fastlane 2.241.1 → 2.241.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41082316db6260b452820acb2f6254dd8666b30092363544b46f4bf7da8a372d
-  data.tar.gz: 72020a428f0804273e1dbe44b2ae1dcac74b2eede448370932cbf63b94f3d5f4
+  metadata.gz: de93b89428a3de2726024a5c924723c7fcb3f3096402884e4139749e8d22cb39
+  data.tar.gz: 25aa9615e76bb0f0e503ebf6cad2170178938f249027994b8b463ce45bd94403
 SHA512:
-  metadata.gz: da0f67a4715290e286ef7faf42aa12b73ccc2c3de580f96807b22dda347411b0fb138c21284a91f18f983825555161bd6072556fb980d1c14976a8f76a3a1b8a
-  data.tar.gz: c22918d93563fd3181c3f4cf3fa21c48873e16b0130ac8a5453145311943dd34b822e250e85ddcbcaccfc2b843934a355e562654ce2144cfdea6f56f67011b62
+  metadata.gz: a3ae511471c7729e7854ac3aa91ea06d2ceb306e87b7e968aab9be77ce05d0ba6e3b127e3e720598380084686158c2b40b2e587cf78d402b5ec1a6aebcf4e42c
+  data.tar.gz: 84016a1687602afdde1ab12f6c6dacb1f22550c6ab3c3724e79638435dea908cdcf58735519523ba670074190caddb6bb4b0fb792c359b56b181751acb0347eb

data/README.md

@@ -30,12 +30,6 @@ If the above doesn't help, please [submit an issue](https://github.com/fastlane/
 <!-- team:start -->
 <table id='team'>
 <tr>
-<td id='stefan-natchev'>
-<a href='https://github.com/snatchev'>
-<img src='https://github.com/snatchev.png?size=200' width='140'>
-</a>
-<h4 align='center'><a href='https://twitter.com/snatchev'>Stefan Natchev</a></h4>
-</td>
 <td id='jan-piotrowski'>
 <a href='https://github.com/janpio'>
 <img src='https://github.com/janpio.png?size=200' width='140'>
@@ -48,43 +42,49 @@ If the above doesn't help, please [submit an issue](https://github.com/fastlane/
 </a>
 <h4 align='center'><a href='https://twitter.com/ibotpeaches'>Connor Tumbleson</a></h4>
 </td>
+<td id='olivier-halligon'>
+<a href='https://github.com/AliSoftware'>
+<img src='https://github.com/AliSoftware.png?size=200' width='140'>
+</a>
+<h4 align='center'><a href='https://twitter.com/aligatr'>Olivier Halligon</a></h4>
+</td>
 <td id='felix-krause'>
 <a href='https://github.com/KrauseFx'>
 <img src='https://github.com/KrauseFx.png?size=200' width='140'>
 </a>
 <h4 align='center'><a href='https://twitter.com/KrauseFx'>Felix Krause</a></h4>
 </td>
-<td id='jérôme-lacoste'>
-<a href='https://github.com/lacostej'>
-<img src='https://github.com/lacostej.png?size=200' width='140'>
+<td id='josh-holtz'>
+<a href='https://github.com/joshdholtz'>
+<img src='https://github.com/joshdholtz.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/lacostej'>Jérôme Lacoste</a></h4>
+<h4 align='center'><a href='https://twitter.com/joshdholtz'>Josh Holtz</a></h4>
 </td>
 </tr>
 <tr>
-<td id='roger-oba'>
-<a href='https://github.com/rogerluan'>
-<img src='https://github.com/rogerluan.png?size=200' width='140'>
-</a>
-<h4 align='center'><a href='https://twitter.com/rogerluan_'>Roger Oba</a></h4>
-</td>
 <td id='joshua-liebowitz'>
 <a href='https://github.com/taquitos'>
 <img src='https://github.com/taquitos.png?size=200' width='140'>
 </a>
 <h4 align='center'><a href='https://twitter.com/taquitos'>Joshua Liebowitz</a></h4>
 </td>
-<td id='olivier-halligon'>
-<a href='https://github.com/AliSoftware'>
-<img src='https://github.com/AliSoftware.png?size=200' width='140'>
+<td id='jérôme-lacoste'>
+<a href='https://github.com/lacostej'>
+<img src='https://github.com/lacostej.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/aligatr'>Olivier Halligon</a></h4>
+<h4 align='center'><a href='https://twitter.com/lacostej'>Jérôme Lacoste</a></h4>
 </td>
-<td id='josh-holtz'>
-<a href='https://github.com/joshdholtz'>
-<img src='https://github.com/joshdholtz.png?size=200' width='140'>
+<td id='stefan-natchev'>
+<a href='https://github.com/snatchev'>
+<img src='https://github.com/snatchev.png?size=200' width='140'>
 </a>
-<h4 align='center'><a href='https://twitter.com/joshdholtz'>Josh Holtz</a></h4>
+<h4 align='center'><a href='https://twitter.com/snatchev'>Stefan Natchev</a></h4>
+</td>
+<td id='roger-oba'>
+<a href='https://github.com/rogerluan'>
+<img src='https://github.com/rogerluan.png?size=200' width='140'>
+</a>
+<h4 align='center'><a href='https://twitter.com/rogerluan_'>Roger Oba</a></h4>
 </td>
 </tr>
 </table>
@@ -94,24 +94,24 @@ If the above doesn't help, please [submit an issue](https://github.com/fastlane/
 _fastlane_ wouldn't be what it is today without the countless hours these former team members have dedicated to the project ❤️
 
 <p id='alumni'>
-<a href='https://github.com/lmirosevic'>Luka Mirosevic</a>,
-<a href='https://github.com/minuscorp'>Jorge Revuelta H</a>,
-<a href='https://github.com/milch'>Manu Wallner</a>,
-<a href='https://github.com/nafu'>Fumiya Nakamura</a>,
-<a href='https://github.com/revolter'>Iulian Onofrei</a>,
-<a href='https://github.com/ainame'>Satoshi Namai</a>,
-<a href='https://github.com/getaaron'>Aaron Brager</a>,
-<a href='https://github.com/hjanuschka'>Helmut Januschka</a>,
+<a href='https://github.com/endocrimes'>Danielle Tomlinson</a>,
 <a href='https://github.com/max-ott'>Max Ott</a>,
+<a href='https://github.com/crazymanish'>Manish Rathi</a>,
+<a href='https://github.com/lucgrabowski'>Łukasz Grabowski</a>,
 <a href='https://github.com/mollyIV'>Daniel Jankowski</a>,
-<a href='https://github.com/matthewellis'>Matthew Ellis</a>,
+<a href='https://github.com/ainame'>Satoshi Namai</a>,
+<a href='https://github.com/getaaron'>Aaron Brager</a>,
+<a href='https://github.com/jdee'>Jimmy Dee</a>,
+<a href='https://github.com/revolter'>Iulian Onofrei</a>,
 <a href='https://github.com/mgrebenets'>Maksym Grebenets</a>,
 <a href='https://github.com/armcburney'>Andrew McBurney</a>,
-<a href='https://github.com/giginet'>Kohki Miki</a>,
-<a href='https://github.com/endocrimes'>Danielle Tomlinson</a>,
-<a href='https://github.com/crazymanish'>Manish Rathi</a>,
-<a href='https://github.com/jdee'>Jimmy Dee</a>,
-<a href='https://github.com/lucgrabowski'>Łukasz Grabowski</a>
+<a href='https://github.com/lmirosevic'>Luka Mirosevic</a>,
+<a href='https://github.com/milch'>Manu Wallner</a>,
+<a href='https://github.com/minuscorp'>Jorge Revuelta H</a>,
+<a href='https://github.com/matthewellis'>Matthew Ellis</a>,
+<a href='https://github.com/hjanuschka'>Helmut Januschka</a>,
+<a href='https://github.com/nafu'>Fumiya Nakamura</a>,
+<a href='https://github.com/giginet'>Kohki Miki</a>
 </p>
 <!-- team:end -->
 

data/fastlane/lib/fastlane/commands_generator.rb

@@ -144,11 +144,16 @@ module Fastlane
         c.option('-s', '--stay_alive', 'Keeps socket server up even after error or disconnects, requires CTRL-C to kill.')
         c.option('-c seconds', '--connection_timeout', 'Sets connection established timeout')
         c.option('-p port', '--port', "Sets the port on localhost for the socket connection")
+        c.option('--token_file path', "File holding the token every command must carry (default: FASTLANE_SOCKET_SERVER_TOKEN_FILE)")
         c.action do |args, options|
           default_connection_timeout = 5
           stay_alive = options.stay_alive || false
           connection_timeout = options.connection_timeout || default_connection_timeout
           port = options.port || 2000
+          token_file = options.token_file || ENV["FASTLANE_SOCKET_SERVER_TOKEN_FILE"]
+          token = File.read(token_file).strip if token_file
+          UI.user_error!("The token file #{token_file} is empty") if token_file && token.empty?
+          UI.important("No --token_file given: any local process that connects first can run actions") unless token
 
           if stay_alive && options.connection_timeout.nil?
             UI.important("stay_alive is set, but the connection timeout is not, this will give you #{default_connection_timeout} seconds to (re)connect")
@@ -162,7 +167,8 @@ module Fastlane
             command_executor: command_executor,
             connection_timeout: connection_timeout,
             stay_alive: stay_alive,
-            port: port
+            port: port,
+            token: token
           )
           result = server.start
           UI.success("Result: #{result}") if result

data/fastlane/lib/fastlane/server/socket_server.rb

@@ -3,6 +3,7 @@ require 'fastlane/server/command_parser.rb'
 require 'fastlane/server/json_return_value_processor.rb'
 require 'socket'
 require 'json'
+require 'openssl'
 
 module Fastlane
   class SocketServer
@@ -20,7 +21,8 @@ module Fastlane
       return_value_processor: nil,
       connection_timeout: 5,
       stay_alive: false,
-      port: 2000
+      port: 2000,
+      token: nil
     )
       if return_value_processor.nil?
         return_value_processor = JSONReturnValueProcessor.new
@@ -31,6 +33,8 @@ module Fastlane
       @connection_timeout = connection_timeout.to_i
       @stay_alive = stay_alive
       @port = port.to_i
+      # When set, every command must carry it: the runner reads it from a file only this user can read
+      @token = token
     end
 
     # this is the public API, don't call anything else
@@ -78,6 +82,11 @@ module Fastlane
     end
 
     def parse_and_execute_command(command_string: nil)
+      unless token_matches?(command_string)
+        UI.error("Refusing a command without this run's token: it does not come from the FastlaneRunner fastlane started")
+        return COMMAND_EXECUTION_STATE[:error]
+      end
+
       command = CommandParser.parse(json: command_string)
       case command
       when ControlCommand
@@ -137,15 +146,17 @@ module Fastlane
     end
 
     def listen
-      @server = TCPServer.open('localhost', @port) # Socket to listen on port 2000
-      UI.verbose("Waiting for #{@connection_timeout} seconds for a connection from FastlaneRunner")
+      @servers = listening_sockets
+      @port = @servers.first.local_address.ip_port
+      UI.verbose("Waiting for #{@connection_timeout} seconds for a connection from FastlaneRunner on port #{@port}")
 
-      # set thread local to ready so we can check it
+      # set thread locals so the caller can tell the runner where to connect
+      Thread.current[:port] = @port
       Thread.current[:ready] = true
       @client = nil
       begin
         Timeout.timeout(@connection_timeout) do
-          @client = @server.accept # Wait for a client to connect
+          @client = accept_first_connection
         end
       rescue Timeout::Error
         UI.user_error!("fastlane failed to receive a connection from the FastlaneRunner binary after #{@connection_timeout} seconds, shutting down")
@@ -166,8 +177,47 @@ module Fastlane
       @client.close
       @client = nil
 
-      @server.close
-      @server = nil
+      close_servers
+    end
+
+    # A socket on every address localhost resolves to. The runner connects to
+    # `localhost` and tries those addresses in turn, so another process listening
+    # on one this server did not take would receive its commands.
+    def listening_sockets
+      # Port 0: a free port, the same on every address
+      return Socket.tcp_server_sockets('localhost', 0) if @port.zero?
+
+      sockets = []
+      Addrinfo.getaddrinfo('localhost', @port, nil, :STREAM).uniq(&:ip_address).each do |address|
+        sockets << address.listen
+      rescue SystemCallError => e
+        sockets.each(&:close)
+        UI.user_error!("fastlane could not listen on #{address.inspect_sockaddr} for the FastlaneRunner binary: #{e.message}")
+      end
+      sockets
+    end
+
+    # The first connection on any of the sockets. They are closed once it is
+    # accepted, so nothing else can connect while the runner is talking to us.
+    def accept_first_connection
+      ready, = IO.select(@servers)
+      ready.first.accept.first
+    ensure
+      close_servers
+    end
+
+    def token_matches?(command_string)
+      return true if @token.nil?
+
+      token = JSON.parse(command_string)['token']
+      token.kind_of?(String) && OpenSSL.secure_compare(token, @token)
+    rescue JSON::ParserError, TypeError
+      false
+    end
+
+    def close_servers
+      (@servers || []).each { |server| server.close unless server.closed? }
+      @servers = nil
     end
 
     # record fastlane action command and then execute it

data/fastlane/lib/fastlane/swift_lane_manager.rb

@@ -1,10 +1,12 @@
 require_relative 'lane_manager_base.rb'
 require_relative 'swift_runner_upgrader.rb'
+require 'securerandom'
+require 'tmpdir'
 
 module Fastlane
   class SwiftLaneManager < LaneManagerBase
     # The runner protocol version this fastlane ships, see main.swift
-    RUNNER_PROTOCOL_VERSION = 1
+    RUNNER_PROTOCOL_VERSION = 2
     RUNNER_PROTOCOL_VERSION_REGEX = /FastlaneRunnerProtocolVersion \[(\d+)\]/
 
     # @param lane_name The name of the lane to execute
@@ -31,15 +33,25 @@ module Fastlane
 
         self.ensure_runner_built!
         self.warn_if_runner_outdated
-        swift_server_port ||= 2000
-        socket_thread = self.start_socket_thread(port: swift_server_port)
-        sleep(0.250) while socket_thread[:ready].nil?
+        # A secret only this user can read, which the runner sends back with every command
+        token_dir = Dir.mktmpdir('fastlane-runner')
+        token_file = File.join(token_dir, 'token')
+        token = SecureRandom.hex(32)
+        File.write(token_file, token, perm: 0o600)
+        token = nil unless self.runner_sends_token?
+        # Port 0 lets the server pick a free port, which no other process can take beforehand
+        socket_thread = self.start_socket_thread(port: swift_server_port || 0, token: token)
+        sleep(0.250) while socket_thread[:ready].nil? && socket_thread.alive?
+        # The thread ended without listening: join raises its error rather than waiting forever
+        socket_thread.join unless socket_thread[:ready]
         # wait on socket_thread to be in ready state, then start the runner thread
-        self.cruise_swift_lane_in_thread(lane, parameters, swift_server_port)
+        self.cruise_swift_lane_in_thread(lane, parameters, socket_thread[:port], token_file)
 
         socket_thread.value
       rescue Exception => ex # rubocop:disable Lint/RescueException
         e = ex
+      ensure
+        FileUtils.remove_entry(token_dir) if token_dir
       end
       # If we have a thread exception, drop that in the exception
       # won't ever have a situation where e is non-nil, and socket_thread[:exception] is also non-nil
@@ -84,14 +96,14 @@ module Fastlane
       end
     end
 
-    def self.cruise_swift_lane_in_thread(lane, parameters = nil, swift_server_port)
+    def self.cruise_swift_lane_in_thread(lane, parameters = nil, swift_server_port, token_file)
       if parameters.nil?
         parameters = {}
       end
 
       parameter_string = ""
       parameters.each do |key, value|
-        parameter_string += " #{key} #{value}"
+        parameter_string += " #{key.to_s.shellescape} #{value.to_s.shellescape}"
       end
 
       if FastlaneCore::Globals.verbose?
@@ -99,13 +111,16 @@ module Fastlane
       end
 
       parameter_string += " swiftServerPort #{swift_server_port}"
+      parameter_string += " swiftServerTokenFile #{token_file.shellescape}"
+
+      command = "#{FastlaneCore::FastlaneFolder.swift_runner_path.shellescape} lane #{lane.to_s.shellescape}#{parameter_string}"
 
       return Thread.new do
         if FastlaneCore::Globals.verbose?
-          return_value = Actions.sh(%(#{FastlaneCore::FastlaneFolder.swift_runner_path} lane #{lane}#{parameter_string}))
+          return_value = Actions.sh(command)
           UI.message("runner output: ".yellow + return_value)
         else
-          Actions.sh(%(#{FastlaneCore::FastlaneFolder.swift_runner_path} lane #{lane}#{parameter_string} > /dev/null))
+          Actions.sh("#{command} > /dev/null")
         end
       end
     end
@@ -223,13 +238,13 @@ module Fastlane
       return project_modified
     end
 
-    def self.start_socket_thread(port: nil)
+    def self.start_socket_thread(port: nil, token: nil)
       require 'fastlane/server/socket_server'
       require 'fastlane/server/socket_server_action_command_executor'
 
       return Thread.new do
         command_executor = SocketServerActionCommandExecutor.new
-        server = Fastlane::SocketServer.new(command_executor: command_executor, port: port)
+        server = Fastlane::SocketServer.new(command_executor: command_executor, port: port, token: token)
         server.start
       end
     end
@@ -245,6 +260,12 @@ module Fastlane
       UI.important("Your FastlaneRunner is outdated for this version of fastlane. Run a lane outside CI, without `disable_runner_upgrades`, to update it, then commit the changes.")
     end
 
+    # Runners from protocol version 2 send the run's token with every command; older ones get warn_if_runner_outdated.
+    # Version 1 was released before the token existed.
+    def self.runner_sends_token?
+      runner_protocol_version >= 2
+    end
+
     def self.ensure_runner_built!
       UI.verbose("Checking for new user-provided tool configuration files")
       # if self.link_user_configs_to_project returns true, that means we need to rebuild the runner

data/fastlane/lib/fastlane/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
-  VERSION = '2.241.1'.freeze
+  VERSION = '2.241.2'.freeze
   SUMMARY = "The easiest way to build and release mobile apps.".freeze
   DESCRIPTION = "The easiest way to automate beta deployments and releases for your iOS and Android apps".freeze
   MINIMUM_XCODE_RELEASE = "7.0".freeze

data/fastlane/swift/ArgumentProcessor.swift

@@ -11,6 +11,10 @@
 import Foundation
 
 struct ArgumentProcessor {
+    /// The secret fastlane wrote to a file only this user can read: sent with every command so that
+    /// fastlane can tell this runner from another process that connected to its port
+    static var serverToken: String?
+
     let args: [RunnerArgument]
     let currentLane: String
     let commandTimeout: Int
@@ -33,6 +37,10 @@ struct ArgumentProcessor {
 
         port = UInt32(fastlaneArgsMinusLanes.first(where: { $0.name == "swiftServerPort" })?.value ?? "") ?? 2000
 
+        if let tokenFile = fastlaneArgsMinusLanes.first(where: { $0.name == "swiftServerTokenFile" })?.value {
+            ArgumentProcessor.serverToken = (try? String(contentsOfFile: tokenFile, encoding: .utf8))?.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+
         // Configure logMode since we might need to use it before we finish parsing
         if let logModeArg = potentialLogMode.first {
             let logModeString = logModeArg.value
@@ -74,7 +82,7 @@ struct ArgumentProcessor {
     func laneParameters() -> [String: String] {
         let laneParametersArgs = args.filter { arg in
             let lowercasedName = arg.name.lowercased()
-            return lowercasedName != "timeoutseconds" && lowercasedName != "lane" && lowercasedName != "logmode"
+            return lowercasedName != "timeoutseconds" && lowercasedName != "lane" && lowercasedName != "logmode" && lowercasedName != "swiftservertokenfile"
         }
         var laneParameters = [String: String]()
         for arg in laneParametersArgs {
@@ -86,4 +94,4 @@ struct ArgumentProcessor {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.2]
+// FastlaneRunnerAPIVersion [0.9.3]

data/fastlane/swift/Deliverfile.swift

@@ -17,4 +17,4 @@ public class Deliverfile: DeliverfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/DeliverfileProtocol.swift

@@ -539,4 +539,4 @@ public extension DeliverfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.157]
+// FastlaneRunnerAPIVersion [0.9.158]

data/fastlane/swift/Fastlane.swift

@@ -12605,7 +12605,7 @@ public func updateProjectProvisioning(xcodeproj: OptionalConfigValue<String?> =
                                       targetFilter: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                                       buildConfigurationFilter: OptionalConfigValue<String?> = .fastlaneDefault(nil),
                                       buildConfiguration: OptionalConfigValue<String?> = .fastlaneDefault(nil),
-                                      certificate: String = "/var/folders/36/tjdph2t965j8snz9_vkdnw0r0000gn/T/AppleIncRootCertificate.cer",
+                                      certificate: String = "/var/folders/n6/hn37q6pj7sj_9dmqqc2113800000gn/T/AppleIncRootCertificate.cer",
                                       codeSigningIdentity: OptionalConfigValue<String?> = .fastlaneDefault(nil))
 {
     let xcodeprojArg = xcodeproj.asRubyArgument(name: "xcodeproj", type: nil)
@@ -14245,4 +14245,4 @@ public let snapshotfile: Snapshotfile = .init()
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.210]
+// FastlaneRunnerAPIVersion [0.9.211]

data/fastlane/swift/Gymfile.swift

@@ -17,4 +17,4 @@ public class Gymfile: GymfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/GymfileProtocol.swift

@@ -399,4 +399,4 @@ public extension GymfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.160]
+// FastlaneRunnerAPIVersion [0.9.161]

data/fastlane/swift/MainProcess.swift

@@ -42,12 +42,21 @@ class MainProcess {
             killExistingSocketServerProcesses(port: argumentProcessor.port)
             abortIfPortIsInUse(argumentProcessor.port)
 
+            let serverToken = createServerToken()
+            ArgumentProcessor.serverToken = serverToken.token
+
             rubySocketCommand = Process()
             rubySocketCommand.launchPath = "/usr/bin/env"
             rubySocketCommand.arguments = fastlaneLaunchArguments() + ["socket_server", "-c", String(timeout), "-p", String(argumentProcessor.port)]
+            // An environment variable rather than --token_file, so that an older fastlane still starts
+            var environment = ProcessInfo.processInfo.environment
+            environment["FASTLANE_SOCKET_SERVER_TOKEN_FILE"] = serverToken.file
+            rubySocketCommand.environment = environment
             rubySocketCommand.launch()
 
             waitUntilSocketServerIsListening(port: argumentProcessor.port, serverProcess: rubySocketCommand)
+            // socket_server read the token when it started
+            try? FileManager.default.removeItem(atPath: serverToken.directory)
             thread.start()
         #endif
     }
@@ -78,6 +87,24 @@ class MainProcess {
             return ["bundle", "exec", "fastlane"]
         }
 
+        /// A random token in a file only this user can read, which socket_server requires on every command and the runner sends
+        func createServerToken() -> (token: String, directory: String, file: String) {
+            var template = Array((NSTemporaryDirectory() as NSString).appendingPathComponent("fastlane-runner.XXXXXX").utf8CString)
+            guard let created = mkdtemp(&template), let random = FileHandle(forReadingAtPath: "/dev/urandom") else {
+                log(message: "Could not create the token for fastlane socket_server")
+                exit(1)
+            }
+            let directory = String(cString: created)
+            let token = random.readData(ofLength: 32).map { String(format: "%02x", $0) }.joined()
+            random.closeFile()
+            let file = directory + "/token"
+            guard token.count == 64, FileManager.default.createFile(atPath: file, contents: token.data(using: .utf8), attributes: [.posixPermissions: 0o600]) else {
+                log(message: "Could not create the token for fastlane socket_server")
+                exit(1)
+            }
+            return (token, directory, file)
+        }
+
         /// The directory of the Gemfile Bundler would use: BUNDLE_GEMFILE, else the
         /// nearest Gemfile or gems.rb from the working directory up.
         func bundleRootDirectory() -> String? {

data/fastlane/swift/Matchfile.swift

@@ -17,4 +17,4 @@ public class Matchfile: MatchfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/MatchfileProtocol.swift

@@ -420,4 +420,4 @@ public extension MatchfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.154]
+// FastlaneRunnerAPIVersion [0.9.155]

data/fastlane/swift/Precheckfile.swift

@@ -17,4 +17,4 @@ public class Precheckfile: PrecheckfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/PrecheckfileProtocol.swift

@@ -84,4 +84,4 @@ public extension PrecheckfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.153]
+// FastlaneRunnerAPIVersion [0.9.154]

data/fastlane/swift/RubyCommand.swift

@@ -81,15 +81,7 @@ struct RubyCommand: RubyCommandable {
 
     var closure: ((String) -> Void)? {
         let callbacks = args.filter { ($0.type != nil) && $0.type == .stringClosure }
-        guard let callback = callbacks.first else {
-            return nil
-        }
-
-        guard let callbackArgValue = callback.value else {
-            return nil
-        }
-
-        guard let callbackClosure = callbackArgValue as? ((String) -> Void) else {
+        guard let callback = callbacks.first, let callbackArgValue = callback.value, let callbackClosure = callbackArgValue as? ((String) -> Void) else {
             return nil
         }
         return callbackClosure

data/fastlane/swift/RubyCommandable.swift

@@ -32,12 +32,13 @@ protocol RubyCommandable {
 
 extension RubyCommandable {
     var json: String {
+        let token = ArgumentProcessor.serverToken.map { ", \"token\": \"\($0)\"" } ?? ""
         return """
-        { "commandType": "\(type.token)", "command": \(commandJson) }
+        { "commandType": "\(type.token)", "command": \(commandJson)\(token) }
         """
     }
 }
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.2]
+// FastlaneRunnerAPIVersion [0.9.3]

data/fastlane/swift/Scanfile.swift

@@ -17,4 +17,4 @@ public class Scanfile: ScanfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/ScanfileProtocol.swift

@@ -595,4 +595,4 @@ public extension ScanfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.165]
+// FastlaneRunnerAPIVersion [0.9.166]

data/fastlane/swift/Screengrabfile.swift

@@ -17,4 +17,4 @@ public class Screengrabfile: ScreengrabfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/ScreengrabfileProtocol.swift

@@ -161,4 +161,4 @@ public extension ScreengrabfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.155]
+// FastlaneRunnerAPIVersion [0.9.156]

data/fastlane/swift/Snapshotfile.swift

@@ -17,4 +17,4 @@ public class Snapshotfile: SnapshotfileProtocol {
     // during the `init` process, and you won't see this message
 }
 
-// Generated with fastlane 2.241.1
+// Generated with fastlane 2.241.2

data/fastlane/swift/SnapshotfileProtocol.swift

@@ -385,4 +385,4 @@ public extension SnapshotfileProtocol {
 
 // Please don't remove the lines below
 // They are used to detect outdated files
-// FastlaneRunnerAPIVersion [0.9.149]
+// FastlaneRunnerAPIVersion [0.9.150]

data/fastlane/swift/main.swift

@@ -12,7 +12,7 @@ import Foundation
 
 let argumentProcessor = ArgumentProcessor(args: CommandLine.arguments)
 /// fastlane reads this from the built runner, to tell whether it is outdated. Increase it when the runner changes how it talks to fastlane.
-let runnerProtocolVersion = "FastlaneRunnerProtocolVersion [1]"
+let runnerProtocolVersion = "FastlaneRunnerProtocolVersion [2]"
 verbose(message: runnerProtocolVersion)
 let timeout = argumentProcessor.commandTimeout
 

data/fastlane_core/lib/fastlane_core/itunes_transporter.rb

@@ -58,30 +58,44 @@ module FastlaneCore
     # Runs preparations before executing any command from the executor.
     #
     # @param original_api_key [Hash] api key containing the issuer id and private key
-    # @return [Hash] copy of `api_key` which includes an extra `key_dir` with the location of the .p8 file on disk
+    # @return [Hash] copy of `api_key` which includes an extra `key_dir` with the location of the .p8 file on disk,
+    #   and `cleanup_path`: what #cleanup removes afterwards
     def prepare(original_api_key:)
       return if original_api_key.nil?
       # Create .p8 file from api_key and provide api key info which contains .p8 file path
       api_key = original_api_key.dup
+      p8_name = "AuthKey_#{api_key[:key_id]}.p8"
       if self.kind_of?(ShellScriptTransporterExecutor)
         # as of Transporter v3.3.0, the app is unable to detect the private keys under the 'private_keys' folder in current directory
         # so we must rely on the other search paths in the Home dir:
         # https://help.apple.com/itc/transporteruserguide/en.lproj/static.html#itc803b7be80
         private_keys_dir = File.join(Dir.home, ".appstoreconnect/private_keys")
         unless Dir.exist?(private_keys_dir)
-          FileUtils.mkdir_p(private_keys_dir)
+          FileUtils.mkdir_p(private_keys_dir, mode: 0o700)
         end
         api_key[:key_dir] = private_keys_dir
+        # Keys already there belong to the user: only remove the one written below
+        p8_path = File.join(private_keys_dir, p8_name)
+        api_key[:cleanup_path] = p8_path unless File.exist?(p8_path)
       else
         api_key[:key_dir] = Dir.mktmpdir("deliver-")
+        api_key[:cleanup_path] = api_key[:key_dir]
       end
       # Specified p8 needs to be generated to call altool or iTMSTransporter
-      File.open(File.join(api_key[:key_dir], "AuthKey_#{api_key[:key_id]}.p8"), "wb") do |p8|
+      p8_path = File.join(api_key[:key_dir], p8_name)
+      File.open(p8_path, "wb", 0o600) do |p8|
         p8.write(api_key[:key])
       end
+      File.chmod(0o600, p8_path)
       api_key
     end
 
+    # Removes what #prepare wrote: its temporary directory, or the key file it added to ~/.appstoreconnect/private_keys
+    def cleanup(api_key)
+      return if api_key.nil? || api_key[:cleanup_path].nil?
+      FileUtils.rm_rf(api_key[:cleanup_path])
+    end
+
     def execute(command, hide_output)
       if Helper.test?
         yield(nil) if block_given?
@@ -869,7 +883,7 @@ module FastlaneCore
         return upload(app_id, dir, package_path: package_path, asset_path: asset_path)
       ensure
         if use_api_key
-          FileUtils.rm_rf(api_key[:key_dir]) unless api_key.nil?
+          @transporter_executor.cleanup(api_key)
         end
       end
 
@@ -967,7 +981,7 @@ module FastlaneCore
         return provider_ids
       ensure
         if use_api_key
-          FileUtils.rm_rf(api_key[:key_dir]) unless api_key.nil?
+          @transporter_executor.cleanup(api_key)
         end
       end
 

data/match/lib/match/runner.rb

@@ -387,6 +387,8 @@ module Match
 
       if Helper.mac?
         installed_profile = FastlaneCore::ProvisioningProfile.install(stored_profile_path, keychain_path)
+      else
+        UI.message("Skipping installation of provisioning profile as it would not work on this operating system.")
       end
 
       if params[:output_path]

data/match/lib/match/storage/gitlab/secure_file.rb

@@ -2,6 +2,7 @@ require 'open-uri'
 require 'ostruct'
 
 require_relative '../../module'
+require_relative '../interface'
 
 module Match
   module Storage
@@ -36,7 +37,7 @@ module Match
           url = URI("#{file_url}/download")
 
           begin
-            destination_file = "#{working_directory}/#{@file.name}"
+            destination_file = Storage.download_path(working_directory, @file.name)
 
             create_subfolders(working_directory)
             File.open(destination_file, "wb") do |saved_file|

data/match/lib/match/storage/google_cloud_storage.rb

@@ -158,7 +158,7 @@ module Match
 
         bucket.files.each do |current_file|
           file_path = current_file.name # e.g. "N8X438SEU2/certs/distribution/XD9G7QCACF.cer"
-          download_path = File.join(self.working_directory, file_path)
+          download_path = Storage.download_path(self.working_directory, file_path)
 
           FileUtils.mkdir_p(File.expand_path("..", download_path))
           UI.verbose("Downloading file from Google Cloud Storage '#{file_path}' on bucket #{self.bucket_name}")

data/match/lib/match/storage/interface.rb

@@ -2,6 +2,16 @@ require_relative '../module'
 
 module Match
   module Storage
+    # Where a file named `remote_name` by the storage is written in `working_directory`.
+    # Fails when the name would place it outside, e.g. with `..` segments.
+    def self.download_path(working_directory, remote_name)
+      root = File.expand_path(working_directory)
+      path = File.expand_path(File.join(root, remote_name))
+      return path if path.start_with?(root + File::SEPARATOR)
+
+      UI.user_error!("Refusing to download #{remote_name.inspect}: it would be written outside #{root}")
+    end
+
     class Interface
       MATCH_VERSION_FILE_NAME = "match_version.txt"
       # The working directory in which we download all the profiles

data/match/lib/match/storage/s3_storage.rb

@@ -114,7 +114,7 @@ module Match
           file_path = strip_s3_object_prefix(object.key) # :s3_object_prefix:team_id/path/to/file
 
           # strip s3_prefix from file_path
-          download_path = File.join(self.working_directory, file_path)
+          download_path = Storage.download_path(self.working_directory, file_path)
 
           FileUtils.mkdir_p(File.expand_path("..", download_path))
           UI.verbose("Downloading file from S3 '#{file_path}' on bucket #{self.s3_bucket}")

data/sigh/lib/sigh/manager.rb

@@ -41,7 +41,11 @@ module Sigh
       ENV["SIGH_UDID"] = ENV["SIGH_UUID"] = uuid if uuid
       ENV["SIGH_NAME"] = name if name
 
-      FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      if Helper.mac?
+        FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      else
+        UI.message("Skipping installation of provisioning profile as it would not work on this operating system.")
+      end
     end
   end
 end

data/spaceship/lib/spaceship/client.rb

@@ -252,6 +252,8 @@ module Spaceship
         else
           # Log to file by default
           path = File.join(Dir.tmpdir, "spaceship#{Time.now.to_i}_#{Process.pid}_#{Thread.current.object_id}.log")
+          # The log holds every request and response body: create it readable by its owner only
+          File.open(path, File::WRONLY | File::CREAT | File::APPEND, 0o600) {}
           @logger = Logger.new(path)
         end
 
@@ -279,10 +281,12 @@ module Spaceship
     def store_cookie(path: nil)
       path ||= persistent_cookie_path
       FileUtils.mkdir_p(File.expand_path("..", path))
+      File.chmod(0o700, File.expand_path("..", path))
 
       # really important to specify the session to true
       # otherwise myacinfo and more won't be stored
       @cookie.save(path, :yaml, session: true)
+      File.chmod(0o600, path)
       return File.read(path)
     end
 
@@ -880,6 +884,8 @@ module Spaceship
       begin
         if File.exist?(persistent_cookie_path)
           puts("Loading session from '#{persistent_cookie_path}'") if Spaceship::Globals.verbose?
+          File.chmod(0o700, File.expand_path("..", persistent_cookie_path))
+          File.chmod(0o600, persistent_cookie_path)
           @cookie.load(persistent_cookie_path)
           return true
         end
@@ -1144,7 +1150,7 @@ module Spaceship
 
     def log_response(method, url, response, headers = nil, &block)
       url ||= extract_key_from_block('url', &block)
-      body = response.body.kind_of?(String) ? response.body.force_encoding(Encoding::UTF_8) : response.body
+      body = response.body.kind_of?(String) ? response.body.dup.force_encoding(Encoding::UTF_8) : response.body
       logger.debug("<< #{method.upcase} #{url}: #{response.status} #{body}")
     end
 

metadata

@@ -1,36 +1,36 @@
 --- !ruby/object:Gem::Specification
 name: fastlane
 version: !ruby/object:Gem::Version
-  version: 2.241.1
+  version: 2.241.2
 platform: ruby
 authors:
-- Felix Krause
-- Jimmy Dee
-- Connor Tumbleson
-- Manish Rathi
-- Daniel Jankowski
-- Kohki Miki
 - Josh Holtz
-- Manu Wallner
-- Stefan Natchev
-- Olivier Halligon
+- Jimmy Dee
+- Joshua Liebowitz
 - Max Ott
+- Olivier Halligon
 - Helmut Januschka
-- Luka Mirosevic
 - Satoshi Namai
-- Roger Oba
 - Danielle Tomlinson
-- Andrew McBurney
+- Manish Rathi
 - Iulian Onofrei
-- Aaron Brager
-- Jan Piotrowski
-- Jérôme Lacoste
+- Kohki Miki
 - Jorge Revuelta H
+- Andrew McBurney
+- Connor Tumbleson
+- Jan Piotrowski
 - Maksym Grebenets
-- Joshua Liebowitz
-- Fumiya Nakamura
+- Manu Wallner
+- Stefan Natchev
 - Łukasz Grabowski
 - Matthew Ellis
+- Roger Oba
+- Luka Mirosevic
+- Aaron Brager
+- Fumiya Nakamura
+- Jérôme Lacoste
+- Daniel Jankowski
+- Felix Krause
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z