fastlane_hotfix 2.165.0

data/cert/lib/cert/runner.rb

@@ -0,0 +1,239 @@
+require 'fileutils'
+require 'fastlane_core/globals'
+require 'fastlane_core/cert_checker'
+require 'fastlane_core/keychain_importer'
+require 'fastlane_core/print_table'
+require 'spaceship'
+
+require_relative 'module'
+
+module Cert
+  class Runner
+    def launch
+      run
+
+      installed = FastlaneCore::CertChecker.installed?(ENV["CER_FILE_PATH"], in_keychain: ENV["CER_KEYCHAIN_PATH"])
+      UI.message("Verifying the certificate is properly installed locally...")
+      UI.user_error!("Could not find the newly generated certificate installed", show_github_issues: true) unless installed
+      UI.success("Successfully installed certificate #{ENV['CER_CERTIFICATE_ID']}")
+      return ENV["CER_FILE_PATH"]
+    end
+
+    def login
+      if api_token
+        UI.message("Creating authorization token for App Store Connect API")
+        Spaceship::ConnectAPI.token = api_token
+      else
+        UI.message("Starting login with user '#{Cert.config[:username]}'")
+        Spaceship::ConnectAPI.login(Cert.config[:username], nil, use_portal: true, use_tunes: false)
+        UI.message("Successfully logged in")
+      end
+    end
+
+    def api_token
+      @api_token ||= Spaceship::ConnectAPI::Token.create(Cert.config[:api_key]) if Cert.config[:api_key]
+      @api_token ||= Spaceship::ConnectAPI::Token.from_json_file(Cert.config[:api_key_path]) if Cert.config[:api_key_path]
+      return @api_token
+    end
+
+    def run
+      FileUtils.mkdir_p(Cert.config[:output_path])
+
+      FastlaneCore::PrintTable.print_values(config: Cert.config, hide_keys: [:output_path], title: "Summary for cert #{Fastlane::VERSION}")
+
+      login
+
+      should_create = Cert.config[:force]
+      unless should_create
+        cert_path = find_existing_cert
+        should_create = cert_path.nil?
+      end
+
+      return unless should_create
+
+      if create_certificate # no certificate here, creating a new one
+        return # success
+      else
+        UI.user_error!("Something went wrong when trying to create a new certificate...")
+      end
+    end
+
+    # Command method for the :revoke_expired sub-command
+    def revoke_expired_certs!
+      FastlaneCore::PrintTable.print_values(config: Cert.config, hide_keys: [:output_path], title: "Summary for cert #{Fastlane::VERSION}")
+
+      login
+
+      to_revoke = expired_certs
+
+      if to_revoke.empty?
+        UI.success("No expired certificates were found to revoke! 👍")
+        return
+      end
+
+      revoke_count = 0
+
+      to_revoke.each do |certificate|
+        begin
+          UI.message("#{certificate.id} #{certificate.display_name} has expired, revoking...")
+          certificate.delete!
+          revoke_count += 1
+        rescue => e
+          UI.error("An error occurred while revoking #{certificate.id} #{certificate.display_name}")
+          UI.error("#{e.message}\n#{e.backtrace.join("\n")}") if FastlaneCore::Globals.verbose?
+        end
+      end
+
+      UI.success("#{revoke_count} expired certificate#{'s' if revoke_count != 1} #{revoke_count == 1 ? 'has' : 'have'} been revoked! 👍")
+    end
+
+    def expired_certs
+      certificates.reject(&:valid?)
+    end
+
+    def find_existing_cert
+      certificates.each do |certificate|
+        unless certificate.certificate_content
+          next
+        end
+
+        path = store_certificate(certificate, Cert.config[:filename])
+        private_key_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.p12"))
+
+        # As keychain is specific to macOS, this will likely fail on non macOS systems.
+        # See also: https://github.com/fastlane/fastlane/pull/14462
+        keychain = File.expand_path(Cert.config[:keychain_path]) unless Cert.config[:keychain_path].nil?
+        if FastlaneCore::CertChecker.installed?(path, in_keychain: keychain)
+          # This certificate is installed on the local machine
+          ENV["CER_CERTIFICATE_ID"] = certificate.id
+          ENV["CER_FILE_PATH"] = path
+          ENV["CER_KEYCHAIN_PATH"] = keychain
+
+          UI.success("Found the certificate #{certificate.id} (#{certificate.display_name}) which is installed on the local machine. Using this one.")
+
+          return path
+        elsif File.exist?(private_key_path)
+          password = Cert.config[:keychain_password]
+          FastlaneCore::KeychainImporter.import_file(private_key_path, keychain, keychain_password: password, skip_set_partition_list: Cert.config[:skip_set_partition_list])
+          FastlaneCore::KeychainImporter.import_file(path, keychain, keychain_password: password, skip_set_partition_list: Cert.config[:skip_set_partition_list])
+
+          ENV["CER_CERTIFICATE_ID"] = certificate.id
+          ENV["CER_FILE_PATH"] = path
+          ENV["CER_KEYCHAIN_PATH"] = keychain
+
+          UI.success("Found the cached certificate #{certificate.id} (#{certificate.display_name}). Using this one.")
+
+          return path
+        else
+          UI.error("Certificate #{certificate.id} (#{certificate.display_name}) can't be found on your local computer")
+        end
+
+        File.delete(path) # as apparently this certificate is pretty useless without a private key
+      end
+
+      UI.important("Couldn't find an existing certificate... creating a new one")
+      return nil
+    end
+
+    # All certificates of this type
+    def certificates
+      filter = {
+        certificateType: certificate_type
+      }
+      return Spaceship::ConnectAPI::Certificate.all(filter: filter)
+    end
+
+    # The kind of certificate we're interested in
+    def certificate_type
+      if Cert.config[:type]
+        case Cert.config[:type].to_sym
+        when :mac_installer_distribution
+          return Spaceship::ConnectAPI::Certificate::CertificateType::MAC_INSTALLER_DISTRIBUTION
+        when :developer_id_application
+          return Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_APPLICATION
+        when :developer_id_kext
+          return Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPER_ID_KEXT
+        when :developer_id_installer
+          raise "Cannot do with ASC API?"
+          # return Spaceship.certificate.developer_id_installer
+        else
+          UI.user_error("Unaccepted value for :type - #{Cert.config[:type]}")
+        end
+      end
+
+      # Check if apple certs (Xcode 11 and later) should be used
+      if Cert.config[:generate_apple_certs]
+        cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::DISTRIBUTION
+        cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION if Spaceship::ConnectAPI.client.in_house? # Enterprise doesn't use Apple Distribution
+        cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT if Cert.config[:development]
+      else
+        case Cert.config[:platform].to_s
+        when 'ios', 'tvos'
+          cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION
+          cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DISTRIBUTION if Spaceship::ConnectAPI.client.in_house?
+          cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DEVELOPMENT if Cert.config[:development]
+
+        when 'macos'
+          cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DISTRIBUTION
+          cert_type = Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DEVELOPMENT if Cert.config[:development]
+        end
+      end
+
+      return cert_type
+    end
+
+    def create_certificate
+      # Create a new certificate signing request
+      csr, pkey = Spaceship::ConnectAPI::Certificate.create_certificate_signing_request
+
+      # Use the signing request to create a new (development|distribution) certificate
+      begin
+        certificate = Spaceship::ConnectAPI::Certificate.create(
+          certificate_type: certificate_type,
+          csr_content: csr
+        )
+      rescue => ex
+        type_name = (Cert.config[:development] ? "Development" : "Distribution")
+        if ex.to_s.include?("You already have a current")
+          UI.user_error!("Could not create another #{type_name} certificate, reached the maximum number of available #{type_name} certificates.", show_github_issues: true)
+        elsif ex.to_s.include?("You are not allowed to perform this operation.") && type_name == "Distribution"
+          UI.user_error!("You do not have permission to create this certificate. Only Team Admins can create Distribution certificates\n 🔍 See https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/ManagingYourTeam/ManagingYourTeam.html for more information.")
+        end
+        raise ex
+      end
+
+      # Store all that onto the filesystem
+
+      request_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.certSigningRequest"))
+      File.write(request_path, csr.to_pem)
+
+      private_key_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.p12"))
+      File.write(private_key_path, pkey)
+
+      cert_path = store_certificate(certificate, Cert.config[:filename])
+
+      # Import all the things into the Keychain
+      keychain = File.expand_path(Cert.config[:keychain_path])
+      password = Cert.config[:keychain_password]
+      FastlaneCore::KeychainImporter.import_file(private_key_path, keychain, keychain_password: password, skip_set_partition_list: Cert.config[:skip_set_partition_list])
+      FastlaneCore::KeychainImporter.import_file(cert_path, keychain, keychain_password: password, skip_set_partition_list: Cert.config[:skip_set_partition_list])
+
+      # Environment variables for the fastlane action
+      ENV["CER_CERTIFICATE_ID"] = certificate.id
+      ENV["CER_FILE_PATH"] = cert_path
+
+      UI.success("Successfully generated #{certificate.id} which was imported to the local machine.")
+
+      return cert_path
+    end
+
+    def store_certificate(certificate, filename = nil)
+      cert_name = filename ? filename : certificate.id
+      cert_name = "#{cert_name}.cer" unless File.extname(cert_name) == ".cer"
+      path = File.expand_path(File.join(Cert.config[:output_path], cert_name))
+      raw_data = Base64.decode64(certificate.certificate_content)
+      File.write(path, raw_data.force_encoding("UTF-8"))
+      return path
+    end
+  end
+end

data/credentials_manager/README.md

@@ -0,0 +1,64 @@
+CredentialsManager
+===================
+
+`CredentialsManager` is used by most components in the [fastlane.tools](https://fastlane.tools) toolchain.
+
+All code related to your username and password can be found here: [account_manager.rb](https://github.com/fastlane/fastlane/blob/master/credentials_manager/lib/credentials_manager/account_manager.rb)
+
+## Usage
+Along with the [Ruby libraries](https://github.com/fastlane/fastlane/tree/master/credentials_manager#implementing-a-custom-solution) you can use the command line interface to add credentials to the keychain.
+
+**Adding Credentials**
+```
+fastlane fastlane-credentials add --username felix@krausefx.com
+Password: *********
+Credential felix@krausefx.com:********* added to keychain.
+```
+
+**Removing Credentials**
+```
+fastlane fastlane-credentials remove --username felix@krausefx.com
+password has been deleted.
+```
+
+## Storing in the keychain
+
+By default, your Apple credentials are stored in the macOS Keychain.
+
+Your password is only stored locally on your computer.
+
+## Change Password
+
+You can easily delete the stored password by opening the "Keychain Access" app, switching to *All Items*, and searching for "*deliver*". Select the item you want to change and delete it. Next time running one of the tools, you'll be asked for the new password.
+
+## Using environment variables
+
+Pass the user credentials via the following environment variables:
+
+```
+FASTLANE_USER
+FASTLANE_PASSWORD
+```
+
+If you don't want to have your password stored in the Keychain set the `FASTLANE_DONT_STORE_PASSWORD` environment variable to `"1"`.
+
+## Implementing a custom solution
+
+All _fastlane_ tools are Ruby-based, and you can take a look at the source code to easily implement your own authentication solution.
+
+```ruby
+require 'credentials_manager'
+
+data = CredentialsManager::AccountManager.new(user: user, password: password)
+puts data.user
+puts data.password
+```
+
+# Code of Conduct
+Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/CODE_OF_CONDUCT.md).
+
+# License
+
+This project is licensed under the terms of the MIT license. See the LICENSE file.
+
+> This project and all fastlane tools are in no way affiliated with Apple Inc. This project is open source under the MIT license, which means you have full access to the source code and can modify it to fit your own needs. All fastlane tools run on your own computer or server, so your credentials or other sensitive information will never leave your own computer. You are responsible for how you use fastlane tools.

data/credentials_manager/lib/credentials_manager.rb

@@ -0,0 +1,7 @@
+require_relative 'credentials_manager/account_manager'
+require_relative 'credentials_manager/cli'
+require_relative 'credentials_manager/appfile_config'
+
+module CredentialsManager
+  ROOT = Pathname.new(File.expand_path('../..', __FILE__))
+end

data/credentials_manager/lib/credentials_manager/account_manager.rb

@@ -0,0 +1,157 @@
+require 'security'
+require 'highline/import' # to hide the entered password
+
+require_relative 'appfile_config'
+
+module CredentialsManager
+  class AccountManager
+    DEFAULT_PREFIX = "deliver"
+
+    # Is used for iTunes Transporter
+    attr_reader :prefix
+
+    # @param prefix [String] Very optional, is used for the
+    #   iTunes Transporter which uses application specific passwords
+    # @param note [String] An optional note that will be shown next
+    #   to the password and username prompt
+    def initialize(user: nil, password: nil, prefix: nil, note: nil)
+      @prefix = prefix || DEFAULT_PREFIX
+
+      @user = user
+      @password = password
+      @note = note
+    end
+
+    # Is the default prefix "deliver"
+    def default_prefix?
+      @prefix == DEFAULT_PREFIX
+    end
+
+    def user
+      if default_prefix?
+        @user ||= ENV["FASTLANE_USER"]
+        @user ||= ENV["DELIVER_USER"]
+        @user ||= AppfileConfig.try_fetch_value(:apple_id)
+      end
+
+      ask_for_login if @user.to_s.length == 0
+      return @user
+    end
+
+    def fetch_password_from_env
+      password = ENV["FASTLANE_PASSWORD"] || ENV["DELIVER_PASSWORD"]
+      return password if password.to_s.length > 0
+      return nil
+    end
+
+    def password(ask_if_missing: true)
+      if default_prefix?
+        @password ||= fetch_password_from_env
+      end
+
+      unless @password
+        item = Security::InternetPassword.find(server: server_name)
+        @password ||= item.password if item
+      end
+      ask_for_login while ask_if_missing && @password.to_s.length == 0
+      return @password
+    end
+
+    # Call this method to ask the user to re-enter the credentials
+    # @param force: if false, the user is asked before it gets deleted
+    # @return: Did the user decide to remove the old entry and enter a new password?
+    def invalid_credentials(force: false)
+      puts("The login credentials for '#{user}' seem to be wrong".red)
+
+      if fetch_password_from_env
+        puts("The password was taken from the environment variable")
+        puts("Please make sure it is correct")
+        return false
+      end
+
+      if force || agree("Do you want to re-enter your password? (y/n)", true)
+        puts("Removing Keychain entry for user '#{user}'...".yellow) if mac?
+        remove_from_keychain
+        ask_for_login
+        return true
+      end
+      false
+    end
+
+    def add_to_keychain
+      if options
+        Security::InternetPassword.add(server_name, user, password, options)
+      else
+        Security::InternetPassword.add(server_name, user, password)
+      end
+    end
+
+    def remove_from_keychain
+      Security::InternetPassword.delete(server: server_name)
+      @password = nil
+    end
+
+    def server_name
+      "#{@prefix}.#{user}"
+    end
+
+    # Use env variables from this method to augment internet password item with additional data.
+    # These variables are used by Xamarin Studio to authenticate Apple developers.
+    def options
+      hash = {}
+      hash[:p] = ENV["FASTLANE_PATH"] if ENV["FASTLANE_PATH"]
+      hash[:P] = ENV["FASTLANE_PORT"] if ENV["FASTLANE_PORT"]
+      hash[:r] = ENV["FASTLANE_PROTOCOL"] if ENV["FASTLANE_PROTOCOL"]
+      hash.empty? ? nil : hash
+    end
+
+    private
+
+    def ask_for_login
+      if ENV["FASTLANE_HIDE_LOGIN_INFORMATION"].to_s.length == 0
+        puts("-------------------------------------------------------------------------------------".green)
+        puts("Please provide your Apple Developer Program account credentials".green)
+        puts("The login information you enter will be stored in your macOS Keychain".green) if mac?
+        if default_prefix?
+          # We don't want to show this message, if we ask for the application specific password
+          # which has a different prefix
+          puts("You can also pass the password using the `FASTLANE_PASSWORD` environment variable".green)
+          puts("See more information about it on GitHub: https://github.com/fastlane/fastlane/tree/master/credentials_manager".green) if mac?
+        end
+        puts("-------------------------------------------------------------------------------------".green)
+      end
+
+      if @user.to_s.length == 0
+        raise "Missing username, and running in non-interactive shell" if $stdout.isatty == false
+        prompt_text = "Username"
+        prompt_text += " (#{@note})" if @note
+        prompt_text += ": "
+        @user = ask(prompt_text) while @user.to_s.length == 0
+        # Returning here since only the username was asked for. This method will be called again when a password is needed.
+        return
+      end
+
+      while @password.to_s.length == 0
+        raise "Missing password for user #{@user}, and running in non-interactive shell" if $stdout.isatty == false
+        note = @note + " " if @note
+        @password = ask("Password (#{note}for #{@user}): ") { |q| q.echo = "*" }
+      end
+
+      return true if ENV["FASTLANE_DONT_STORE_PASSWORD"]
+      return true unless mac?
+
+      # Now we store this information in the keychain
+      if add_to_keychain
+        return true
+      else
+        puts("Could not store password in keychain".red)
+        return false
+      end
+    end
+
+    # Helper.mac? - but we don't have access to the helper here
+    def mac?
+      (/darwin/ =~ RUBY_PLATFORM) != nil
+    end
+  end
+end