fastlane_hotfix 2.165.1 → 2.187.0

data/screengrab/lib/screengrab/options.rb

@@ -22,7 +22,8 @@ module Screengrab
         FastlaneCore::ConfigItem.new(key: :build_tools_version,
                                      short_option: "-i",
                                      optional: true,
-                                     description: "The Android build tools version to use, e.g. '23.0.2'"),
+                                     description: "The Android build tools version to use, e.g. '23.0.2'",
+                                     deprecated: true),
         FastlaneCore::ConfigItem.new(key: :locales,
                                      description: "A list of locales which should be used",
                                      short_option: "-q",
@@ -82,10 +83,12 @@ module Screengrab
                                      env_name: 'SCREENGRAB_ENDING_LOCALE',
                                      optional: true,
                                      default_value: 'en-US',
-                                     description: "Return the device to this locale after running tests"),
+                                     description: "Return the device to this locale after running tests",
+                                     deprecated: true),
         FastlaneCore::ConfigItem.new(key: :use_adb_root,
                                      env_name: 'SCREENGRAB_USE_ADB_ROOT',
                                      description: "Restarts the adb daemon using `adb root` to allow access to screenshots directories on device. Use if getting 'Permission denied' errors",
+                                     deprecated: true,
                                      default_value: false,
                                      type: Boolean),
         FastlaneCore::ConfigItem.new(key: :app_apk_path,

data/screengrab/lib/screengrab/runner.rb

@@ -6,12 +6,6 @@ require_relative 'module'
 
 module Screengrab
   class Runner
-    NEEDED_PERMISSIONS = [
-      'android.permission.READ_EXTERNAL_STORAGE',
-      'android.permission.WRITE_EXTERNAL_STORAGE',
-      'android.permission.CHANGE_CONFIGURATION'
-    ].freeze
-
     attr_accessor :number_of_retries
 
     def initialize(executor = FastlaneCore::CommandExecutor,
@@ -24,6 +18,7 @@ module Screengrab
     end
 
     def run
+      # Standardize the locales
       FastlaneCore::PrintTable.print_values(config: @config, hide_keys: [], title: "Summary for screengrab #{Fastlane::VERSION}")
 
       app_apk_path = @config.fetch(:app_apk_path, ask: false)
@@ -57,14 +52,14 @@ module Screengrab
       device_serial = select_device
 
       device_screenshots_paths = [
-        determine_external_screenshots_path(device_serial, @config[:locales]),
-        determine_internal_screenshots_paths(@config[:app_package_name], @config[:locales])
-      ].flatten
+        determine_external_screenshots_path(device_serial, @config[:app_package_name], @config[:locales]),
+        determine_internal_screenshots_paths(device_serial, @config[:app_package_name], @config[:locales])
+      ].flatten(1)
 
       # Root is needed to access device paths at /data
       if @config[:use_adb_root]
-        run_adb_command("-s #{device_serial} root", print_all: false, print_command: true)
-        run_adb_command("-s #{device_serial} wait-for-device", print_all: false, print_command: true)
+        run_adb_command("-s #{device_serial.shellescape} root", print_all: false, print_command: true)
+        run_adb_command("-s #{device_serial.shellescape} wait-for-device", print_all: false, print_command: true)
       end
 
       clear_device_previous_screenshots(@config[:app_package_name], device_serial, device_screenshots_paths)
@@ -72,9 +67,7 @@ module Screengrab
       app_apk_path ||= select_app_apk(discovered_apk_paths)
       tests_apk_path ||= select_tests_apk(discovered_apk_paths)
 
-      validate_apk(app_apk_path)
-
-      number_of_screenshots = run_tests(device_type_dir_name, device_screenshots_paths, device_serial, app_apk_path, tests_apk_path, test_classes_to_use, test_packages_to_use, @config[:launch_arguments])
+      number_of_screenshots = run_tests(device_type_dir_name, device_serial, app_apk_path, tests_apk_path, test_classes_to_use, test_packages_to_use, @config[:launch_arguments])
 
       ReportsGenerator.new.generate
 
@@ -131,72 +124,71 @@ module Screengrab
       Dir.glob(File.join(output_directory, '**', device_type, '*.png'), File::FNM_CASEFOLD)
     end
 
-    def determine_external_screenshots_path(device_serial, locales)
+    def get_device_environment_variable(device_serial, variable_name)
       # macOS evaluates $foo in `echo $foo` before executing the command,
       # Windows doesn't - hence the double backslash vs. single backslash
-      command = Helper.windows? ? "shell echo \$EXTERNAL_STORAGE " : "shell echo \\$EXTERNAL_STORAGE"
-      device_ext_storage = run_adb_command("-s #{device_serial} #{command}",
-                                           print_all: true,
-                                           print_command: true)
-      device_ext_storage = device_ext_storage.strip
+      command = Helper.windows? ? "shell echo \$#{variable_name.shellescape.shellescape}" : "shell echo \\$#{variable_name.shellescape.shellescape}"
+      value = run_adb_command("-s #{device_serial.shellescape} #{command}",
+                              print_all: true,
+                              print_command: true)
+      return value.strip
+    end
+
+    # Don't need to use to use run-as if external
+    def use_adb_run_as?(path, device_serial)
+      device_ext_storage = get_device_environment_variable(device_serial, "EXTERNAL_STORAGE")
+      return !path.start_with?(device_ext_storage)
+    end
+
+    def determine_external_screenshots_path(device_serial, app_package_name, locales)
+      device_ext_storage = get_device_environment_variable(device_serial, "EXTERNAL_STORAGE")
       return locales.map do |locale|
-        File.join(device_ext_storage, @config[:app_package_name], 'screengrab', locale, "images", "screenshots")
-      end.flatten
+        [
+          File.join(device_ext_storage, app_package_name, 'screengrab', locale, "images", "screenshots"),
+          File.join(device_ext_storage, "Android", "data", app_package_name, 'files', 'screengrab', locale, "images", "screenshots")
+        ]
+      end.flatten.map { |path| [path, false] }
     end
 
-    def determine_internal_screenshots_paths(app_package_name, locales)
+    def determine_internal_screenshots_paths(device_serial, app_package_name, locales)
+      device_data = get_device_environment_variable(device_serial, "ANDROID_DATA")
       return locales.map do |locale|
         [
-          "/data/user/0/#{app_package_name}/files/#{app_package_name}/screengrab/#{locale}/images/screenshots",
+          "#{device_data}/user/0/#{app_package_name}/files/#{app_package_name}/screengrab/#{locale}/images/screenshots",
 
           # https://github.com/fastlane/fastlane/issues/15653#issuecomment-578541663
-          "/data/data/#{app_package_name}/files/#{app_package_name}/screengrab/#{locale}/images/screenshots",
+          "#{device_data}/data/#{app_package_name}/files/#{app_package_name}/screengrab/#{locale}/images/screenshots",
 
-          "/data/data/#{app_package_name}/app_screengrab/#{locale}/images/screenshots",
-          "/data/data/#{app_package_name}/screengrab/#{locale}/images/screenshots"
+          "#{device_data}/data/#{app_package_name}/app_screengrab/#{locale}/images/screenshots",
+          "#{device_data}/data/#{app_package_name}/screengrab/#{locale}/images/screenshots"
         ]
-      end.flatten
+      end.flatten.map { |path| [path, true] }
     end
 
     def clear_device_previous_screenshots(app_package_name, device_serial, device_screenshots_paths)
       UI.message('Cleaning screenshots on device')
 
-      device_screenshots_paths.each do |device_path|
-        if_device_path_exists(app_package_name, device_serial, device_path) do |path|
-          run_adb_command("-s #{device_serial} shell run-as #{app_package_name} rm -rf #{path}",
+      device_screenshots_paths.each do |(device_path, needs_run_as)|
+        if_device_path_exists(app_package_name, device_serial, device_path, needs_run_as) do |path|
+          # Determine if path needs the run-as permission
+          run_as = needs_run_as ? " run-as #{app_package_name.shellescape.shellescape}" : ""
+
+          run_adb_command("-s #{device_serial.shellescape} shell#{run_as} rm -rf #{path.shellescape.shellescape}",
                           print_all: true,
                           print_command: true)
         end
       end
     end
 
-    def validate_apk(app_apk_path)
-      unless @android_env.aapt_path
-        UI.important("The `aapt` command could not be found on your system, so your app APK could not be validated")
-        return
-      end
-
-      UI.message('Validating app APK')
-      apk_permissions = @executor.execute(command: "#{@android_env.aapt_path} dump permissions #{app_apk_path}",
-                                          print_all: true,
-                                          print_command: true)
-
-      missing_permissions = NEEDED_PERMISSIONS.reject { |needed| apk_permissions.include?(needed) }
-
-      if missing_permissions.any?
-        UI.user_error!("The needed permission(s) #{missing_permissions.join(', ')} could not be found in your app APK")
-      end
-    end
-
     def install_apks(device_serial, app_apk_path, tests_apk_path)
       UI.message('Installing app APK')
-      apk_install_output = run_adb_command("-s #{device_serial} install -t -r #{app_apk_path.shellescape}",
+      apk_install_output = run_adb_command("-s #{device_serial.shellescape} install -t -r #{app_apk_path.shellescape}",
                                            print_all: true,
                                            print_command: true)
       UI.user_error!("App APK could not be installed") if apk_install_output.include?("Failure [")
 
       UI.message('Installing tests APK')
-      apk_install_output = run_adb_command("-s #{device_serial} install -t -r #{tests_apk_path.shellescape}",
+      apk_install_output = run_adb_command("-s #{device_serial.shellescape} install -t -r #{tests_apk_path.shellescape}",
                                            print_all: true,
                                            print_command: true)
       UI.user_error!("Tests APK could not be installed") if apk_install_output.include?("Failure [")
@@ -207,14 +199,14 @@ module Screengrab
 
       if packages.include?(app_package_name.to_s)
         UI.message('Uninstalling app APK')
-        run_adb_command("-s #{device_serial} uninstall #{app_package_name}",
+        run_adb_command("-s #{device_serial.shellescape} uninstall #{app_package_name.shellescape}",
                         print_all: true,
                         print_command: true)
       end
 
       if packages.include?(tests_package_name.to_s)
         UI.message('Uninstalling tests APK')
-        run_adb_command("-s #{device_serial} uninstall #{tests_package_name}",
+        run_adb_command("-s #{device_serial.shellescape} uninstall #{tests_package_name.shellescape}",
                         print_all: true,
                         print_command: true)
       end
@@ -222,26 +214,37 @@ module Screengrab
 
     def grant_permissions(device_serial)
       UI.message('Granting the permission necessary to change locales on the device')
-      run_adb_command("-s #{device_serial} shell pm grant #{@config[:app_package_name]} android.permission.CHANGE_CONFIGURATION",
+      run_adb_command("-s #{device_serial.shellescape} shell pm grant #{@config[:app_package_name].shellescape.shellescape} android.permission.CHANGE_CONFIGURATION",
                       print_all: true,
-                      print_command: true)
+                      print_command: true,
+                      raise_errors: false)
 
-      if device_api_version(device_serial) >= 23
-        UI.message('Granting the permissions necessary to access device external storage')
-        run_adb_command("-s #{device_serial} shell pm grant #{@config[:app_package_name]} android.permission.WRITE_EXTERNAL_STORAGE",
-                        print_all: true,
-                        print_command: true)
-        run_adb_command("-s #{device_serial} shell pm grant #{@config[:app_package_name]} android.permission.READ_EXTERNAL_STORAGE",
-                        print_all: true,
-                        print_command: true)
-      end
+      UI.message('Granting the permissions necessary to access device external storage')
+      run_adb_command("-s #{device_serial.shellescape} shell pm grant #{@config[:app_package_name].shellescape.shellescape} android.permission.WRITE_EXTERNAL_STORAGE",
+                      print_all: true,
+                      print_command: true,
+                      raise_errors: false)
+      run_adb_command("-s #{device_serial.shellescape} shell pm grant #{@config[:app_package_name].shellescape.shellescape} android.permission.READ_EXTERNAL_STORAGE",
+                      print_all: true,
+                      print_command: true,
+                      raise_errors: false)
+    end
+
+    def kill_app(device_serial, package_name)
+      run_adb_command("-s #{device_serial.shellescape} shell am force-stop #{package_name.shellescape.shellescape}.test",
+                      print_all: true,
+                      print_command: true)
+      run_adb_command("-s #{device_serial.shellescape} shell am force-stop #{package_name.shellescape.shellescape}",
+                      print_all: true,
+                      print_command: true)
     end
 
-    def run_tests(device_type_dir_name, device_screenshots_paths, device_serial, app_apk_path, tests_apk_path, test_classes_to_use, test_packages_to_use, launch_arguments)
+    def run_tests(device_type_dir_name, device_serial, app_apk_path, tests_apk_path, test_classes_to_use, test_packages_to_use, launch_arguments)
+      sdk_version = device_api_version(device_serial)
       unless @config[:reinstall_app]
         install_apks(device_serial, app_apk_path, tests_apk_path)
         grant_permissions(device_serial)
-        enable_clean_status_bar(device_serial, app_apk_path)
+        enable_clean_status_bar(device_serial, sdk_version)
       end
 
       number_of_screenshots = 0
@@ -251,25 +254,28 @@ module Screengrab
           uninstall_apks(device_serial, @config[:app_package_name], @config[:tests_package_name])
           install_apks(device_serial, app_apk_path, tests_apk_path)
           grant_permissions(device_serial)
-          enable_clean_status_bar(device_serial, app_apk_path)
+        else
+          kill_app(device_serial, @config[:app_package_name])
         end
-        number_of_screenshots += run_tests_for_locale(device_type_dir_name, device_screenshots_paths, locale, device_serial, test_classes_to_use, test_packages_to_use, launch_arguments)
+        number_of_screenshots += run_tests_for_locale(device_type_dir_name, locale, device_serial, test_classes_to_use, test_packages_to_use, launch_arguments, sdk_version)
       end
 
       number_of_screenshots
     end
 
-    def run_tests_for_locale(device_type_dir_name, device_screenshots_paths, locale, device_serial, test_classes_to_use, test_packages_to_use, launch_arguments)
+    def run_tests_for_locale(device_type_dir_name, locale, device_serial, test_classes_to_use, test_packages_to_use, launch_arguments, sdk_version)
       UI.message("Running tests for locale: #{locale}")
 
-      instrument_command = ["-s #{device_serial} shell am instrument --no-window-animation -w",
-                            "-e testLocale #{locale.tr('-', '_')}",
-                            "-e endingLocale #{@config[:ending_locale].tr('-', '_')}"]
+      instrument_command = ["-s #{device_serial.shellescape} shell am instrument --no-window-animation -w",
+                            "-e testLocale #{locale.shellescape.shellescape}"]
+      if sdk_version >= 28
+        instrument_command << "--no-hidden-api-checks"
+      end
       instrument_command << "-e appendTimestamp #{@config[:use_timestamp_suffix]}"
-      instrument_command << "-e class #{test_classes_to_use.join(',')}" if test_classes_to_use
-      instrument_command << "-e package #{test_packages_to_use.join(',')}" if test_packages_to_use
+      instrument_command << "-e class #{test_classes_to_use.join(',').shellescape.shellescape}" if test_classes_to_use
+      instrument_command << "-e package #{test_packages_to_use.join(',').shellescape.shellescape}" if test_packages_to_use
       instrument_command << launch_arguments.map { |item| '-e ' + item }.join(' ') if launch_arguments
-      instrument_command << "#{@config[:tests_package_name]}/#{@config[:test_instrumentation_runner]}"
+      instrument_command << "#{@config[:tests_package_name].shellescape.shellescape}/#{@config[:test_instrumentation_runner].shellescape.shellescape}"
 
       test_output = run_adb_command(instrument_command.join(" \\\n"),
                                     print_all: true,
@@ -283,30 +289,40 @@ module Screengrab
         end
       end
 
-      pull_screenshots_from_device(locale, device_serial, device_screenshots_paths, device_type_dir_name)
+      pull_screenshots_from_device(locale, device_serial, device_type_dir_name)
     end
 
-    def pull_screenshots_from_device(locale, device_serial, device_screenshots_paths, device_type_dir_name)
+    def pull_screenshots_from_device(locale, device_serial, device_type_dir_name)
       UI.message("Pulling captured screenshots for locale #{locale} from the device")
       starting_screenshot_count = screenshot_file_names_in(@config[:output_directory], device_type_dir_name).length
 
       UI.verbose("Starting screenshot count is: #{starting_screenshot_count}")
 
+      device_screenshots_paths = [
+        determine_external_screenshots_path(device_serial, @config[:app_package_name], [locale]),
+        determine_internal_screenshots_paths(device_serial, @config[:app_package_name], [locale])
+      ].flatten(1)
+
       # Make a temp directory into which to pull the screenshots before they are moved to their final location.
       # This makes directory cleanup easier, as the temp directory will be removed when the block completes.
 
       Dir.mktmpdir do |tempdir|
-        device_screenshots_paths.each do |device_path|
-          if_device_path_exists(@config[:app_package_name], device_serial, device_path) do |path|
+        device_screenshots_paths.each do |(device_path, needs_run_as)|
+          if_device_path_exists(@config[:app_package_name], device_serial, device_path, needs_run_as) do |path|
+            UI.message(path)
             next unless path.include?(locale)
-            out = run_adb_command("-s #{device_serial} pull #{path} #{tempdir}",
+            out = run_adb_command("-s #{device_serial.shellescape} pull #{path.shellescape} #{tempdir.shellescape}",
                                   print_all: false,
                                   print_command: true,
                                   raise_errors: false)
             if out =~ /Permission denied/
               dir = File.dirname(path)
               base = File.basename(path)
-              run_adb_command("-s #{device_serial} shell run-as #{@config[:app_package_name]} 'tar -cC #{dir} #{base}' | tar -xvC #{tempdir}",
+
+              # Determine if path needs the run-as permission
+              run_as = needs_run_as ? " run-as #{@config[:app_package_name].shellescape.shellescape}" : ""
+
+              run_adb_command("-s #{device_serial.shellescape} shell#{run_as}  \"tar -cC #{dir} #{base}\" | tar -xv -f- -C #{tempdir}",
                               print_all: false,
                               print_command: true)
             end
@@ -370,8 +386,11 @@ module Screengrab
 
     # Some device commands fail if executed against a device path that does not exist, so this helper method
     # provides a way to conditionally execute a block only if the provided path exists on the device.
-    def if_device_path_exists(app_package_name, device_serial, device_path)
-      return if run_adb_command("-s #{device_serial} shell run-as #{app_package_name} ls #{device_path}",
+    def if_device_path_exists(app_package_name, device_serial, device_path, needs_run_as)
+      # Determine if path needs the run-as permission
+      run_as = needs_run_as ? " run-as #{app_package_name.shellescape.shellescape}" : ""
+
+      return if run_adb_command("-s #{device_serial.shellescape} shell#{run_as} ls #{device_path.shellescape.shellescape}",
                                 print_all: false,
                                 print_command: false).include?('No such file')
 
@@ -383,20 +402,19 @@ module Screengrab
 
     # Return an array of packages that are installed on the device
     def installed_packages(device_serial)
-      packages = run_adb_command("-s #{device_serial} shell pm list packages",
+      packages = run_adb_command("-s #{device_serial.shellescape} shell pm list packages",
                                  print_all: true,
                                  print_command: true)
       packages.split("\n").map { |package| package.gsub("package:", "") }
     end
 
     def run_adb_command(command, print_all: false, print_command: false, raise_errors: true)
-      adb_path = @android_env.adb_path.chomp("adb")
       adb_host = @config[:adb_host]
-      host = adb_host.nil? ? '' : "-H #{adb_host} "
+      host = adb_host.nil? ? '' : "-H #{adb_host.shellescape} "
       output = ''
       begin
         errout = nil
-        cmdout = @executor.execute(command: adb_path + "adb " + host + command,
+        cmdout = @executor.execute(command: @android_env.adb_path + " " + host + command,
                                   print_all: print_all,
                                   print_command: print_command,
                                   error: raise_errors ? nil : proc { |out, status| errout = out }) || ''
@@ -413,36 +431,21 @@ module Screengrab
     end
 
     def device_api_version(device_serial)
-      run_adb_command("-s #{device_serial} shell getprop ro.build.version.sdk",
+      run_adb_command("-s #{device_serial.shellescape} shell getprop ro.build.version.sdk",
                       print_all: true, print_command: true).to_i
     end
 
-    def enable_clean_status_bar(device_serial, app_apk_path)
-      return unless device_api_version(device_serial) >= 23
-
-      unless @android_env.aapt_path
-        UI.error("The `aapt` command could not be found, so status bar could not be cleaned. Make sure android_home is configured for screengrab or ANDROID_HOME is set in the environment")
-        return
-      end
-
-      # Check if the app wants to use the clean status bar feature
-      badging_dump = @executor.execute(command: "#{@android_env.aapt_path} dump badging #{app_apk_path}",
-                                       print_all: true, print_command: true)
-      return unless badging_dump.include?('uses-feature: name=\'tools.fastlane.screengrab.cleanstatusbar\'')
+    def enable_clean_status_bar(device_serial, sdk_version)
+      return unless sdk_version >= 23
 
       UI.message('Enabling clean status bar')
 
-      # Make sure the app requests the DUMP permission
-      unless badging_dump.include?('uses-permission: name=\'android.permission.DUMP\'')
-        UI.user_error!("The clean status bar feature requires the android.permission.DUMP permission but it could not be found in your app APK")
-      end
-
       # Grant the DUMP permission
-      run_adb_command("-s #{device_serial} shell pm grant #{@config[:app_package_name]} android.permission.DUMP",
-                      print_all: true, print_command: true)
+      run_adb_command("-s #{device_serial.shellescape} shell pm grant #{@config[:app_package_name].shellescape.shellescape} android.permission.DUMP",
+                      print_all: true, print_command: true, raise_errors: false)
 
       # Enable the SystemUI demo mode
-      run_adb_command("-s #{device_serial} shell settings put global sysui_demo_allowed 1",
+      run_adb_command("-s #{device_serial.shellescape} shell settings put global sysui_demo_allowed 1",
                       print_all: true, print_command: true)
     end
   end

data/sigh/lib/assets/resign.sh

@@ -75,6 +75,11 @@
 # new features August 2020
 # 1. fixes usage for users with GNU-sed in their $PATH
 #
+# new features May 2021
+# 1. fix entitlements merging when changing team
+#
+# new features June 2021
+# 1. fix the way app entitlements are extracted
 
 # Logging functions
 
@@ -346,7 +351,7 @@ function provision_for_bundle_id {
 }
 
 # Find the bundle identifier contained inside a provisioning profile
-function bundle_id_for_provison {
+function bundle_id_for_provision {
 
     local FULL_BUNDLE_ID=$(PlistBuddy -c 'Print :Entitlements:application-identifier' /dev/stdin <<< "$(security cms -D -i "$1")")
     checkStatus
@@ -384,7 +389,7 @@ function add_provision {
         error "Provisioning profile '$PROVISION' file does not exist"
     fi
 
-    local BUNDLE_ID=$(bundle_id_for_provison "$PROVISION")
+    local BUNDLE_ID=$(bundle_id_for_provision "$PROVISION")
     add_provision_for_bundle_id "$PROVISION" "$BUNDLE_ID"
 }
 
@@ -434,7 +439,7 @@ function resign {
         error "Use the -p option (example: -p com.example.app=xxxx.mobileprovision)"
     fi
 
-    local PROVISION_BUNDLE_IDENTIFIER=$(bundle_id_for_provison "$NEW_PROVISION")
+    local PROVISION_BUNDLE_IDENTIFIER=$(bundle_id_for_provision "$NEW_PROVISION")
 
     # Use provisioning profile's bundle identifier
     if [ "$BUNDLE_IDENTIFIER" == "" ]; then
@@ -580,7 +585,7 @@ function resign {
             # Found a reference bundle id, now get the corresponding provisioning profile for this bundle id
             REF_PROVISION=$(provision_for_bundle_id "$REF_BUNDLE_ID")
             # Map to the new bundle id
-            NEW_REF_BUNDLE_ID=$(bundle_id_for_provison "$REF_PROVISION")
+            NEW_REF_BUNDLE_ID=$(bundle_id_for_provision "$REF_PROVISION")
             # Change if not the same and if doesn't contain wildcard
             # shellcheck disable=SC2049
             if [[ "$REF_BUNDLE_ID" != "$NEW_REF_BUNDLE_ID" ]] && ! [[ "$NEW_REF_BUNDLE_ID" =~ \* ]]; then
@@ -636,6 +641,20 @@ function resign {
         log "\nApp entitlements for ${APP_PATH}:"
         log "$(cat "$APP_ENTITLEMENTS")"
 
+        # Get the old and new app identifier (prefix)
+        APP_ID_KEY="application-identifier"
+        # Extract just the identifier from the value
+        # Use the fact that we are after some identifer, which is always at the start of the string
+        OLD_APP_ID=$(PlistBuddy -c "Print $APP_ID_KEY" "$APP_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+        NEW_APP_ID=$(PlistBuddy -c "Print $APP_ID_KEY" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+
+        # Get the old and the new team ID
+        # Old team ID is not part of app entitlements, have to get it from old embedded provisioning profile
+        security cms -D -i "$TEMP_DIR/old-embedded.mobileprovision" > "$TEMP_DIR/old-embedded-profile.plist"
+        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist")
+        # New team ID is part of profile entitlements
+        NEW_TEAM_ID=$(PlistBuddy -c "Print com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+
         log "Patching profile entitlements with values from app entitlements"
         PATCHED_ENTITLEMENTS="$TEMP_DIR/patchedEntitlements"
         # Start with using what comes in provisioning profile entitlements before patching
@@ -654,20 +673,14 @@ function resign {
             "com.apple.developer.icloud-container-development-container-identifiers" \
             # This key has an invalid generic value in PP (actual value is set by Xcode during export), see dedicated processing a few blocks below
             "com.apple.developer.icloud-container-environment" \
-            # PP list identifiers inconsistent with app-defined ones, must use App entitlements value
-            "com.apple.developer.icloud-container-identifiers" \
             # PP enable all available services and not app-defined ones, must use App entitlements value
             "com.apple.developer.icloud-services" \
             # Was already denylisted in previous version, but has someone ever seen this key in a PP?
             "com.apple.developer.restricted-resource-mode" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.developer.nfc.readersession.formats" \
-            # PP list a single TeamID.* identifier and not app-defined ones, must use App entitlements value
-            "com.apple.developer.pass-type-identifiers" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.developer.siri" \
-            # PP list identifiers inconsistent with app-defined ones, must use App entitlements value
-            "com.apple.developer.ubiquity-container-identifiers" \
             # PP define a generic TeamID.* identifier and not the app-defined one, must use App entitlements value
             "com.apple.developer.ubiquity-kvstore-identifier" \
             # If actually used by the App, this value will be set in its entitlements
@@ -680,8 +693,6 @@ function resign {
             "com.apple.developer.healthkit" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.developer.healthkit.access" \
-            # PP list identifiers inconsistent with app-defined ones, must use App entitlements value
-            "com.apple.developer.in-app-payments" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.developer.networking.vpn.api" \
             # If actually used by the App, this value will be set in its entitlements
@@ -694,40 +705,45 @@ function resign {
             "com.apple.developer.associated-domains" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.developer.default-data-protection" \
-            # PP seem to list the same groups as the App, but use App entitlements value to be sure
-            "com.apple.security.application-groups" \
             # Was already denylisted in previous version, seems to be an artifact from an old Xcode release
             "com.apple.developer.maps" \
             # If actually used by the App, this value will be set in its entitlements
             "com.apple.external-accessory.wireless-configuration"
         )
 
+        # If we change team while resigning, we have no other choice than to use the following entitlements from the PP instead of the App
+        # because they are based on unique identifiers (defined in the developer portal) that can't be shared between teams
+        if [[ "$OLD_TEAM_ID" != "$NEW_TEAM_ID" ]]; then
+            warning "WARNING: Changing team while resigning"
+            warning "WARNING: Using these entitlements from the provisioning profile instead of the existing app:"
+            warning "WARNING: App Groups, Merchant IDs (Apple Pay In-App Payments), iCloud Containers, Pass Type IDs (Wallet)"
+            warning "WARNING: If these capabilities are enabled, make sure AppID and provisioning profile are properly configured"
+            # For Pass Types, PP only list a single TeamID.* identifier and not the potential restricted list defined in the existing App
+            # but we can't guess the new identifiers to be used, so this generic value is better than nothing and should be fine for most apps
+            warning "WARNING: Resigned app will allow all pass types from the new team, even if old app only allowed a restricted list"
+        else
+            DENYLISTED_KEYS+=(\
+                "com.apple.security.application-groups" \
+                "com.apple.developer.in-app-payments" \
+                "com.apple.developer.ubiquity-container-identifiers" \
+                "com.apple.developer.icloud-container-identifiers" \
+                "com.apple.developer.pass-type-identifiers" \
+            )
+        fi
+
         # Denylisted keys must not be included into new profile, so remove them from patched profile
         for KEY in "${DENYLISTED_KEYS[@]}"; do
             log "Removing denylisted key: $KEY"
             PlistBuddy -c "Delete $KEY" "$PATCHED_ENTITLEMENTS" 2>/dev/null
         done
 
-        # Get the old and new app identifier (prefix)
-        APP_ID_KEY="application-identifier"
-        # Extract just the identifier from the value
-        # Use the fact that we are after some identifier, which is always at the start of the string
-        OLD_APP_ID=$(PlistBuddy -c "Print $APP_ID_KEY" "$APP_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
-        NEW_APP_ID=$(PlistBuddy -c "Print $APP_ID_KEY" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
-
-        # Get the old and the new team ID
-        # Old team ID is not part of app entitlements, have to get it from old embedded provisioning profile
-        security cms -D -i "$TEMP_DIR/old-embedded.mobileprovision" > "$TEMP_DIR/old-embedded-profile.plist"
-        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist")
-        # New team ID is part of profile entitlements
-        NEW_TEAM_ID=$(PlistBuddy -c "Print com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
-
         # List of rules for transferring entitlements from app to profile plist
         # The format for each enty is "KEY[|ID_TYPE]"
         # Where KEY is the plist key, e.g. "keychain-access-groups"
         # and ID_TYPE is optional part separated by '|' that specifies what value to patch:
         # TEAM_ID - patch the TeamIdentifierPrefix
         # APP_ID - patch the AppIdentifierPrefix
+        # ICLOUD_ENV - patch the target iCloud Environment
         # Patching means replacing old value from app entitlements with new value from provisioning profile
         # For example, for KEY=keychain-access-groups the ID_TYPE=APP_ID
         # Which means that old app ID prefix in keychain-access-groups will be replaced with new app ID prefix
@@ -740,23 +756,32 @@ function resign {
             "com.apple.developer.healthkit" \
             "com.apple.developer.healthkit.access" \
             "com.apple.developer.homekit" \
-            "com.apple.developer.icloud-container-environment" \
-            "com.apple.developer.icloud-container-identifiers" \
+            "com.apple.developer.icloud-container-environment|ICLOUD_ENV" \
             "com.apple.developer.icloud-services" \
-            "com.apple.developer.in-app-payments" \
             "com.apple.developer.networking.HotspotConfiguration" \
             "com.apple.developer.networking.multipath" \
             "com.apple.developer.networking.networkextension" \
             "com.apple.developer.networking.vpn.api" \
             "com.apple.developer.nfc.readersession.formats" \
-            "com.apple.developer.pass-type-identifiers|TEAM_ID" \
             "com.apple.developer.siri" \
-            "com.apple.developer.ubiquity-container-identifiers" \
             "com.apple.developer.ubiquity-kvstore-identifier|TEAM_ID" \
             "com.apple.external-accessory.wireless-configuration" \
-            "com.apple.security.application-groups" \
             "inter-app-audio" \
-            "keychain-access-groups|APP_ID")
+            "keychain-access-groups|APP_ID" \
+        )
+
+        # If we change team while resigning, we have no other choice than to use the following entitlements from the PP instead of the App
+        # because they are based on unique identifiers (defined in the developer portal) that can't be shared between teams
+        # If we don't change team while resigning, we should use the following entitlements from the existing App and not from the PP
+        if [[ "$OLD_TEAM_ID" == "$NEW_TEAM_ID" ]]; then
+            ENTITLEMENTS_TRANSFER_RULES+=(\
+                "com.apple.security.application-groups" \
+                "com.apple.developer.in-app-payments" \
+                "com.apple.developer.ubiquity-container-identifiers" \
+                "com.apple.developer.icloud-container-identifiers" \
+                "com.apple.developer.pass-type-identifiers|TEAM_ID" \
+            )
+        fi
 
         # Loop over all the entitlement keys that need to be transferred from app entitlements
         for RULE in "${ENTITLEMENTS_TRANSFER_RULES[@]}"; do
@@ -765,13 +790,25 @@ function resign {
 
             # Get the entry from app's entitlements
             # Read it with PlistBuddy as XML, then strip the header and <plist></plist> part
-            ENTITLEMENTS_VALUE="$(PlistBuddy -x -c "Print $KEY" "$APP_ENTITLEMENTS" 2>/dev/null | /usr/bin/sed -e 's,.*<plist[^>]*>\(.*\)</plist>,\1,g')"
+            ENTITLEMENTS_VALUE="$(PlistBuddy -x -c "Print $KEY" "$APP_ENTITLEMENTS" 2>/dev/null | tr -d '\n' | /usr/bin/sed -e 's,.*<plist[^>]*>\(.*\)</plist>,\1,g')"
             if [[ -z "$ENTITLEMENTS_VALUE" ]]; then
                 log "No value for '$KEY'"
                 continue
             fi
 
-            if [[ "$KEY" == "com.apple.developer.icloud-container-environment" ]]; then
+            log "App entitlements value for key '$KEY':"
+            log "$ENTITLEMENTS_VALUE"
+
+            # Patch the ID value if specified
+            if [[ "$ID_TYPE" == "APP_ID" ]]; then
+                # Replace old value with new value in patched entitlements
+                log "Replacing old app ID '$OLD_APP_ID' with new app ID '$NEW_APP_ID'"
+                ENTITLEMENTS_VALUE=$(echo "$ENTITLEMENTS_VALUE" | /usr/bin/sed -e "s/$OLD_APP_ID/$NEW_APP_ID/g")
+            elif [[ "$ID_TYPE" == "TEAM_ID" ]]; then
+                # Replace old team identifier with new value
+                log "Replacing old team ID '$OLD_TEAM_ID' with new team ID '$NEW_TEAM_ID'"
+                ENTITLEMENTS_VALUE=$(echo "$ENTITLEMENTS_VALUE" | /usr/bin/sed -e "s/$OLD_TEAM_ID/$NEW_TEAM_ID/g")
+            elif [[ "$ID_TYPE" == "ICLOUD_ENV" ]]; then
                 # Add specific iCloud Environment key to patched entitlements
                 # This value is set by Xcode during export (manually selected for Development and AdHoc, automatically set to Production for Store)
                 # Would need an additional dedicated option to specify the iCloud environment to be used (Development or Production)
@@ -788,20 +825,16 @@ function resign {
                     fi
                 fi
 
+                OLD_ICLOUD_ENV=$(echo "$ENTITLEMENTS_VALUE" | /usr/bin/sed -e 's,<string>\(.*\)</string>,\1,g')
                 if [[ "$certificate_name" =~ "Distribution:" ]]; then
-                    ICLOUD_ENV="Production"
+                    NEW_ICLOUD_ENV="Production"
                 else
-                    ICLOUD_ENV="Development"
+                    NEW_ICLOUD_ENV="Development"
                 fi
-                log "Overriding value for $KEY"
-                log "Old value: $ENTITLEMENTS_VALUE"
-                log "New value: $ICLOUD_ENV"
-                ENTITLEMENTS_VALUE="$ICLOUD_ENV"
+                log "Replacing iCloud environment '$OLD_ICLOUD_ENV' with '$NEW_ICLOUD_ENV'"
+                ENTITLEMENTS_VALUE=$(echo "$ENTITLEMENTS_VALUE" | /usr/bin/sed -e "s/$OLD_ICLOUD_ENV/$NEW_ICLOUD_ENV/g")
             fi
 
-            log "App entitlements value for key '$KEY':"
-            log "$ENTITLEMENTS_VALUE"
-
             # Remove the entry for current key from profisioning profile entitlements (if exists)
             PlistBuddy -c "Delete $KEY" "$PATCHED_ENTITLEMENTS" 2>/dev/null
 
@@ -810,27 +843,14 @@ function resign {
             # otherwise it interprets they key path as nested keys
             # TODO: Should be able to replace with echo ${KEY//\./\\\\.} and remove shellcheck disable directive
             # shellcheck disable=SC2001
-            PLUTIL_KEY=$(echo "$KEY" | /usr/bin/sed 's/\./\\\./g')
+            PLUTIL_KEY=$(echo "$KEY" | /usr/bin/sed -e 's/\./\\\./g')
             plutil -insert "$PLUTIL_KEY" -xml "$ENTITLEMENTS_VALUE" "$PATCHED_ENTITLEMENTS"
-
-            # Patch the ID value if specified
-            if [[ "$ID_TYPE" == "APP_ID" ]]; then
-                # Replace old value with new value in patched entitlements
-                log "Replacing old app identifier prefix '$OLD_APP_ID' with new value '$NEW_APP_ID'"
-                /usr/bin/sed -i .bak "s/$OLD_APP_ID/$NEW_APP_ID/g" "$PATCHED_ENTITLEMENTS"
-            elif [[ "$ID_TYPE" == "TEAM_ID" ]]; then
-                # Replace old team identifier with new value
-                log "Replacing old team ID '$OLD_TEAM_ID' with new team ID: '$NEW_TEAM_ID'"
-                /usr/bin/sed -i .bak "s/$OLD_TEAM_ID/$NEW_TEAM_ID/g" "$PATCHED_ENTITLEMENTS"
-            else
-                continue
-            fi
         done
 
         # Replace old bundle ID with new bundle ID in patched entitlements
         # Read old bundle ID from the old Info.plist which was saved for this purpose
         OLD_BUNDLE_ID="$(PlistBuddy -c "Print :CFBundleIdentifier" "$TEMP_DIR/oldInfo.plist")"
-        NEW_BUNDLE_ID="$(bundle_id_for_provison "$NEW_PROVISION")"
+        NEW_BUNDLE_ID="$(bundle_id_for_provision "$NEW_PROVISION")"
         log "Replacing old bundle ID '$OLD_BUNDLE_ID' with new bundle ID '$NEW_BUNDLE_ID' in patched entitlements"
         # Note: ideally we'd match against the opening <string> tag too, but this isn't possible
         # because $OLD_BUNDLE_ID and $NEW_BUNDLE_ID do not include the team ID prefix which is