fastlane_iac_publish 0.1.0

data/match/lib/match/options.rb

@@ -0,0 +1,198 @@
+require 'fastlane_core/configuration/config_item'
+require 'credentials_manager/appfile_config'
+require_relative 'module'
+
+module Match
+  class Options
+    # This is match specific, as users can append storage specific options
+    def self.append_option(option)
+      self.available_options # to ensure we created the initial `@available_options` array
+      @available_options << option
+    end
+
+    def self.available_options
+      user = CredentialsManager::AppfileConfig.try_fetch_value(:apple_dev_portal_id)
+      user ||= CredentialsManager::AppfileConfig.try_fetch_value(:apple_id)
+
+      [
+        # main
+        FastlaneCore::ConfigItem.new(key: :type,
+                                     env_name: "MATCH_TYPE",
+                                     description: "Define the profile type, can be #{Match.environments.join(', ')}",
+                                     is_string: true,
+                                     short_option: "-y",
+                                     default_value: 'development',
+                                     verify_block: proc do |value|
+                                       unless Match.environments.include?(value)
+                                         UI.user_error!("Unsupported environment #{value}, must be in #{Match.environments.join(', ')}")
+                                       end
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :readonly,
+                                     env_name: "MATCH_READONLY",
+                                     description: "Only fetch existing certificates and profiles, don't generate new ones",
+                                     is_string: false,
+                                     default_value: false),
+
+        # app
+        FastlaneCore::ConfigItem.new(key: :app_identifier,
+                                     short_option: "-a",
+                                     env_name: "MATCH_APP_IDENTIFIER",
+                                     description: "The bundle identifier(s) of your app (comma-separated)",
+                                     is_string: false,
+                                     type: Array, # we actually allow String and Array here
+                                     skip_type_validation: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier),
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :username,
+                                     short_option: "-u",
+                                     env_name: "MATCH_USERNAME",
+                                     description: "Your Apple ID Username",
+                                     default_value: user,
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :team_id,
+                                     short_option: "-b",
+                                     env_name: "FASTLANE_TEAM_ID",
+                                     description: "The ID of your Developer Portal team if you're in multiple teams",
+                                     optional: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_id),
+                                     default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :team_name,
+                                     short_option: "-l",
+                                     env_name: "FASTLANE_TEAM_NAME",
+                                     description: "The name of your Developer Portal team if you're in multiple teams",
+                                     optional: true,
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:team_name),
+                                     default_value_dynamic: true),
+
+        # Storage
+        FastlaneCore::ConfigItem.new(key: :storage_mode,
+                                     env_name: "MATCH_STORAGE_MODE",
+                                     description: "Define where you want to store your certificates",
+                                     is_string: true,
+                                     short_option: "-q",
+                                     default_value: 'git',
+                                     verify_block: proc do |value|
+                                       unless Match.storage_modes.include?(value)
+                                         UI.user_error!("Unsupported storage_mode #{value}, must be in #{Match.storage_modes.join(', ')}")
+                                       end
+                                     end),
+
+        # Storage: Git
+        FastlaneCore::ConfigItem.new(key: :git_url,
+                                     env_name: "MATCH_GIT_URL",
+                                     description: "URL to the git repo containing all the certificates",
+                                     optional: false,
+                                     short_option: "-r"),
+        FastlaneCore::ConfigItem.new(key: :git_branch,
+                                     env_name: "MATCH_GIT_BRANCH",
+                                     description: "Specific git branch to use",
+                                     default_value: 'master'),
+        FastlaneCore::ConfigItem.new(key: :git_full_name,
+                                     env_name: "MATCH_GIT_FULL_NAME",
+                                     description: "git user full name to commit",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :git_user_email,
+                                     env_name: "MATCH_GIT_USER_EMAIL",
+                                     description: "git user email to commit",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :shallow_clone,
+                                     env_name: "MATCH_SHALLOW_CLONE",
+                                     description: "Make a shallow clone of the repository (truncate the history to 1 revision)",
+                                     is_string: false,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :clone_branch_directly,
+                                     env_name: "MATCH_CLONE_BRANCH_DIRECTLY",
+                                     description: "Clone just the branch specified, instead of the whole repo. This requires that the branch already exists. Otherwise the command will fail",
+                                     is_string: false,
+                                     default_value: false),
+
+        # Storage: Google Cloud
+        FastlaneCore::ConfigItem.new(key: :google_cloud_bucket_name,
+                                     env_name: "MATCH_GOOGLE_CLOUD_BUCKET_NAME",
+                                     description: "Name of the Google Cloud Storage bucket to use",
+                                     optional: true),
+        FastlaneCore::ConfigItem.new(key: :google_cloud_keys_file,
+                                     env_name: "MATCH_GOOGLE_CLOUD_KEYS_FILE",
+                                     description: "Path to the gc_keys.json file",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Could not find keys file at path '#{File.expand_path(value)}'") unless File.exist?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :google_cloud_project_id,
+                                     env_name: "MATCH_GOOGLE_CLOUD_PROJECT_ID",
+                                     description: "ID of the Google Cloud project to use for authentication",
+                                     optional: true),
+
+        # Keychain
+        FastlaneCore::ConfigItem.new(key: :keychain_name,
+                                     short_option: "-s",
+                                     env_name: "MATCH_KEYCHAIN_NAME",
+                                     description: "Keychain the items should be imported to",
+                                     default_value: "login.keychain"),
+        FastlaneCore::ConfigItem.new(key: :keychain_password,
+                                     short_option: "-p",
+                                     env_name: "MATCH_KEYCHAIN_PASSWORD",
+                                     sensitive: true,
+                                     description: "This might be required the first time you access certificates on a new mac. For the login/default keychain this is your account password",
+                                     optional: true),
+
+        # settings
+        FastlaneCore::ConfigItem.new(key: :force,
+                                     env_name: "MATCH_FORCE",
+                                     description: "Renew the provisioning profiles every time you run match",
+                                     is_string: false,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :force_for_new_devices,
+                                     env_name: "MATCH_FORCE_FOR_NEW_DEVICES",
+                                     description: "Renew the provisioning profiles if the device count on the developer portal has changed. Ignored for profile type 'appstore'",
+                                     is_string: false,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :skip_confirmation,
+                                     env_name: "MATCH_SKIP_CONFIRMATION",
+                                     description: "Disables confirmation prompts during nuke, answering them with yes",
+                                     is_string: false,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :skip_docs,
+                                     env_name: "MATCH_SKIP_DOCS",
+                                     description: "Skip generation of a README.md for the created git repository",
+                                     is_string: false,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :platform,
+                                     short_option: '-o',
+                                     env_name: "MATCH_PLATFORM",
+                                     description: "Set the provisioning profile's platform to work with (i.e. ios, tvos)",
+                                     is_string: false,
+                                     default_value: "ios",
+                                     verify_block: proc do |value|
+                                       value = value.to_s
+                                       pt = %w(tvos ios)
+                                       UI.user_error!("Unsupported platform, must be: #{pt}") unless pt.include?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :template_name,
+                                     env_name: "MATCH_PROVISIONING_PROFILE_TEMPLATE_NAME",
+                                     description: "The name of provisioning profile template. If the developer account has provisioning profile templates (aka: custom entitlements), the template name can be found by inspecting the Entitlements drop-down while creating/editing a provisioning profile (e.g. \"Apple Pay Pass Suppression Development\")",
+                                     optional: true,
+                                     default_value: nil),
+        FastlaneCore::ConfigItem.new(key: :output_path,
+                                     env_name: "MATCH_OUTPUT_PATH",
+                                     description: "Path in which to export certificates, key and profile",
+                                     optional: true),
+
+        # other
+        FastlaneCore::ConfigItem.new(key: :verbose,
+                                     env_name: "MATCH_VERBOSE",
+                                     description: "Print out extra information and all commands",
+                                     is_string: false,
+                                     default_value: false,
+                                     verify_block: proc do |value|
+                                       FastlaneCore::Globals.verbose = true if value
+                                     end)
+      ]
+    end
+  end
+end

data/match/lib/match/runner.rb

@@ -0,0 +1,333 @@
+require 'fastlane_core/cert_checker'
+require 'fastlane_core/provisioning_profile'
+require 'fastlane_core/print_table'
+require 'spaceship/client'
+require_relative 'generator'
+require_relative 'module'
+require_relative 'table_printer'
+require_relative 'spaceship_ensure'
+require_relative 'utils'
+
+require_relative 'storage'
+require_relative 'encryption'
+
+module Match
+  class Runner
+    attr_accessor :files_to_commit
+    attr_accessor :spaceship
+
+    attr_accessor :storage_mode
+
+    # The Team ID that was fetched
+    # This will always be `nil` in readonly mode
+    attr_accessor :currently_used_team_id
+
+    def run(params)
+      self.files_to_commit = []
+
+      FileUtils.mkdir_p(params[:output_path]) if params[:output_path]
+
+      FastlaneCore::PrintTable.print_values(config: params,
+                                             title: "Summary for match #{Fastlane::VERSION}")
+
+      update_optional_values_depending_on_storage_type(params)
+
+      self.storage_mode = params[:storage_mode]
+
+      # Choose the right storage and encryption implementations
+      storage = Storage.for_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        skip_docs: params[:skip_docs],
+        git_branch: params[:git_branch],
+        git_full_name: params[:git_full_name],
+        git_user_email: params[:git_user_email],
+        clone_branch_directly: params[:clone_branch_directly],
+        type: params[:type].to_s,
+        platform: params[:platform].to_s,
+        google_cloud_bucket_name: params[:google_cloud_bucket_name].to_s,
+        google_cloud_keys_file: params[:google_cloud_keys_file].to_s,
+        google_cloud_project_id: params[:google_cloud_project_id].to_s
+      })
+      storage.download
+
+      # Init the encryption only after the `storage.download` was called to have the right working directory
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        working_directory: storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+
+      if params[:readonly]
+        # In readonly mode, we still want to see if the user provided a team_id
+        # see `prefixed_working_directory` comments for more details
+        self.currently_used_team_id = params[:team_id]
+      else
+        self.spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name])
+        self.currently_used_team_id = self.spaceship.team_id
+
+        if params[:type] == "enterprise" && !Spaceship.client.in_house?
+          UI.user_error!("You defined the profile type 'enterprise', but your Apple account doesn't support In-House profiles")
+        end
+      end
+
+      if params[:app_identifier].kind_of?(Array)
+        app_identifiers = params[:app_identifier]
+      else
+        app_identifiers = params[:app_identifier].to_s.split(/\s*,\s*/).uniq
+      end
+
+      # sometimes we get an array with arrays, this is a bug. To unblock people using match, I suggest we flatten!
+      # then in the future address the root cause of https://github.com/fastlane/fastlane/issues/11324
+      app_identifiers.flatten!
+
+      # Verify the App ID (as we don't want 'match' to fail at a later point)
+      if spaceship
+        app_identifiers.each do |app_identifier|
+          spaceship.bundle_identifier_exists(username: params[:username], app_identifier: app_identifier)
+        end
+      end
+
+      # Certificate
+      cert_id = fetch_certificate(params: params, working_directory: storage.working_directory)
+      spaceship.certificate_exists(username: params[:username], certificate_id: cert_id) if spaceship
+
+      # Provisioning Profiles
+      app_identifiers.each do |app_identifier|
+        loop do
+          break if fetch_provisioning_profile(params: params,
+                                      certificate_id: cert_id,
+                                      app_identifier: app_identifier,
+                                   working_directory: storage.working_directory)
+        end
+      end
+
+      if self.files_to_commit.count > 0 && !params[:readonly]
+        encryption.encrypt_files if encryption
+        storage.save_changes!(files_to_commit: self.files_to_commit)
+      end
+
+      # Print a summary table for each app_identifier
+      app_identifiers.each do |app_identifier|
+        TablePrinter.print_summary(app_identifier: app_identifier, type: params[:type], platform: params[:platform])
+      end
+
+      UI.success("All required keys, certificates and provisioning profiles are installed 🙌".green)
+    rescue Spaceship::Client::UnexpectedResponse, Spaceship::Client::InvalidUserCredentialsError, Spaceship::Client::NoUserCredentialsError => ex
+      UI.error("An error occurred while verifying your certificates and profiles with the Apple Developer Portal.")
+      UI.error("If you already have your certificates stored in git, you can run `fastlane match` in readonly mode")
+      UI.error("to just install the certificates and profiles without accessing the Dev Portal.")
+      UI.error("To do so, just pass `readonly: true` to your match call.")
+      raise ex
+    ensure
+      storage.clear_changes if storage
+    end
+
+    # Used when creating a new certificate or profile
+    def prefixed_working_directory(working_directory)
+      if self.storage_mode == "git"
+        return working_directory
+      elsif self.storage_mode == "google_cloud"
+        # We fall back to "*", which means certificates and profiles
+        # from all teams that use this bucket would be installed. This is not ideal, but
+        # unless the user provides a `team_id`, we can't know which one to use
+        # This only happens if `readonly` is activated, and no `team_id` was provided
+        @_folder_prefix ||= self.currently_used_team_id
+        if @_folder_prefix.nil?
+          # We use a `@_folder_prefix` variable, to keep state between multiple calls of this
+          # method, as the value won't change. This way the warning is only printed once
+          UI.important("Looks like you run `match` in `readonly` mode, and didn't provide a `team_id`. This will still work, however it is recommended to provide a `team_id` in your Appfile or Matchfile")
+          @_folder_prefix = "*"
+        end
+        return File.join(working_directory, @_folder_prefix)
+      else
+        UI.crash!("No implementation for `prefixed_working_directory`")
+      end
+    end
+
+    # Be smart about optional values here
+    # Depending on the storage mode, different values are required
+    def update_optional_values_depending_on_storage_type(params)
+      if params[:storage_mode] != "git"
+        params.option_for_key(:git_url).optional = true
+      end
+    end
+
+    def fetch_certificate(params: nil, working_directory: nil)
+      cert_type = Match.cert_type_sym(params[:type])
+
+      certs = Dir[File.join(prefixed_working_directory(working_directory), "certs", cert_type.to_s, "*.cer")]
+      keys = Dir[File.join(prefixed_working_directory(working_directory), "certs", cert_type.to_s, "*.p12")]
+
+      if certs.count == 0 || keys.count == 0
+        UI.important("Couldn't find a valid code signing identity for #{cert_type}... creating one for you now")
+        UI.crash!("No code signing identity found and can not create a new one because you enabled `readonly`") if params[:readonly]
+        cert_path = Generator.generate_certificate(params, cert_type, prefixed_working_directory(working_directory))
+        private_key_path = cert_path.gsub(".cer", ".p12")
+
+        self.files_to_commit << cert_path
+        self.files_to_commit << private_key_path
+      else
+        cert_path = certs.last
+
+        # Check validity of certificate
+        if Utils.is_cert_valid?(cert_path)
+          UI.verbose("Your certificate '#{File.basename(cert_path)}' is valid")
+        else
+          UI.user_error!("Your certificate '#{File.basename(cert_path)}' is not valid, please check end date and renew it if necessary")
+        end
+
+        if Helper.mac?
+          UI.message("Installing certificate...")
+
+          # Only looking for cert in "custom" (non login.keychain) keychain
+          # Doing this for backwards compatability
+          keychain_name = params[:keychain_name] == "login.keychain" ? nil : params[:keychain_name]
+
+          if FastlaneCore::CertChecker.installed?(cert_path, in_keychain: keychain_name)
+            UI.verbose("Certificate '#{File.basename(cert_path)}' is already installed on this machine")
+          else
+            Utils.import(cert_path, params[:keychain_name], password: params[:keychain_password])
+          end
+
+          # Import the private key
+          # there seems to be no good way to check if it's already installed - so just install it
+          # Key will only be added to the partition list if it isn't already installed
+          Utils.import(keys.last, params[:keychain_name], password: params[:keychain_password])
+        else
+          UI.message("Skipping installation of certificate as it would not work on this operating system.")
+        end
+
+        if params[:output_path]
+          FileUtils.cp(cert_path, params[:output_path])
+          FileUtils.cp(keys.last, params[:output_path])
+        end
+
+        # Get and print info of certificate
+        info = Utils.get_cert_info(cert_path)
+        TablePrinter.print_certificate_info(cert_info: info)
+      end
+
+      return File.basename(cert_path).gsub(".cer", "") # Certificate ID
+    end
+
+    # @return [String] The UUID of the provisioning profile so we can verify it with the Apple Developer Portal
+    def fetch_provisioning_profile(params: nil, certificate_id: nil, app_identifier: nil, working_directory: nil)
+      prov_type = Match.profile_type_sym(params[:type])
+
+      names = [Match::Generator.profile_type_name(prov_type), app_identifier]
+      if params[:platform].to_s != :ios.to_s
+        names.push(params[:platform])
+      end
+
+      profile_name = names.join("_").gsub("*", '\*') # this is important, as it shouldn't be a wildcard
+      base_dir = File.join(prefixed_working_directory(working_directory), "profiles", prov_type.to_s)
+      profiles = Dir[File.join(base_dir, "#{profile_name}.mobileprovision")]
+      if Helper.mac?
+        keychain_path = FastlaneCore::Helper.keychain_path(params[:keychain_name]) unless params[:keychain_name].nil?
+      end
+
+      # Install the provisioning profiles
+      profile = profiles.last
+
+      if params[:force_for_new_devices] && !params[:readonly]
+        if prov_type != :appstore
+          params[:force] = device_count_different?(profile: profile, keychain_path: keychain_path, platform: params[:platform].to_sym) unless params[:force]
+        else
+          # App Store provisioning profiles don't contain device identifiers and
+          # thus shouldn't be renewed if the device count has changed.
+          UI.important("Warning: `force_for_new_devices` is set but is ignored for App Store provisioning profiles.")
+          UI.important("You can safely stop specifying `force_for_new_devices` when running Match for type 'appstore'.")
+        end
+      end
+
+      if profile.nil? || params[:force]
+        if params[:readonly]
+          UI.error("No matching provisioning profiles found for '#{profile_name}'")
+          UI.error("A new one cannot be created because you enabled `readonly`")
+          if Dir.exist?(base_dir) # folder for `prov_type` does not exist on first match use for that type
+            all_profiles = Dir.entries(base_dir).reject { |f| f.start_with?(".") }
+            UI.error("Provisioning profiles in your repo for type `#{prov_type}`:")
+            all_profiles.each { |p| UI.error("- '#{p}'") }
+          end
+          UI.error("If you are certain that a profile should exist, double-check the recent changes to your match repository")
+          UI.user_error!("No matching provisioning profiles found and can not create a new one because you enabled `readonly`. Check the output above for more information.")
+        end
+        profile = Generator.generate_provisioning_profile(params: params,
+                                                       prov_type: prov_type,
+                                                  certificate_id: certificate_id,
+                                                  app_identifier: app_identifier,
+                                               working_directory: prefixed_working_directory(working_directory))
+        self.files_to_commit << profile
+      end
+
+      if Helper.mac?
+        installed_profile = FastlaneCore::ProvisioningProfile.install(profile, keychain_path)
+      end
+      parsed = FastlaneCore::ProvisioningProfile.parse(profile, keychain_path)
+      uuid = parsed["UUID"]
+
+      if params[:output_path]
+        FileUtils.cp(profile, params[:output_path])
+      end
+
+      if spaceship && !spaceship.profile_exists(username: params[:username], uuid: uuid)
+        # This profile is invalid, let's remove the local file and generate a new one
+        File.delete(profile)
+        # This method will be called again, no need to modify `files_to_commit`
+        return nil
+      end
+
+      Utils.fill_environment(Utils.environment_variable_name(app_identifier: app_identifier,
+                                                                       type: prov_type,
+                                                                   platform: params[:platform]),
+
+                             uuid)
+
+      # TeamIdentifier is returned as an array, but we're not sure why there could be more than one
+      Utils.fill_environment(Utils.environment_variable_name_team_id(app_identifier: app_identifier,
+                                                                               type: prov_type,
+                                                                           platform: params[:platform]),
+                             parsed["TeamIdentifier"].first)
+
+      Utils.fill_environment(Utils.environment_variable_name_profile_name(app_identifier: app_identifier,
+                                                                                    type: prov_type,
+                                                                                platform: params[:platform]),
+                             parsed["Name"])
+
+      Utils.fill_environment(Utils.environment_variable_name_profile_path(app_identifier: app_identifier,
+                                                                                    type: prov_type,
+                                                                                platform: params[:platform]),
+                             installed_profile)
+
+      return uuid
+    end
+
+    def device_count_different?(profile: nil, keychain_path: nil, platform: nil)
+      return false unless profile
+
+      parsed = FastlaneCore::ProvisioningProfile.parse(profile, keychain_path)
+      uuid = parsed["UUID"]
+      portal_profile = Spaceship.provisioning_profile.all.detect { |i| i.uuid == uuid }
+
+      if portal_profile
+        profile_device_count = portal_profile.devices.count
+
+        portal_device_count =
+          case platform
+          when :ios
+            Spaceship.device.all_ios_profile_devices.count
+          when :tvos
+            Spaceship.device.all_apple_tvs.count
+          when :mac
+            Spaceship.device.all_macs.count
+          else
+            Spaceship.device.all.count
+          end
+
+        return portal_device_count != profile_device_count
+      end
+      return false
+    end
+  end
+end