fastlane_hotfix 2.165.0

data/match/lib/match/options.rb

@@ -0,0 +1,315 @@
+require 'fastlane_core/configuration/config_item'
+require 'fastlane/helper/lane_helper'
+require 'credentials_manager/appfile_config'
+require_relative 'module'
+
+module Match
+  class Options
+    # This is match specific, as users can append storage specific options
+    def self.append_option(option)
+      self.available_options # to ensure we created the initial `@available_options` array
+      @available_options << option
+    end
+
+    def self.default_platform
+      case Fastlane::Helper::LaneHelper.current_platform.to_s
+      when "mac"
+        "macos"
+      else
+        "ios"
+      end
+    end
+
+    def self.available_options
+      user = CredentialsManager::AppfileConfig.try_fetch_value(:apple_dev_portal_id)
+      user ||= CredentialsManager::AppfileConfig.try_fetch_value(:apple_id)
+
+      [
+        # main
+        FastlaneCore::ConfigItem.new(key: :type,
+                                     env_name: "MATCH_TYPE",
+                                     description: "Define the profile type, can be #{Match.environments.join(', ')}",
+                                     short_option: "-y",
+                                     default_value: 'development',
+                                     verify_block: proc do |value|
+                                       unless Match.environments.include?(value)
+                                         UI.user_error!("Unsupported environment #{value}, must be in #{Match.environments.join(', ')}")
+                                       end
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :additional_cert_types,
+                                     env_name: "MATCH_ADDITIONAL_CERT_TYPES",
+                                     description: "Create additional cert types needed for macOS installers (valid values: mac_installer_distribution, developer_id_installer)",
+                                     optional: true,
+                                     type: Array,
+                                     verify_block: proc do |values|
+                                       types = %w(mac_installer_distribution developer_id_installer)
+                                       UI.user_error!("Unsupported types, must be: #{types}") unless (values - types).empty?
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :readonly,
+                                     env_name: "MATCH_READONLY",
+                                     description: "Only fetch existing certificates and profiles, don't generate new ones",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :generate_apple_certs,
+                                     env_name: "MATCH_GENERATE_APPLE_CERTS",
+                                     description: "Create a certificate type for Xcode 11 and later (Apple Development or Apple Distribution)",
+                                     type: Boolean,
+                                     default_value: FastlaneCore::Helper.mac? && FastlaneCore::Helper.xcode_at_least?('11'),
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :skip_provisioning_profiles,
+                                     env_name: "MATCH_SKIP_PROVISIONING_PROFILES",
+                                     description: "Skip syncing provisioning profiles",
+                                     type: Boolean,
+                                     default_value: false),
+
+        FastlaneCore::ConfigItem.new(key: :app_identifier,
+                                     short_option: "-a",
+                                     env_name: "MATCH_APP_IDENTIFIER",
+                                     description: "The bundle identifier(s) of your app (comma-separated string or array of strings)",
+                                     type: Array, # we actually allow String and Array here
+                                     skip_type_validation: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier),
+                                     default_value_dynamic: true),
+
+        # App Store Connect API
+        FastlaneCore::ConfigItem.new(key: :api_key_path,
+                                     env_name: "SIGH_API_KEY_PATH",
+                                     description: "Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)",
+                                     optional: true,
+                                     conflicting_options: [:api_key],
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Couldn't find API key JSON file at path '#{value}'") unless File.exist?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :api_key,
+                                     env_name: "SIGH_API_KEY",
+                                     description: "Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#use-return-value-and-pass-in-as-an-option)",
+                                     type: Hash,
+                                     optional: true,
+                                     sensitive: true,
+                                     conflicting_options: [:api_key_path]),
+
+        # Apple ID
+        FastlaneCore::ConfigItem.new(key: :username,
+                                     short_option: "-u",
+                                     env_name: "MATCH_USERNAME",
+                                     description: "Your Apple ID Username",
+                                     optional: true,
+                                     default_value: user,
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :team_id,
+                                     short_option: "-b",
+                                     env_name: "FASTLANE_TEAM_ID",
+                                     description: "The ID of your Developer Portal team if you're in multiple teams",
+                                     optional: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_id),
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :team_name,
+                                     short_option: "-l",
+                                     env_name: "FASTLANE_TEAM_NAME",
+                                     description: "The name of your Developer Portal team if you're in multiple teams",
+                                     optional: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_name),
+                                     default_value_dynamic: true),
+
+        # Storage
+        FastlaneCore::ConfigItem.new(key: :storage_mode,
+                                     env_name: "MATCH_STORAGE_MODE",
+                                     description: "Define where you want to store your certificates",
+                                     short_option: "-q",
+                                     default_value: 'git',
+                                     verify_block: proc do |value|
+                                       unless Match.storage_modes.include?(value)
+                                         UI.user_error!("Unsupported storage_mode #{value}, must be in #{Match.storage_modes.join(', ')}")
+                                       end
+                                     end),
+
+        # Storage: Git
+        FastlaneCore::ConfigItem.new(key: :git_url,
+                                     env_name: "MATCH_GIT_URL",
+                                     description: "URL to the git repo containing all the certificates",
+                                     optional: false,
+                                     short_option: "-r"),
+        FastlaneCore::ConfigItem.new(key: :git_branch,
+                                     env_name: "MATCH_GIT_BRANCH",
+                                     description: "Specific git branch to use",
+                                     default_value: 'master'),
+        FastlaneCore::ConfigItem.new(key: :git_full_name,
+                                     env_name: "MATCH_GIT_FULL_NAME",
+                                     description: "git user full name to commit",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :git_user_email,
+                                     env_name: "MATCH_GIT_USER_EMAIL",
+                                     description: "git user email to commit",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :shallow_clone,
+                                     env_name: "MATCH_SHALLOW_CLONE",
+                                     description: "Make a shallow clone of the repository (truncate the history to 1 revision)",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :clone_branch_directly,
+                                     env_name: "MATCH_CLONE_BRANCH_DIRECTLY",
+                                     description: "Clone just the branch specified, instead of the whole repo. This requires that the branch already exists. Otherwise the command will fail",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :git_basic_authorization,
+                                     env_name: "MATCH_GIT_BASIC_AUTHORIZATION",
+                                     sensitive: true,
+                                     description: "Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64",
+                                     conflicting_options: [:git_bearer_authorization, :git_private_key],
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :git_bearer_authorization,
+                                     env_name: "MATCH_GIT_BEARER_AUTHORIZATION",
+                                     sensitive: true,
+                                     description: "Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64",
+                                     conflicting_options: [:git_basic_authorization, :git_private_key],
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :git_private_key,
+                                     env_name: "MATCH_GIT_PRIVATE_KEY",
+                                     sensitive: true,
+                                     description: "Use a private key to access the git repo (e.g.: access to GitHub repository via Deploy keys), usually a id_rsa named file or the contents hereof",
+                                     conflicting_options: [:git_basic_authorization, :git_bearer_authorization],
+                                     optional: true,
+                                     default_value: nil),
+
+        # Storage: Google Cloud
+        FastlaneCore::ConfigItem.new(key: :google_cloud_bucket_name,
+                                     env_name: "MATCH_GOOGLE_CLOUD_BUCKET_NAME",
+                                     description: "Name of the Google Cloud Storage bucket to use",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :google_cloud_keys_file,
+                                     env_name: "MATCH_GOOGLE_CLOUD_KEYS_FILE",
+                                     description: "Path to the gc_keys.json file",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Could not find keys file at path '#{File.expand_path(value)}'") unless File.exist?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :google_cloud_project_id,
+                                     env_name: "MATCH_GOOGLE_CLOUD_PROJECT_ID",
+                                     description: "ID of the Google Cloud project to use for authentication",
+                                     optional: true),
+
+        # Storage: S3
+        FastlaneCore::ConfigItem.new(key: :s3_region,
+                                     env_name: "MATCH_S3_REGION",
+                                     description: "Name of the S3 region",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :s3_access_key,
+                                     env_name: "MATCH_S3_ACCESS_KEY",
+                                     description: "S3 access key",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :s3_secret_access_key,
+                                     env_name: "MATCH_S3_SECRET_ACCESS_KEY",
+                                     description: "S3 secret access key",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :s3_bucket,
+                                     env_name: "MATCH_S3_BUCKET",
+                                     description: "Name of the S3 bucket",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :s3_object_prefix,
+                                     env_name: "MATCH_S3_OBJECT_PREFIX",
+                                     description: "Prefix to be used on all objects uploaded to S3",
+                                     optional: true),
+
+        # Keychain
+        FastlaneCore::ConfigItem.new(key: :keychain_name,
+                                     short_option: "-s",
+                                     env_name: "MATCH_KEYCHAIN_NAME",
+                                     description: "Keychain the items should be imported to",
+                                     default_value: "login.keychain"),
+        FastlaneCore::ConfigItem.new(key: :keychain_password,
+                                     short_option: "-p",
+                                     env_name: "MATCH_KEYCHAIN_PASSWORD",
+                                     sensitive: true,
+                                     description: "This might be required the first time you access certificates on a new mac. For the login/default keychain this is your account password",
+                                     optional: true),
+
+        # settings
+        FastlaneCore::ConfigItem.new(key: :force,
+                                     env_name: "MATCH_FORCE",
+                                     description: "Renew the provisioning profiles every time you run match",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :force_for_new_devices,
+                                     env_name: "MATCH_FORCE_FOR_NEW_DEVICES",
+                                     description: "Renew the provisioning profiles if the device count on the developer portal has changed. Ignored for profile type 'appstore'",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :skip_confirmation,
+                                     env_name: "MATCH_SKIP_CONFIRMATION",
+                                     description: "Disables confirmation prompts during nuke, answering them with yes",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :skip_docs,
+                                     env_name: "MATCH_SKIP_DOCS",
+                                     description: "Skip generation of a README.md for the created git repository",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :platform,
+                                     short_option: '-o',
+                                     env_name: "MATCH_PLATFORM",
+                                     description: "Set the provisioning profile's platform to work with (i.e. ios, tvos, macos, catalyst)",
+                                     default_value: default_platform,
+                                     default_value_dynamic: true,
+                                     verify_block: proc do |value|
+                                       value = value.to_s
+                                       pt = %w(tvos ios macos catalyst)
+                                       UI.user_error!("Unsupported platform, must be: #{pt}") unless pt.include?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :derive_catalyst_app_identifier,
+                                     env_name: "MATCH_DERIVE_CATALYST_APP_IDENTIFIER",
+                                     description: "Enable this if you have the Mac Catalyst capability enabled and your project was created with Xcode 11.3 or earlier. Prepends 'maccatalyst.' to the app identifier for the provisioning profile mapping",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :template_name,
+                                     env_name: "MATCH_PROVISIONING_PROFILE_TEMPLATE_NAME",
+                                     description: "The name of provisioning profile template. If the developer account has provisioning profile templates (aka: custom entitlements), the template name can be found by inspecting the Entitlements drop-down while creating/editing a provisioning profile (e.g. \"Apple Pay Pass Suppression Development\")",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :profile_name,
+                                    env_name: "MATCH_PROVISIONING_PROFILE_NAME",
+                                    description: "A custom name for the provisioning profile. This will replace the default provisioning profile name if specified",
+                                    optional: true,
+                                    default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :fail_on_name_taken,
+                                     env_name: "MATCH_FAIL_ON_NAME_TAKEN",
+                                     description: "Should the command fail if it was about to create a duplicate of an existing provisioning profile. It can happen due to issues on Apple Developer Portal, when profile to be recreated was not properly deleted first",
+                                     optional: true,
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :skip_certificate_matching,
+                                     env_name: "MATCH_SKIP_CERTIFICATE_MATCHING",
+                                     description: "Set to true if there is no access to Apple developer portal but there are certificates, keys and profiles provided. Only works with match import action",
+                                     optional: true,
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :output_path,
+                                     env_name: "MATCH_OUTPUT_PATH",
+                                     description: "Path in which to export certificates, key and profile",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :skip_set_partition_list,
+                                     short_option: "-P",
+                                     env_name: "MATCH_SKIP_SET_PARTITION_LIST",
+                                     description: "Skips setting the partition list (which can sometimes take a long time). Setting the partition list is usually needed to prevent Xcode from prompting to allow a cert to be used for signing",
+                                     type: Boolean,
+                                     default_value: false),
+
+        # other
+        FastlaneCore::ConfigItem.new(key: :verbose,
+                                     env_name: "MATCH_VERBOSE",
+                                     description: "Print out extra information and all commands",
+                                     type: Boolean,
+                                     default_value: false,
+                                     verify_block: proc do |value|
+                                       FastlaneCore::Globals.verbose = true if value
+                                     end)
+      ]
+    end
+  end
+end

data/match/lib/match/runner.rb

@@ -0,0 +1,369 @@
+require 'fastlane_core/cert_checker'
+require 'fastlane_core/provisioning_profile'
+require 'fastlane_core/print_table'
+require 'spaceship/client'
+require_relative 'generator'
+require_relative 'module'
+require_relative 'table_printer'
+require_relative 'spaceship_ensure'
+require_relative 'utils'
+
+require_relative 'storage'
+require_relative 'encryption'
+
+module Match
+  class Runner
+    attr_accessor :files_to_commit
+    attr_accessor :spaceship
+
+    attr_accessor :storage
+
+    # rubocop:disable Metrics/PerceivedComplexity
+    def run(params)
+      self.files_to_commit = []
+
+      FileUtils.mkdir_p(params[:output_path]) if params[:output_path]
+
+      FastlaneCore::PrintTable.print_values(config: params,
+                                             title: "Summary for match #{Fastlane::VERSION}")
+
+      update_optional_values_depending_on_storage_type(params)
+
+      # Choose the right storage and encryption implementations
+      self.storage = Storage.for_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        skip_docs: params[:skip_docs],
+        git_branch: params[:git_branch],
+        git_full_name: params[:git_full_name],
+        git_user_email: params[:git_user_email],
+        clone_branch_directly: params[:clone_branch_directly],
+        git_basic_authorization: params[:git_basic_authorization],
+        git_bearer_authorization: params[:git_bearer_authorization],
+        git_private_key: params[:git_private_key],
+        type: params[:type].to_s,
+        generate_apple_certs: params[:generate_apple_certs],
+        platform: params[:platform].to_s,
+        google_cloud_bucket_name: params[:google_cloud_bucket_name].to_s,
+        google_cloud_keys_file: params[:google_cloud_keys_file].to_s,
+        google_cloud_project_id: params[:google_cloud_project_id].to_s,
+        s3_region: params[:s3_region],
+        s3_access_key: params[:s3_access_key],
+        s3_secret_access_key: params[:s3_secret_access_key],
+        s3_bucket: params[:s3_bucket],
+        s3_object_prefix: params[:s3_object_prefix],
+        readonly: params[:readonly],
+        username: params[:readonly] ? nil : params[:username], # only pass username if not readonly
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        api_key_path: params[:api_key_path],
+        api_key: params[:api_key]
+      })
+      storage.download
+
+      # Init the encryption only after the `storage.download` was called to have the right working directory
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        working_directory: storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+
+      unless params[:readonly]
+        self.spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name], api_token(params))
+        if params[:type] == "enterprise" && !Spaceship.client.in_house?
+          UI.user_error!("You defined the profile type 'enterprise', but your Apple account doesn't support In-House profiles")
+        end
+      end
+
+      if params[:app_identifier].kind_of?(Array)
+        app_identifiers = params[:app_identifier]
+      else
+        app_identifiers = params[:app_identifier].to_s.split(/\s*,\s*/).uniq
+      end
+
+      # sometimes we get an array with arrays, this is a bug. To unblock people using match, I suggest we flatten!
+      # then in the future address the root cause of https://github.com/fastlane/fastlane/issues/11324
+      app_identifiers.flatten!
+
+      # Verify the App ID (as we don't want 'match' to fail at a later point)
+      if spaceship
+        app_identifiers.each do |app_identifier|
+          spaceship.bundle_identifier_exists(username: params[:username], app_identifier: app_identifier, platform: params[:platform])
+        end
+      end
+
+      # Certificate
+      cert_id = fetch_certificate(params: params, working_directory: storage.working_directory)
+
+      # Mac Installer Distribution Certificate
+      additional_cert_types = params[:additional_cert_types] || []
+      cert_ids = additional_cert_types.map do |additional_cert_type|
+        fetch_certificate(params: params, working_directory: storage.working_directory, specific_cert_type: additional_cert_type)
+      end
+
+      cert_ids << cert_id
+      spaceship.certificates_exists(username: params[:username], certificate_ids: cert_ids) if spaceship
+
+      # Provisioning Profiles
+      unless params[:skip_provisioning_profiles]
+        app_identifiers.each do |app_identifier|
+          loop do
+            break if fetch_provisioning_profile(params: params,
+                                        certificate_id: cert_id,
+                                        app_identifier: app_identifier,
+                                    working_directory: storage.working_directory)
+          end
+        end
+      end
+
+      if self.files_to_commit.count > 0 && !params[:readonly]
+        encryption.encrypt_files if encryption
+        storage.save_changes!(files_to_commit: self.files_to_commit)
+      end
+
+      # Print a summary table for each app_identifier
+      app_identifiers.each do |app_identifier|
+        TablePrinter.print_summary(app_identifier: app_identifier, type: params[:type], platform: params[:platform])
+      end
+
+      UI.success("All required keys, certificates and provisioning profiles are installed 🙌".green)
+    rescue Spaceship::Client::UnexpectedResponse, Spaceship::Client::InvalidUserCredentialsError, Spaceship::Client::NoUserCredentialsError => ex
+      UI.error("An error occurred while verifying your certificates and profiles with the Apple Developer Portal.")
+      UI.error("If you already have your certificates stored in git, you can run `fastlane match` in readonly mode")
+      UI.error("to just install the certificates and profiles without accessing the Dev Portal.")
+      UI.error("To do so, just pass `readonly: true` to your match call.")
+      raise ex
+    ensure
+      storage.clear_changes if storage
+    end
+    # rubocop:enable Metrics/PerceivedComplexity
+
+    def api_token(params)
+      @api_token ||= Spaceship::ConnectAPI::Token.create(params[:api_key]) if params[:api_key]
+      @api_token ||= Spaceship::ConnectAPI::Token.from_json_file(params[:api_key_path]) if params[:api_key_path]
+      return @api_token
+    end
+
+    # Used when creating a new certificate or profile
+    def prefixed_working_directory
+      return self.storage.prefixed_working_directory
+    end
+
+    # Be smart about optional values here
+    # Depending on the storage mode, different values are required
+    def update_optional_values_depending_on_storage_type(params)
+      if params[:storage_mode] != "git"
+        params.option_for_key(:git_url).optional = true
+      end
+    end
+
+    def fetch_certificate(params: nil, working_directory: nil, specific_cert_type: nil)
+      cert_type = Match.cert_type_sym(specific_cert_type || params[:type])
+
+      certs = Dir[File.join(prefixed_working_directory, "certs", cert_type.to_s, "*.cer")]
+      keys = Dir[File.join(prefixed_working_directory, "certs", cert_type.to_s, "*.p12")]
+
+      if certs.count == 0 || keys.count == 0
+        UI.important("Couldn't find a valid code signing identity for #{cert_type}... creating one for you now")
+        UI.crash!("No code signing identity found and can not create a new one because you enabled `readonly`") if params[:readonly]
+        cert_path = Generator.generate_certificate(params, cert_type, prefixed_working_directory, specific_cert_type: specific_cert_type)
+        private_key_path = cert_path.gsub(".cer", ".p12")
+
+        self.files_to_commit << cert_path
+        self.files_to_commit << private_key_path
+      else
+        cert_path = certs.last
+
+        # Check validity of certificate
+        if Utils.is_cert_valid?(cert_path)
+          UI.verbose("Your certificate '#{File.basename(cert_path)}' is valid")
+        else
+          UI.user_error!("Your certificate '#{File.basename(cert_path)}' is not valid, please check end date and renew it if necessary")
+        end
+
+        if Helper.mac?
+          UI.message("Installing certificate...")
+
+          # Only looking for cert in "custom" (non login.keychain) keychain
+          # Doing this for backwards compatibility
+          keychain_name = params[:keychain_name] == "login.keychain" ? nil : params[:keychain_name]
+
+          if FastlaneCore::CertChecker.installed?(cert_path, in_keychain: keychain_name)
+            UI.verbose("Certificate '#{File.basename(cert_path)}' is already installed on this machine")
+          else
+            Utils.import(cert_path, params[:keychain_name], password: params[:keychain_password])
+          end
+
+          # Import the private key
+          # there seems to be no good way to check if it's already installed - so just install it
+          # Key will only be added to the partition list if it isn't already installed
+          Utils.import(keys.last, params[:keychain_name], password: params[:keychain_password])
+        else
+          UI.message("Skipping installation of certificate as it would not work on this operating system.")
+        end
+
+        if params[:output_path]
+          FileUtils.cp(cert_path, params[:output_path])
+          FileUtils.cp(keys.last, params[:output_path])
+        end
+
+        # Get and print info of certificate
+        info = Utils.get_cert_info(cert_path)
+        TablePrinter.print_certificate_info(cert_info: info)
+      end
+
+      return File.basename(cert_path).gsub(".cer", "") # Certificate ID
+    end
+
+    # rubocop:disable Metrics/PerceivedComplexity
+    # @return [String] The UUID of the provisioning profile so we can verify it with the Apple Developer Portal
+    def fetch_provisioning_profile(params: nil, certificate_id: nil, app_identifier: nil, working_directory: nil)
+      prov_type = Match.profile_type_sym(params[:type])
+
+      names = [Match::Generator.profile_type_name(prov_type), app_identifier]
+      if params[:platform].to_s == :tvos.to_s || params[:platform].to_s == :catalyst.to_s
+        names.push(params[:platform])
+      end
+
+      profile_name = names.join("_").gsub("*", '\*') # this is important, as it shouldn't be a wildcard
+      base_dir = File.join(prefixed_working_directory, "profiles", prov_type.to_s)
+
+      extension = ".mobileprovision"
+      if [:macos.to_s, :catalyst.to_s].include?(params[:platform].to_s)
+        extension = ".provisionprofile"
+      end
+
+      profile_file = "#{profile_name}#{extension}"
+      profiles = Dir[File.join(base_dir, profile_file)]
+      if Helper.mac?
+        keychain_path = FastlaneCore::Helper.keychain_path(params[:keychain_name]) unless params[:keychain_name].nil?
+      end
+
+      # Install the provisioning profiles
+      profile = profiles.last
+      force = params[:force]
+
+      if params[:force_for_new_devices] && !params[:readonly]
+        if prov_type != :appstore && !params[:force]
+          force = device_count_different?(profile: profile, keychain_path: keychain_path, platform: params[:platform].to_sym)
+        else
+          # App Store provisioning profiles don't contain device identifiers and
+          # thus shouldn't be renewed if the device count has changed.
+          UI.important("Warning: `force_for_new_devices` is set but is ignored for App Store provisioning profiles.")
+          UI.important("You can safely stop specifying `force_for_new_devices` when running Match for type 'appstore'.")
+        end
+      end
+
+      if profile.nil? || force
+        if params[:readonly]
+          UI.error("No matching provisioning profiles found for '#{profile_file}'")
+          UI.error("A new one cannot be created because you enabled `readonly`")
+          if Dir.exist?(base_dir) # folder for `prov_type` does not exist on first match use for that type
+            all_profiles = Dir.entries(base_dir).reject { |f| f.start_with?(".") }
+            UI.error("Provisioning profiles in your repo for type `#{prov_type}`:")
+            all_profiles.each { |p| UI.error("- '#{p}'") }
+          end
+          UI.error("If you are certain that a profile should exist, double-check the recent changes to your match repository")
+          UI.user_error!("No matching provisioning profiles found and can not create a new one because you enabled `readonly`. Check the output above for more information.")
+        end
+
+        profile = Generator.generate_provisioning_profile(params: params,
+                                                       prov_type: prov_type,
+                                                  certificate_id: certificate_id,
+                                                  app_identifier: app_identifier,
+                                                           force: force,
+                                               working_directory: prefixed_working_directory)
+        self.files_to_commit << profile
+      end
+
+      if Helper.mac?
+        installed_profile = FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      end
+      parsed = FastlaneCore::ProvisioningProfile.parse(profile, keychain_path)
+      uuid = parsed["UUID"]
+
+      if params[:output_path]
+        FileUtils.cp(profile, params[:output_path])
+      end
+
+      if spaceship && !spaceship.profile_exists(username: params[:username], uuid: uuid, platform: params[:platform])
+        # This profile is invalid, let's remove the local file and generate a new one
+        File.delete(profile)
+        # This method will be called again, no need to modify `files_to_commit`
+        return nil
+      end
+
+      Utils.fill_environment(Utils.environment_variable_name(app_identifier: app_identifier,
+                                                                       type: prov_type,
+                                                                   platform: params[:platform]),
+
+                             uuid)
+
+      # TeamIdentifier is returned as an array, but we're not sure why there could be more than one
+      Utils.fill_environment(Utils.environment_variable_name_team_id(app_identifier: app_identifier,
+                                                                               type: prov_type,
+                                                                           platform: params[:platform]),
+                             parsed["TeamIdentifier"].first)
+
+      Utils.fill_environment(Utils.environment_variable_name_profile_name(app_identifier: app_identifier,
+                                                                                    type: prov_type,
+                                                                                platform: params[:platform]),
+                             parsed["Name"])
+
+      Utils.fill_environment(Utils.environment_variable_name_profile_path(app_identifier: app_identifier,
+                                                                                    type: prov_type,
+                                                                                platform: params[:platform]),
+                             installed_profile)
+
+      return uuid
+    end
+    # rubocop:enable Metrics/PerceivedComplexity
+
+    def device_count_different?(profile: nil, keychain_path: nil, platform: nil)
+      return false unless profile
+
+      parsed = FastlaneCore::ProvisioningProfile.parse(profile, keychain_path)
+      uuid = parsed["UUID"]
+
+      all_profiles = Spaceship::ConnectAPI::Profile.all(includes: "devices")
+      portal_profile = all_profiles.detect { |i| i.uuid == uuid }
+
+      if portal_profile
+        profile_device_count = portal_profile.fetch_all_devices.count
+
+        device_classes =
+          case platform
+          when :ios
+            [
+              Spaceship::ConnectAPI::Device::DeviceClass::IPAD,
+              Spaceship::ConnectAPI::Device::DeviceClass::IPHONE,
+              Spaceship::ConnectAPI::Device::DeviceClass::IPOD,
+              Spaceship::ConnectAPI::Device::DeviceClass::APPLE_WATCH
+            ]
+          when :tvos
+            [
+              Spaceship::ConnectAPI::Device::DeviceClass::APPLE_TV
+            ]
+          when :mac, :catalyst
+            [
+              Spaceship::ConnectAPI::Device::DeviceClass::MAC
+            ]
+          else
+            []
+          end
+
+        devices = Spaceship::ConnectAPI::Device.all
+        unless device_classes.empty?
+          devices = devices.select do |device|
+            device_classes.include?(device.device_class)
+          end
+        end
+
+        portal_device_count = devices.size
+
+        return portal_device_count != profile_device_count
+      end
+      return false
+    end
+  end
+end