fastlane_hotfix 2.165.0

data/match/lib/match/encryption/interface.rb

@@ -0,0 +1,17 @@
+module Match
+  module Encryption
+    class Interface
+      # Call this method to trigger the actual
+      # encryption
+      def encrypt_files
+        not_implemented(__method__)
+      end
+
+      # Call this method to trigger the actual
+      # decryption
+      def decrypt_files
+        not_implemented(__method__)
+      end
+    end
+  end
+end

data/match/lib/match/encryption/openssl.rb

@@ -0,0 +1,161 @@
+require 'base64'
+require 'openssl'
+require 'securerandom'
+require 'security'
+require 'shellwords'
+
+require_relative '../change_password'
+require_relative '../module'
+
+module Match
+  module Encryption
+    class OpenSSL < Interface
+      attr_accessor :keychain_name
+
+      attr_accessor :working_directory
+
+      def self.configure(params)
+        return self.new(
+          keychain_name: params[:keychain_name],
+          working_directory: params[:working_directory]
+        )
+      end
+
+      # @param keychain_name: The identifier used to store the passphrase in the Keychain
+      # @param working_directory: The path to where the certificates are stored
+      def initialize(keychain_name: nil, working_directory: nil)
+        self.keychain_name = keychain_name
+        self.working_directory = working_directory
+      end
+
+      def encrypt_files
+        files = []
+        iterate(self.working_directory) do |current|
+          files << current
+          encrypt_specific_file(path: current, password: password)
+          UI.success("🔒  Encrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔒  Successfully encrypted certificates repo")
+        return files
+      end
+
+      def decrypt_files
+        files = []
+        iterate(self.working_directory) do |current|
+          files << current
+          begin
+            decrypt_specific_file(path: current, password: password)
+          rescue => ex
+            UI.verbose(ex.to_s)
+            UI.error("Couldn't decrypt the repo, please make sure you enter the right password!")
+            UI.user_error!("Invalid password passed via 'MATCH_PASSWORD'") if ENV["MATCH_PASSWORD"]
+            clear_password
+            self.decrypt_files # call itself
+            return
+          end
+          UI.success("🔓  Decrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔓  Successfully decrypted certificates repo")
+        return files
+      end
+
+      def store_password(password)
+        Security::InternetPassword.add(server_name(self.keychain_name), "", password)
+      end
+
+      # removes the password from the keychain again
+      def clear_password
+        Security::InternetPassword.delete(server: server_name(self.keychain_name))
+      end
+
+      private
+
+      def iterate(source_path)
+        Dir[File.join(source_path, "**", "*.{cer,p12,mobileprovision,provisionprofile}")].each do |path|
+          next if File.directory?(path)
+          yield(path)
+        end
+      end
+
+      # server name used for accessing the macOS keychain
+      def server_name(keychain_name)
+        ["match", keychain_name].join("_")
+      end
+
+      # Access the MATCH_PASSWORD, either from ENV variable, Keychain or user input
+      def password
+        password = ENV["MATCH_PASSWORD"]
+        unless password
+          item = Security::InternetPassword.find(server: server_name(self.keychain_name))
+          password = item.password if item
+        end
+
+        unless password
+          if !UI.interactive?
+            UI.error("Neither the MATCH_PASSWORD environment variable nor the local keychain contained a password.")
+            UI.error("Bailing out instead of asking for a password, since this is non-interactive mode.")
+            UI.user_error!("Try setting the MATCH_PASSWORD environment variable, or temporarily enable interactive mode to store a password.")
+          else
+            UI.important("Enter the passphrase that should be used to encrypt/decrypt your certificates")
+            UI.important("This passphrase is specific per repository and will be stored in your local keychain")
+            UI.important("Make sure to remember the password, as you'll need it when you run match on a different machine")
+            password = FastlaneCore::Helper.ask_password(message: "Passphrase for Match storage: ", confirm: true)
+            store_password(password)
+          end
+        end
+
+        return password
+      end
+
+      # We encrypt with MD5 because that was the most common default value in older fastlane versions which used the local OpenSSL installation
+      # A more secure key and IV generation is needed in the future
+      # IV should be randomly generated and provided unencrypted
+      # salt should be randomly generated and provided unencrypted (like in the current implementation)
+      # key should be generated with OpenSSL::KDF::pbkdf2_hmac with properly chosen parameters
+      # Short explanation about salt and IV: https://stackoverflow.com/a/1950674/6324550
+      def encrypt_specific_file(path: nil, password: nil)
+        UI.user_error!("No password supplied") if password.to_s.strip.length == 0
+
+        data_to_encrypt = File.binread(path)
+        salt = SecureRandom.random_bytes(8)
+
+        # The :: is important, as there is a name clash
+        cipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        cipher.encrypt
+        cipher.pkcs5_keyivgen(password, salt, 1, "MD5")
+        encrypted_data = "Salted__" + salt + cipher.update(data_to_encrypt) + cipher.final
+
+        File.write(path, Base64.encode64(encrypted_data))
+      rescue FastlaneCore::Interface::FastlaneError
+        raise
+      rescue => error
+        UI.error(error.to_s)
+        UI.crash!("Error encrypting '#{path}'")
+      end
+
+      # The encryption parameters in this implementations reflect the old behaviour which depended on the users' local OpenSSL version
+      # 1.0.x OpenSSL and earlier versions use MD5, 1.1.0c and newer uses SHA256, we try both before giving an error
+      def decrypt_specific_file(path: nil, password: nil, hash_algorithm: "MD5")
+        stored_data = Base64.decode64(File.read(path))
+        salt = stored_data[8..15]
+        data_to_decrypt = stored_data[16..-1]
+
+        decipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        decipher.decrypt
+        decipher.pkcs5_keyivgen(password, salt, 1, hash_algorithm)
+
+        decrypted_data = decipher.update(data_to_decrypt) + decipher.final
+
+        File.binwrite(path, decrypted_data)
+      rescue => error
+        fallback_hash_algorithm = "SHA256"
+        if hash_algorithm != fallback_hash_algorithm
+          decrypt_specific_file(path: path, password: password, hash_algorithm: fallback_hash_algorithm)
+        else
+          UI.error(error.to_s)
+          UI.crash!("Error decrypting '#{path}'")
+        end
+      end
+    end
+  end
+end

data/match/lib/match/generator.rb

@@ -0,0 +1,122 @@
+require_relative 'module'
+
+module Match
+  # Generate missing resources
+  class Generator
+    def self.generate_certificate(params, cert_type, working_directory, specific_cert_type: nil)
+      require 'cert/runner'
+      require 'cert/options'
+
+      output_path = File.join(working_directory, "certs", cert_type.to_s)
+
+      # Mapping match option to cert option for "Developer ID Application"
+      if cert_type.to_sym == :developer_id_application
+        specific_cert_type = cert_type.to_s
+      end
+
+      platform = params[:platform]
+      if platform.to_s == :catalyst.to_s
+        platform = :macos.to_s
+      end
+
+      arguments = FastlaneCore::Configuration.create(Cert::Options.available_options, {
+        platform: platform,
+        development: params[:type] == "development",
+        type: specific_cert_type,
+        generate_apple_certs: params[:generate_apple_certs],
+        output_path: output_path,
+        force: true, # we don't need a certificate without its private key, we only care about a new certificate
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key],
+        username: params[:username],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        keychain_path: FastlaneCore::Helper.keychain_path(params[:keychain_name]),
+        keychain_password: params[:keychain_password],
+        skip_set_partition_list: params[:skip_set_partition_list]
+      })
+
+      Cert.config = arguments
+
+      begin
+        cert_path = Cert::Runner.new.launch
+      rescue => ex
+        if ex.to_s.include?("You already have a current")
+          UI.user_error!("Could not create a new certificate as you reached the maximum number of certificates for this account. You can use the `fastlane match nuke` command to revoke your existing certificates. More information https://docs.fastlane.tools/actions/match/")
+        else
+          raise ex
+        end
+      end
+
+      # We don't care about the signing request
+      Dir[File.join(working_directory, "**", "*.certSigningRequest")].each { |path| File.delete(path) }
+
+      # we need to return the path
+      # Inside this directory, there is the `.p12` file and the `.cer` file with the same name, but different extension
+      return cert_path
+    end
+
+    # @return (String) The UUID of the newly generated profile
+    def self.generate_provisioning_profile(params: nil, prov_type: nil, certificate_id: nil, app_identifier: nil, force: true, working_directory: nil)
+      require 'sigh/manager'
+      require 'sigh/options'
+
+      prov_type = Match.profile_type_sym(params[:type])
+
+      names = ["match", profile_type_name(prov_type), app_identifier]
+
+      if params[:platform].to_s != :ios.to_s # For ios we do not include the platform for backwards compatibility
+        names << params[:platform]
+      end
+
+      if params[:profile_name].to_s.empty?
+        profile_name = names.join(" ")
+      else
+        profile_name = params[:profile_name]
+      end
+
+      values = {
+        app_identifier: app_identifier,
+        output_path: File.join(working_directory, "profiles", prov_type.to_s),
+        username: params[:username],
+        force: force,
+        cert_id: certificate_id,
+        provisioning_name: profile_name,
+        ignore_profiles_with_different_name: true,
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        template_name: params[:template_name],
+        fail_on_name_taken: params[:fail_on_name_taken]
+      }
+
+      values[:platform] = params[:platform]
+
+      # These options are all conflicting so can only set one
+      if params[:type] == "developer_id"
+        values[:developer_id] = true
+      elsif prov_type == :adhoc
+        values[:adhoc] = true
+      elsif prov_type == :development
+        values[:development] = true
+      end
+
+      arguments = FastlaneCore::Configuration.create(Sigh::Options.available_options, values)
+
+      Sigh.config = arguments
+      path = Sigh::Manager.start
+      return path
+    end
+
+    # @return the name of the provisioning profile type
+    def self.profile_type_name(type)
+      return "Direct" if type == :developer_id
+      return "Development" if type == :development
+      return "AdHoc" if type == :adhoc
+      return "AppStore" if type == :appstore
+      return "InHouse" if type == :enterprise
+      return "Unknown"
+    end
+  end
+end

data/match/lib/match/importer.rb

@@ -0,0 +1,157 @@
+require_relative 'spaceship_ensure'
+require_relative 'encryption'
+require_relative 'storage'
+require_relative 'module'
+require_relative 'generator'
+require 'fastlane_core/provisioning_profile'
+require 'fileutils'
+
+module Match
+  class Importer
+    def import_cert(params, cert_path: nil, p12_path: nil, profile_path: nil)
+      # Get and verify cert, p12 and profiles path
+      cert_path = ensure_valid_file_path(cert_path, "Certificate", ".cer")
+      p12_path = ensure_valid_file_path(p12_path, "Private key", ".p12")
+      profile_path = ensure_valid_file_path(profile_path, "Provisioning profile", ".mobileprovision or .provisionprofile", optional: true)
+
+      # Storage
+      storage = Storage.for_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        skip_docs: params[:skip_docs],
+        git_branch: params[:git_branch],
+        git_full_name: params[:git_full_name],
+        git_user_email: params[:git_user_email],
+        clone_branch_directly: params[:clone_branch_directly],
+        type: params[:type].to_s,
+        platform: params[:platform].to_s,
+        google_cloud_bucket_name: params[:google_cloud_bucket_name].to_s,
+        google_cloud_keys_file: params[:google_cloud_keys_file].to_s,
+        google_cloud_project_id: params[:google_cloud_project_id].to_s,
+        s3_bucket: params[:s3_bucket],
+        s3_region: params[:s3_region],
+        s3_access_key: params[:s3_access_key],
+        s3_secret_access_key: params[:s3_secret_access_key],
+        s3_object_prefix: params[:s3_object_prefix],
+        readonly: params[:readonly],
+        username: params[:username],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key]
+      })
+      storage.download
+
+      # Encryption
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        working_directory: storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+      UI.success("Repo is at: '#{storage.working_directory}'")
+
+      # Map match type into Spaceship::ConnectAPI::Certificate::CertificateType
+      cert_type = Match.cert_type_sym(params[:type])
+
+      case cert_type
+      when :development
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DEVELOPMENT,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT
+        ].join(',')
+      when :distribution, :enterprise
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DISTRIBUTION,
+          Spaceship::ConnectAPI::Certificate::CertificateType::DISTRIBUTION
+        ].join(',')
+      when :developer_id_application
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_APPLICATION
+        ].join(',')
+      when :mac_installer_distribution
+        certificate_type = [
+          Spaceship::ConnectAPI::Certificate::CertificateType::MAC_INSTALLER_DISTRIBUTION
+        ].join(',')
+      else
+        UI.user_error!("Cert type '#{cert_type}' is not supported")
+      end
+
+      prov_type = Match.profile_type_sym(params[:type])
+      output_dir_certs = File.join(storage.prefixed_working_directory, "certs", cert_type.to_s)
+      output_dir_profiles = File.join(storage.prefixed_working_directory, "profiles", prov_type.to_s)
+
+      should_skip_certificate_matching = params[:skip_certificate_matching]
+      # In case there is no access to Apple Developer portal but we have the certificates, keys and profiles
+      if should_skip_certificate_matching
+        cert_name = File.basename(cert_path, ".*")
+        p12_name = File.basename(p12_path, ".*")
+
+        # Make dir if doesn't exist
+        FileUtils.mkdir_p(output_dir_certs)
+        dest_cert_path = File.join(output_dir_certs, "#{cert_name}.cer")
+        dest_p12_path = File.join(output_dir_certs, "#{p12_name}.p12")
+      else
+        # Need to get the cert id by comparing base64 encoded cert content with certificate content from the API responses
+        token = api_token(params)
+        if token
+          UI.message("Creating authorization token for App Store Connect API")
+          Spaceship::ConnectAPI.token = token
+        else
+          UI.message("Login to App Store Connect (#{params[:username]})")
+          Spaceship::ConnectAPI.login(params[:username], use_portal: true, use_tunes: false, portal_team_id: params[:team_id], team_name: params[:team_name])
+        end
+        certs = Spaceship::ConnectAPI::Certificate.all(filter: { certificateType: certificate_type })
+
+        # Base64 encode contents to find match from API to find a cert ID
+        cert_contents_base_64 = Base64.strict_encode64(File.binread(cert_path))
+        matching_cert = certs.find do |cert|
+          cert.certificate_content == cert_contents_base_64
+        end
+
+        UI.user_error!("This certificate cannot be imported - the certificate contents did not match with any available on the Developer Portal") if matching_cert.nil?
+
+        # Make dir if doesn't exist
+        FileUtils.mkdir_p(output_dir_certs)
+        dest_cert_path = File.join(output_dir_certs, "#{matching_cert.id}.cer")
+        dest_p12_path = File.join(output_dir_certs, "#{matching_cert.id}.p12")
+      end
+
+      files_to_commit = [dest_cert_path, dest_p12_path]
+
+      # Copy files
+      IO.copy_stream(cert_path, dest_cert_path)
+      IO.copy_stream(p12_path, dest_p12_path)
+      unless profile_path.nil?
+        FileUtils.mkdir_p(output_dir_profiles)
+        bundle_id = FastlaneCore::ProvisioningProfile.bundle_id(profile_path)
+        profile_extension = FastlaneCore::ProvisioningProfile.profile_extension(profile_path)
+        profile_type_name = Match::Generator.profile_type_name(prov_type)
+        dest_profile_path = File.join(output_dir_profiles, "#{profile_type_name}_#{bundle_id}#{profile_extension}")
+        files_to_commit.push(dest_profile_path)
+        IO.copy_stream(profile_path, dest_profile_path)
+      end
+
+      # Encrypt and commit
+      encryption.encrypt_files if encryption
+      storage.save_changes!(files_to_commit: files_to_commit)
+    end
+
+    def ensure_valid_file_path(file_path, file_description, file_extension, optional: false)
+      optional_file_message = optional ? " or leave empty to skip this file" : ""
+      file_path ||= UI.input("#{file_description} (#{file_extension}) path#{optional_file_message}:")
+
+      file_path = File.absolute_path(file_path) unless file_path == ""
+      file_path = File.exist?(file_path) ? file_path : nil
+      UI.user_error!("#{file_description} does not exist at path: #{file_path}") unless !file_path.nil? || optional
+      file_path
+    end
+
+    def api_token(params)
+      @api_token ||= Spaceship::ConnectAPI::Token.create(params[:api_key]) if params[:api_key]
+      @api_token ||= Spaceship::ConnectAPI::Token.from_json_file(params[:api_key_path]) if params[:api_key_path]
+      return @api_token
+    end
+  end
+end