.9.161]

data/fastlane/swift/MainProcess.swift

@@ -42,12 +42,21 @@ class MainProcess {
             killExistingSocketServerProcesses(port: argumentProcessor.port)
             abortIfPortIsInUse(argumentProcessor.port)
 
+            let serverToken = createServerToken()
+            ArgumentProcessor.serverToken = serverToken.token
+
             rubySocketCommand = Process()
             rubySocketCommand.launchPath = "/usr/bin/env"
             rubySocketCommand.arguments = fastlaneLaunchArguments() + ["socket_server", "-c", String(timeout), "-p", String(argumentProcessor.port)]
+            // An environment variable rather than --token_file, so that an older fastlane still starts
+            var environment = ProcessInfo.processInfo.environment
+            environment["FASTLANE_SOCKET_SERVER_TOKEN_FILE"] = serverToken.file
+            rubySocketCommand.environment = environment
             rubySocketCommand.launch()
 
             waitUntilSocketServerIsListening(port: argumentProcessor.port, serverProcess: rubySocketCommand)
+            // socket_server read the token when it started
+            try? FileManager.default.removeItem(atPath: serverToken.directory)
             thread.start()
         #endif
     }
@@ -78,6 +87,24 @@ class MainProcess {
             return ["bundle", "exec", "fastlane"]
         }
 
+        /// A random token in a file only this user can read, which socket_server requires on every command and the runner sends
+        func createServerToken() -> (token: String, directory: String, file: String) {
+            var template = Array((NSTemporaryDirectory() as NSString).appendingPathComponent("fastlane-runner.XXXXXX").utf8CString)
+            guard let created = mkdtemp(&template), let random = FileHandle(forReadingAtPath: "/dev/urandom") else {
+                log(message: "Could not create the token for fastlane socket_server")
+                exit(1)
+            }
+            let directory = String(cString: created)
+            let token = random.readData(ofLength: 32).map { String(format: "%02x", $0) }.joined()
+            random.closeFile()
+            let file = directory + "/token"
+            guard token.count == 64, FileManager.default.createFile(atPath: file, contents: token.data(using: .utf8), attributes: [.posixPermissions: 0o600]) else {
+                log(message: "Could not create the token for fastlane socket_server")
+                exit(1)
+            }
+            return (token, directory, file)
+        }
+
         /// The directory of the Gemfile Bundler would use: BUNDLE_GEMFILE, else the
         /// nearest Gemfile or gems.rb from the working directory up.
         func bundleRootDirectory() -> String? {

data/fastlane/swift/Matchfile.swift

@@ -17,4 +17,4 @@ public class Matchfile: MatchfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/MatchfileProtocol.swift

@@ -420,4 +420,4 @@ public extension MatchfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.153]
+// FastlaneRunnerAPIVersion [0.9.155]

data/fastlane/swift/Precheckfile.swift

@@ -17,4 +17,4 @@ public class Precheckfile: PrecheckfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/PrecheckfileProtocol.swift

@@ -84,4 +84,4 @@ public extension PrecheckfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.152]
+// FastlaneRunnerAPIVersion [0.9.154]

data/fastlane/swift/RubyCommand.swift

@@ -81,15 +81,7 @@ struct RubyCommand: RubyCommandable {
 
     var closure: ((String) -> Void)? {
         let callbacks = args.filter { ($0.type != nil) && $0.type == .stringClosure }
-        guard let callback = callbacks.first else {
-            return nil
-        }
-
-        guard let callbackArgValue = callback.value else {
-            return nil
-        }
-
-        guard let callbackClosure = callbackArgValue as? ((String) -> Void) else {
+        guard let callback = callbacks.first, let callbackArgValue = callback.value, let callbackClosure = callbackArgValue as? ((String) -> Void) else {
             return nil
         }
         return callbackClosure

data/fastlane/swift/RubyCommandable.swift

@@ -32,12 +32,13 @@ protocol RubyCommandable {
 
 extension RubyCommandable {
     var json: String {
+        let token = ArgumentProcessor.serverToken.map { ", \"token\": \"\($0)\"" } ?? ""
         return """
-        { "commandType": "\(type.token)", "command": \(commandJson) }
+        { "commandType": "\(type.token)", "command": \(commandJson)\(token) }
         """
     }
 }
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.2]
+// FastlaneRunnerAPIVersion [0.9.3]

data/fastlane/swift/Scanfile.swift

@@ -17,4 +17,4 @@ public class Scanfile: ScanfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/ScanfileProtocol.swift

@@ -595,4 +595,4 @@ public extension ScanfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.164]
+// FastlaneRunnerAPIVersion [0.9.166]

data/fastlane/swift/Screengrabfile.swift

@@ -17,4 +17,4 @@ public class Screengrabfile: ScreengrabfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/ScreengrabfileProtocol.swift

@@ -161,4 +161,4 @@ public extension ScreengrabfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.154]
+// FastlaneRunnerAPIVersion [0.9.156]

data/fastlane/swift/Snapshotfile.swift

@@ -17,4 +17,4 @@ public class Snapshotfile: SnapshotfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.0
+// Generated with fastlane 2.241.2

data/fastlane/swift/SnapshotfileProtocol.swift

@@ -385,4 +385,4 @@ public extension SnapshotfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.148]
+// FastlaneRunnerAPIVersion [0.9.150]

data/fastlane/swift/main.swift

@@ -12,7 +12,7 @@ import Foundation
 
 let argumentProcessor = ArgumentProcessor(args: CommandLine.arguments)
 /// fastlane reads this from the built runner, to tell whether it is outdated. Increase it when the runner changes how it talks to fastlane.
-let runnerProtocolVersion = "FastlaneRunnerProtocolVersion [1]"
+let runnerProtocolVersion = "FastlaneRunnerProtocolVersion [2]"
 verbose(message: runnerProtocolVersion)
 let timeout = argumentProcessor.commandTimeout
 

data/fastlane_core/lib/fastlane_core/itunes_transporter.rb

@@ -58,30 +58,44 @@ module FastlaneCore
     # Runs preparations before executing any command from the executor.
     #
     # @param original_api_key [Hash] api key containing the issuer id and private key
-    # @return [Hash] copy of `api_key` which includes an extra `key_dir` with the location of the .p8 file on disk
+    # @return [Hash] copy of `api_key` which includes an extra `key_dir` with the location of the .p8 file on disk,
+    #   and `cleanup_path`: what #cleanup removes afterwards
     def prepare(original_api_key:)
       return if original_api_key.nil?
       # Create .p8 file from api_key and provide api key info which contains .p8 file path
       api_key = original_api_key.dup
+      p8_name = "AuthKey_#{api_key[:key_id]}.p8"
       if self.kind_of?(ShellScriptTransporterExecutor)
         # as of Transporter v3.3.0, the app is unable to detect the private keys under the 'private_keys' folder in current directory
         # so we must rely on the other search paths in the Home dir:
         # https://help.apple.com/itc/transporteruserguide/en.lproj/static.html#itc803b7be80
         private_keys_dir = File.join(Dir.home, ".appstoreconnect/private_keys")
         unless Dir.exist?(private_keys_dir)
-          FileUtils.mkdir_p(private_keys_dir)
+          FileUtils.mkdir_p(private_keys_dir, mode: 0o700)
         end
         api_key[:key_dir] = private_keys_dir
+        # Keys already there belong to the user: only remove the one written below
+        p8_path = File.join(private_keys_dir, p8_name)
+        api_key[:cleanup_path] = p8_path unless File.exist?(p8_path)
       else
         api_key[:key_dir] = Dir.mktmpdir("deliver-")
+        api_key[:cleanup_path] = api_key[:key_dir]
       end
       # Specified p8 needs to be generated to call altool or iTMSTransporter
-      File.open(File.join(api_key[:key_dir], "AuthKey_#{api_key[:key_id]}.p8"), "wb") do |p8|
+      p8_path = File.join(api_key[:key_dir], p8_name)
+      File.open(p8_path, "wb", 0o600) do |p8|
         p8.write(api_key[:key])
       end
+      File.chmod(0o600, p8_path)
       api_key
     end
 
+    # Removes what #prepare wrote: its temporary directory, or the key file it added to ~/.appstoreconnect/private_keys
+    def cleanup(api_key)
+      return if api_key.nil? || api_key[:cleanup_path].nil?
+      FileUtils.rm_rf(api_key[:cleanup_path])
+    end
+
     def execute(command, hide_output)
       if Helper.test?
         yield(nil) if block_given?
@@ -869,7 +883,7 @@ module FastlaneCore
         return upload(app_id, dir, package_path: package_path, asset_path: asset_path)
       ensure
         if use_api_key
-          FileUtils.rm_rf(api_key[:key_dir]) unless api_key.nil?
+          @transporter_executor.cleanup(api_key)
         end
       end
 
@@ -967,7 +981,7 @@ module FastlaneCore
         return provider_ids
       ensure
         if use_api_key
-          FileUtils.rm_rf(api_key[:key_dir]) unless api_key.nil?
+          @transporter_executor.cleanup(api_key)
         end
       end
 

data/match/lib/match/runner.rb

@@ -387,6 +387,8 @@ module Match
 
       if Helper.mac?
         installed_profile = FastlaneCore::ProvisioningProfile.install(stored_profile_path, keychain_path)
+      else
+        UI.message("Skipping installation of provisioning profile as it would not work on this operating system.")
       end
 
       if params[:output_path]

data/match/lib/match/storage/gitlab/secure_file.rb

@@ -2,6 +2,7 @@ require 'open-uri'
 require 'ostruct'
 
 require_relative '../../module'
+require_relative '../interface'
 
 module Match
   module Storage
@@ -36,7 +37,7 @@ module Match
           url = URI("#{file_url}/download")
 
           begin
-            destination_file = "#{working_directory}/#{@file.name}"
+            destination_file = Storage.download_path(working_directory, @file.name)
 
             create_subfolders(working_directory)
             File.open(destination_file, "wb") do |saved_file|

data/match/lib/match/storage/google_cloud_storage.rb

@@ -158,7 +158,7 @@ module Match
 
         bucket.files.each do |current_file|
           file_path = current_file.name # e.g. "N8X438SEU2/certs/distribution/XD9G7QCACF.cer"
-          download_path = File.join(self.working_directory, file_path)
+          download_path = Storage.download_path(self.working_directory, file_path)
 
           FileUtils.mkdir_p(File.expand_path("..", download_path))
           UI.verbose("Downloading file from Google Cloud Storage '#{file_path}' on bucket #{self.bucket_name}")

data/match/lib/match/storage/interface.rb

@@ -2,6 +2,16 @@ require_relative '../module'
 
 module Match
   module Storage
+    # Where a file named `remote_name` by the storage is written in `working_directory`.
+    # Fails when the name would place it outside, e.g. with `..` segments.
+    def self.download_path(working_directory, remote_name)
+      root = File.expand_path(working_directory)
+      path = File.expand_path(File.join(root, remote_name))
+      return path if path.start_with?(root + File::SEPARATOR)
+
+      UI.user_error!("Refusing to download #{remote_name.inspect}: it would be written outside #{root}")
+    end
+
     class Interface
       MATCH_VERSION_FILE_NAME = "match_version.txt"
       # The working directory in which we download all the profiles

data/match/lib/match/storage/s3_storage.rb

@@ -114,7 +114,7 @@ module Match
           file_path = strip_s3_object_prefix(object.key) # :s3_object_prefix:team_id/path/to/file
 
           # strip s3_prefix from file_path
-          download_path = File.join(self.working_directory, file_path)
+          download_path = Storage.download_path(self.working_directory, file_path)
 
           FileUtils.mkdir_p(File.expand_path("..", download_path))
           UI.verbose("Downloading file from S3 '#{file_path}' on bucket #{self.s3_bucket}")

data/produce/lib/produce/developer_center.rb

@@ -1,7 +1,5 @@
-require 'ostruct'
 require 'spaceship'
 require_relative 'module'
-require_relative 'service'
 
 module Produce
   class DeveloperCenter
@@ -88,8 +86,6 @@ module Produce
     end
 
     def create_new_app
-      return create_new_app_via_connect_api if using_connect_api?
-
       ENV["CREATED_NEW_APP_ID"] = Time.now.to_i.to_s
       if app_exists?
         UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
@@ -122,31 +118,6 @@ module Produce
       return true
     end
 
-    # App Store Connect API key path — used instead of Spaceship.login.
-    def create_new_app_via_connect_api
-      config_enabled_services = Produce.config[:enable_services] || Produce.config[:enabled_features]
-
-      existing = Spaceship::ConnectAPI::BundleId.find(app_identifier)
-      if existing
-        UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
-        return true
-      end
-
-      app_name = Produce.config[:app_name]
-      UI.message("Creating new app '#{app_name}' on the Apple Dev Center")
-
-      connect_api_platform = Spaceship::ConnectAPI::BundleIdPlatform.map(platform)
-      bundle_id = Spaceship::ConnectAPI::BundleId.create(name: app_name, platform: connect_api_platform, identifier: app_identifier)
-
-      UI.crash!("Something went wrong when creating the new app - it's not listed in the apps list") unless bundle_id
-
-      UI.message("Created app #{bundle_id.id}")
-      enable_inline_services(config_enabled_services) if config_enabled_services && !config_enabled_services.empty?
-      UI.success("Finished creating new app '#{app_name}' on the Dev Center")
-
-      return true
-    end
-
     def enable_services
       app_service = Spaceship.app_service
       enabled_clean_options = {}
@@ -190,17 +161,6 @@ module Produce
 
     private
 
-    # Delegates to Service#update instead of duplicating its ~40-capability mapping.
-    # Skips any capability explicitly marked "off" — meaningless on a brand-new app.
-    def enable_inline_services(config_enabled_services)
-      to_enable = config_enabled_services.reject { |_, v| v == SERVICE_OFF }
-      return if to_enable.empty?
-
-      options = OpenStruct.new(to_enable)
-      options.define_singleton_method(:__hash__) { to_enable }
-      Produce::Service.new.update(true, options)
-    end
-
     def platform
       # This was added to support creation of multiple platforms
       # Produce::ItunesConnect can take an array of platforms to create for App Store Connect
@@ -214,16 +174,9 @@ module Produce
       Spaceship.app.find(app_identifier, mac: platform == "osx") != nil
     end
 
-    def using_connect_api?
-      !connect_api_token.nil?
-    end
-
-    def connect_api_token
-      Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path])
-    end
-
     def login
-      Produce.authenticate_connect_api!
+      Spaceship.login(Produce.config[:username], nil)
+      Spaceship.select_team
     end
   end
 end

data/produce/lib/produce/module.rb

@@ -1,5 +1,4 @@
 require 'fastlane_core/helper'
-require 'spaceship'
 
 module Produce
   class << self
@@ -12,24 +11,4 @@ module Produce
 
   ENV['FASTLANE_TEAM_ID'] ||= ENV["PRODUCE_TEAM_ID"]
   ENV['DELIVER_USER'] ||= ENV["PRODUCE_USERNAME"]
-
-  # Shared by DeveloperCenter#login and Service#bundle_id. Prefers a configured API key, falls
-  # back to a token already set by another lane (e.g. app_store_connect_api_key), then falls
-  # back to username-based session login.
-  def self.authenticate_connect_api!
-    if (token = Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path]))
-      UI.message("Authenticating with App Store Connect API Key")
-
-      # `current_team_id:` avoids a live, session-based team_id lookup elsewhere in
-      # ConnectAPI's provisioning client, which has no session to use here.
-      Spaceship::ConnectAPI.client = Spaceship::ConnectAPI::Client.new(token: token, current_team_id: Produce.config[:team_id])
-    elsif !Spaceship::ConnectAPI.token.nil?
-      UI.message("Using existing authorization token for App Store Connect API")
-    else
-      UI.message("Starting login with user '#{Produce.config[:username]}'")
-      Spaceship.login(Produce.config[:username], nil)
-      Spaceship.select_team
-      UI.message("Successfully logged in")
-    end
-  end
 end

data/produce/lib/produce/options.rb

@@ -17,23 +17,6 @@ module Produce
                                      code_gen_sensitive: true,
                                      default_value: user,
                                      default_value_dynamic: true),
-
-        # App Store Connect API
-        FastlaneCore::ConfigItem.new(key: :api_key_path,
-                                     env_names: ["PRODUCE_API_KEY_PATH", "APP_STORE_CONNECT_API_KEY_PATH"],
-                                     description: "Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)",
-                                     optional: true,
-                                     conflicting_options: [:api_key],
-                                     verify_block: proc do |value|
-                                       UI.user_error!("Couldn't find API key JSON file at path '#{value}'") unless File.exist?(value)
-                                     end),
-        FastlaneCore::ConfigItem.new(key: :api_key,
-                                     env_names: ["PRODUCE_API_KEY", "APP_STORE_CONNECT_API_KEY"],
-                                     description: "Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-hash-option)",
-                                     type: Hash,
-                                     optional: true,
-                                     sensitive: true,
-                                     conflicting_options: [:api_key_path]),
         FastlaneCore::ConfigItem.new(key: :app_identifier,
                                      env_name: "PRODUCE_APP_IDENTIFIER",
                                      short_option: "-a",

data/produce/lib/produce/service.rb

@@ -419,9 +419,10 @@ module Produce
 
     def bundle_id
       return @bundle_id if @bundle_id
-
-      Produce.authenticate_connect_api!
-
+      UI.message("Starting login with user '#{Produce.config[:username]}'")
+      Spaceship.login(Produce.config[:username], nil)
+      Spaceship.select_team
+      UI.message("Successfully logged in")
       @bundle_id ||= Spaceship::ConnectAPI::BundleId.find(Produce.config[:app_identifier].to_s)
     end
   end

data/sigh/lib/sigh/manager.rb

@@ -41,7 +41,11 @@ module Sigh
       ENV["SIGH_UDID"] = ENV["SIGH_UUID"] = uuid if uuid
       ENV["SIGH_NAME"] = name if name
 
-      FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      if Helper.mac?
+        FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      else
+        UI.message("Skipping installation of provisioning profile as it would not work on this operating system.")
+      end
     end
   end
 end

data/snapshot/lib/snapshot/reports_generator.rb

@@ -84,6 +84,8 @@ module Snapshot
       {
         # snapshot in Xcode 9 saves screenshots with the SIMULATOR_DEVICE_NAME
         # which includes spaces
+        'iPhone 18 Pro Max' => "iPhone 18 Pro Max",
+        'iPhone 18 Pro' => "iPhone 18 Pro",
         'iPhone 17 Pro Max' => "iPhone 17 Pro Max",
         'iPhone 17 Pro' => "iPhone 17 Pro",
         'iPhone 17' => "iPhone 17",

data/spaceship/lib/spaceship/client.rb

@@ -252,6 +252,8 @@ module Spaceship
         else
           # Log to file by default
           path = File.join(Dir.tmpdir, "spaceship#{Time.now.to_i}_#{Process.pid}_#{Thread.current.object_id}.log")
+          # The log holds every request and response body: create it readable by its owner only
+          File.open(path, File::WRONLY | File::CREAT | File::APPEND, 0o600) {}
           @logger = Logger.new(path)
         end
 
@@ -279,10 +281,12 @@ module Spaceship
     def store_cookie(path: nil)
       path ||= persistent_cookie_path
       FileUtils.mkdir_p(File.expand_path("..", path))
+      File.chmod(0o700, File.expand_path("..", path))
 
       # really important to specify the session to true
       # otherwise myacinfo and more won't be stored
       @cookie.save(path, :yaml, session: true)
+      File.chmod(0o600, path)
       return File.read(path)
     end
 
@@ -880,6 +884,8 @@ module Spaceship
       begin
         if File.exist?(persistent_cookie_path)
           puts("Loading session from '#{persistent_cookie_path}'") if Spaceship::Globals.verbose?
+          File.chmod(0o700, File.expand_path("..", persistent_cookie_path))
+          File.chmod(0o600, persistent_cookie_path)
           @cookie.load(persistent_cookie_path)
           return true
         end
@@ -1144,7 +1150,7 @@ module Spaceship
 
     def log_response(method, url, response, headers = nil, &block)
       url ||= extract_key_from_block('url', &block)
-      body = response.body.kind_of?(String) ? response.body.force_encoding(Encoding::UTF_8) : response.body
+      body = response.body.kind_of?(String) ? response.body.dup.force_encoding(Encoding::UTF_8) : response.body
       logger.debug("<< #{method.upcase} #{url}: #{response.status} #{body}")
     end
 

data/spaceship/lib/spaceship/connect_api/models/app_screenshot_set.rb

@@ -19,6 +19,7 @@ module Spaceship
         APP_IPHONE_61 = "APP_IPHONE_61"
         APP_IPHONE_65 = "APP_IPHONE_65"
         APP_IPHONE_67 = "APP_IPHONE_67"
+        APP_IPHONE_DUO = "APP_IPHONE_DUO"
 
         APP_IPAD_97 = "APP_IPAD_97"
         APP_IPAD_105 = "APP_IPAD_105"
@@ -77,6 +78,7 @@ module Spaceship
           APP_IPHONE_61,
           APP_IPHONE_65,
           APP_IPHONE_67,
+          APP_IPHONE_DUO,
 
           APP_IPAD_97,
           APP_IPAD_105,

data/spaceship/lib/spaceship/connect_api/models/bundle_id.rb

@@ -81,23 +81,12 @@ module Spaceship
         return resp.to_models.first
       end
 
-      # `patch_bundle_id_capability` patches the wrong resource (bundleIds, with
-      # attributes nested inside a relationship's `data` entry) — invalid JSON:API,
-      # rejected by Apple. This uses the real per-capability endpoints instead:
-      # create to enable, PATCH to update settings, delete to disable.
       def update_capability(capability_type, enabled: false, settings: [], client: nil)
         raise "capability_type is required " if capability_type.nil?
 
         client ||= Spaceship::ConnectAPI
-        existing = get_capabilities(client: client).find { |capability| capability.is_type?(capability_type) }
-
-        if enabled
-          return create_capability(capability_type, settings: settings, client: client) unless existing
-          return existing.update!(client: client, settings: settings)
-        else
-          existing&.delete!(client: client)
-          return nil
-        end
+        resp = client.patch_bundle_id_capability(bundle_id_id: id, seed_id: seed_id, enabled: enabled, capability_type: capability_type, settings: settings)
+        return resp.to_models.first
       end
     end
   end

data/spaceship/lib/spaceship/connect_api/models/bundle_id_capability.rb

@@ -133,12 +133,6 @@ module Spaceship
         client ||= Spaceship::ConnectAPI
         client.delete_bundle_id_capability(bundle_id_capability_id: id)
       end
-
-      def update!(client: nil, enabled: true, settings: [])
-        client ||= Spaceship::ConnectAPI
-        resp = client.patch_bundle_id_capability_configuration(bundle_id_capability_id: id, enabled: enabled, settings: settings)
-        return resp.to_models.first
-      end
     end
   end
 end

data/spaceship/lib/spaceship/connect_api/provisioning/provisioning.rb

@@ -89,22 +89,6 @@ module Spaceship
           provisioning_request_client.post("#{Version::V1}/bundleIdCapabilities", body)
         end
 
-        # Modify a Capability Configuration — patches the bundleIdCapability resource
-        # directly (attributes at the top level), not the bundleId it belongs to.
-        def patch_bundle_id_capability_configuration(bundle_id_capability_id:, enabled: false, settings: [])
-          body = {
-            data: {
-              type: "bundleIdCapabilities",
-              id: bundle_id_capability_id,
-              attributes: {
-                enabled: enabled,
-                settings: settings
-              }
-            }
-          }
-          provisioning_request_client.patch("#{Version::V1}/bundleIdCapabilities/#{bundle_id_capability_id}", body)
-        end
-
         def patch_bundle_id_capability(bundle_id_id:, seed_id:, enabled: false, capability_type:, settings: [])
           body = {
             data: {

metadata

@@ -1,36 +1,36 @@
 --- !ruby/object:Gem::Specification
 name: fastlane
 version: !ruby/object:Gem::Version
-  version: 2.241.0
+  version: 2.241.2
 platform: ruby
 authors:
-- Maksym Grebenets
-- Manu Wallner
-- Jan Piotrowski
-- Fumiya Nakamura
-- Satoshi Namai
+- Josh Holtz
 - Jimmy Dee
-- Matthew Ellis
+- Joshua Liebowitz
 - Max Ott
-- Łukasz Grabowski
-- Iulian Onofrei
 - Olivier Halligon
-- Jérôme Lacoste
 - Helmut Januschka
-- Daniel Jankowski
-- Andrew McBurney
+- Satoshi Namai
+- Danielle Tomlinson
+- Manish Rathi
+- Iulian Onofrei
+- Kohki Miki
 - Jorge Revuelta H
-- Aaron Brager
-- Josh Holtz
+- Andrew McBurney
 - Connor Tumbleson
+- Jan Piotrowski
+- Maksym Grebenets
+- Manu Wallner
 - Stefan Natchev
-- Luka Mirosevic
-- Manish Rathi
+- Łukasz Grabowski
+- Matthew Ellis
 - Roger Oba
-- Kohki Miki
+- Luka Mirosevic
+- Aaron Brager
+- Fumiya Nakamura
+- Jérôme Lacoste
+- Daniel Jankowski
 - Felix Krause
-- Joshua Liebowitz
-- Danielle Tomlinson
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z