fastlane_iac_publish 0.1.0

data/cert/lib/cert/runner.rb

@@ -0,0 +1,203 @@
+require 'fileutils'
+require 'fastlane_core/globals'
+require 'fastlane_core/cert_checker'
+require 'fastlane_core/keychain_importer'
+require 'fastlane_core/print_table'
+require 'spaceship'
+
+require_relative 'module'
+
+module Cert
+  class Runner
+    def launch
+      run
+
+      installed = FastlaneCore::CertChecker.installed?(ENV["CER_FILE_PATH"], in_keychain: ENV["CER_KEYCHAIN_PATH"])
+      UI.message("Verifying the certificate is properly installed locally...")
+      UI.user_error!("Could not find the newly generated certificate installed", show_github_issues: true) unless installed
+      UI.success("Successfully installed certificate #{ENV['CER_CERTIFICATE_ID']}")
+      return ENV["CER_FILE_PATH"]
+    end
+
+    def login
+      UI.message("Starting login with user '#{Cert.config[:username]}'")
+      Spaceship.login(Cert.config[:username], nil)
+      Spaceship.select_team
+      UI.message("Successfully logged in")
+    end
+
+    def run
+      FileUtils.mkdir_p(Cert.config[:output_path])
+
+      FastlaneCore::PrintTable.print_values(config: Cert.config, hide_keys: [:output_path], title: "Summary for cert #{Fastlane::VERSION}")
+
+      login
+
+      should_create = Cert.config[:force]
+      unless should_create
+        cert_path = find_existing_cert
+        should_create = cert_path.nil?
+      end
+
+      return unless should_create
+
+      if create_certificate # no certificate here, creating a new one
+        return # success
+      else
+        UI.user_error!("Something went wrong when trying to create a new certificate...")
+      end
+    end
+
+    # Command method for the :revoke_expired sub-command
+    def revoke_expired_certs!
+      FastlaneCore::PrintTable.print_values(config: Cert.config, hide_keys: [:output_path], title: "Summary for cert #{Fastlane::VERSION}")
+
+      login
+
+      to_revoke = expired_certs
+
+      if to_revoke.empty?
+        UI.success("No expired certificates were found to revoke! 👍")
+        return
+      end
+
+      revoke_count = 0
+
+      to_revoke.each do |certificate|
+        begin
+          UI.message("#{certificate.id} #{certificate.name} has expired, revoking...")
+          certificate.revoke!
+          revoke_count += 1
+        rescue => e
+          UI.error("An error occurred while revoking #{certificate.id} #{certificate.name}")
+          UI.error("#{e.message}\n#{e.backtrace.join("\n")}") if FastlaneCore::Globals.verbose?
+        end
+      end
+
+      UI.success("#{revoke_count} expired certificate#{'s' if revoke_count != 1} #{revoke_count == 1 ? 'has' : 'have'} been revoked! 👍")
+    end
+
+    def expired_certs
+      certificates.select do |certificate|
+        certificate.expires < Time.now.utc
+      end
+    end
+
+    def find_existing_cert
+      certificates.each do |certificate|
+        unless certificate.can_download
+          next
+        end
+
+        path = store_certificate(certificate, Cert.config[:filename])
+        private_key_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.p12"))
+
+        # As keychain is specific to macOS, this will likely fail on non macOS systems.
+        # See also: https://github.com/fastlane/fastlane/pull/14462
+        keychain = File.expand_path(Cert.config[:keychain_path]) unless Cert.config[:keychain_path].nil?
+        if FastlaneCore::CertChecker.installed?(path, in_keychain: keychain)
+          # This certificate is installed on the local machine
+          ENV["CER_CERTIFICATE_ID"] = certificate.id
+          ENV["CER_FILE_PATH"] = path
+          ENV["CER_KEYCHAIN_PATH"] = keychain
+
+          UI.success("Found the certificate #{certificate.id} (#{certificate.name}) which is installed on the local machine. Using this one.")
+
+          return path
+        elsif File.exist?(private_key_path)
+          password = Cert.config[:keychain_password]
+          FastlaneCore::KeychainImporter.import_file(private_key_path, keychain, keychain_password: password)
+          FastlaneCore::KeychainImporter.import_file(path, keychain, keychain_password: password)
+
+          ENV["CER_CERTIFICATE_ID"] = certificate.id
+          ENV["CER_FILE_PATH"] = path
+          ENV["CER_KEYCHAIN_PATH"] = keychain
+
+          UI.success("Found the cached certificate #{certificate.id} (#{certificate.name}). Using this one.")
+
+          return path
+        else
+          UI.error("Certificate #{certificate.id} (#{certificate.name}) can't be found on your local computer")
+        end
+
+        File.delete(path) # as apparently this certificate is pretty useless without a private key
+      end
+
+      UI.important("Couldn't find an existing certificate... creating a new one")
+      return nil
+    end
+
+    # All certificates of this type
+    def certificates
+      certificate_type.all
+    end
+
+    # The kind of certificate we're interested in
+    def certificate_type
+      case Cert.config[:platform].to_s
+      when 'ios', 'tvos'
+        cert_type = Spaceship.certificate.production
+        cert_type = Spaceship.certificate.in_house if Spaceship.client.in_house?
+        cert_type = Spaceship.certificate.development if Cert.config[:development]
+
+      when 'macos'
+        cert_type = Spaceship.certificate.mac_app_distribution
+        cert_type = Spaceship.certificate.mac_development if Cert.config[:development]
+
+      end
+
+      cert_type
+    end
+
+    def create_certificate
+      # Create a new certificate signing request
+      csr, pkey = Spaceship.certificate.create_certificate_signing_request
+
+      # Use the signing request to create a new (development|distribution) certificate
+      begin
+        certificate = certificate_type.create!(csr: csr)
+      rescue => ex
+        type_name = (Cert.config[:development] ? "Development" : "Distribution")
+        if ex.to_s.include?("You already have a current")
+          UI.user_error!("Could not create another #{type_name} certificate, reached the maximum number of available #{type_name} certificates.", show_github_issues: true)
+        elsif ex.to_s.include?("You are not allowed to perform this operation.") && type_name == "Distribution"
+          UI.user_error!("You do not have permission to create this certificate. Only Team Admins can create Distribution certificates\n 🔍 See https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/ManagingYourTeam/ManagingYourTeam.html for more information.")
+        end
+        raise ex
+      end
+
+      # Store all that onto the filesystem
+
+      request_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.certSigningRequest"))
+      File.write(request_path, csr.to_pem)
+
+      private_key_path = File.expand_path(File.join(Cert.config[:output_path], "#{certificate.id}.p12"))
+      File.write(private_key_path, pkey)
+
+      cert_path = store_certificate(certificate, Cert.config[:filename])
+
+      # Import all the things into the Keychain
+      keychain = File.expand_path(Cert.config[:keychain_path])
+      password = Cert.config[:keychain_password]
+      FastlaneCore::KeychainImporter.import_file(private_key_path, keychain, keychain_password: password)
+      FastlaneCore::KeychainImporter.import_file(cert_path, keychain, keychain_password: password)
+
+      # Environment variables for the fastlane action
+      ENV["CER_CERTIFICATE_ID"] = certificate.id
+      ENV["CER_FILE_PATH"] = cert_path
+
+      UI.success("Successfully generated #{certificate.id} which was imported to the local machine.")
+
+      return cert_path
+    end
+
+    def store_certificate(certificate, filename = nil)
+      cert_name = filename ? filename : certificate.id
+      cert_name = "#{cert_name}.cer" unless File.extname(cert_name) == ".cer"
+      path = File.expand_path(File.join(Cert.config[:output_path], cert_name))
+      raw_data = certificate.download_raw
+      File.write(path, raw_data)
+      return path
+    end
+  end
+end

data/credentials_manager/README.md

@@ -0,0 +1,64 @@
+CredentialsManager
+===================
+
+`CredentialsManager` is used by most components in the [fastlane.tools](https://fastlane.tools) toolchain.
+
+All code related to your username and password can be found here: [account_manager.rb](https://github.com/fastlane/fastlane/blob/master/credentials_manager/lib/credentials_manager/account_manager.rb)
+
+## Usage
+Along with the [Ruby libraries](https://github.com/fastlane/fastlane/tree/master/credentials_manager#implementing-a-custom-solution) you can use the command line interface to add credentials to the keychain.
+
+**Adding Credentials**
+```
+fastlane fastlane-credentials add --username felix@krausefx.com
+Password: *********
+Credential felix@krausefx.com:********* added to keychain.
+```
+
+**Removing Credentials**
+```
+fastlane fastlane-credentials remove --username felix@krausefx.com
+password has been deleted.
+```
+
+## Storing in the keychain
+
+By default, your Apple credentials are stored in the macOS Keychain.
+
+Your password is only stored locally on your computer.
+
+## Change Password
+
+You can easily delete the stored password by opening the "Keychain Access" app, switching to *All Items*, and searching for "*deliver*". Select the item you want to change and delete it. Next time running one of the tools, you'll be asked for the new password.
+
+## Using environment variables
+
+Pass the user credentials via the following environment variables:
+
+```
+FASTLANE_USER
+FASTLANE_PASSWORD
+```
+
+If you don't want to have your password stored in the Keychain set the `FASTLANE_DONT_STORE_PASSWORD` environment variable to `"1"`.
+
+## Implementing a custom solution
+
+All _fastlane_ tools are Ruby-based, and you can take a look at the source code to easily implement your own authentication solution.
+
+```ruby
+require 'credentials_manager'
+
+data = CredentialsManager::AccountManager.new(user: user, password: password)
+puts data.user
+puts data.password
+```
+
+# Code of Conduct
+Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/CODE_OF_CONDUCT.md).
+
+# License
+
+This project is licensed under the terms of the MIT license. See the LICENSE file.
+
+> This project and all fastlane tools are in no way affiliated with Apple Inc. This project is open source under the MIT license, which means you have full access to the source code and can modify it to fit your own needs. All fastlane tools run on your own computer or server, so your credentials or other sensitive information will never leave your own computer. You are responsible for how you use fastlane tools.

data/credentials_manager/lib/credentials_manager.rb

@@ -0,0 +1,7 @@
+require_relative 'credentials_manager/account_manager'
+require_relative 'credentials_manager/cli'
+require_relative 'credentials_manager/appfile_config'
+
+module CredentialsManager
+  ROOT = Pathname.new(File.expand_path('../..', __FILE__))
+end

data/credentials_manager/lib/credentials_manager/account_manager.rb

@@ -0,0 +1,157 @@
+require 'security'
+require 'highline/import' # to hide the entered password
+
+require_relative 'appfile_config'
+
+module CredentialsManager
+  class AccountManager
+    DEFAULT_PREFIX = "deliver"
+
+    # Is used for iTunes Transporter
+    attr_reader :prefix
+
+    # @param prefix [String] Very optional, is used for the
+    #   iTunes Transporter which uses application specific passwords
+    # @param note [String] An optional note that will be shown next
+    #   to the password and username prompt
+    def initialize(user: nil, password: nil, prefix: nil, note: nil)
+      @prefix = prefix || DEFAULT_PREFIX
+
+      @user = user
+      @password = password
+      @note = note
+    end
+
+    # Is the default prefix "deliver"
+    def default_prefix?
+      @prefix == DEFAULT_PREFIX
+    end
+
+    def user
+      if default_prefix?
+        @user ||= ENV["FASTLANE_USER"]
+        @user ||= ENV["DELIVER_USER"]
+        @user ||= AppfileConfig.try_fetch_value(:apple_id)
+      end
+
+      ask_for_login if @user.to_s.length == 0
+      return @user
+    end
+
+    def fetch_password_from_env
+      password = ENV["FASTLANE_PASSWORD"] || ENV["DELIVER_PASSWORD"]
+      return password if password.to_s.length > 0
+      return nil
+    end
+
+    def password(ask_if_missing: true)
+      if default_prefix?
+        @password ||= fetch_password_from_env
+      end
+
+      unless @password
+        item = Security::InternetPassword.find(server: server_name)
+        @password ||= item.password if item
+      end
+      ask_for_login while ask_if_missing && @password.to_s.length == 0
+      return @password
+    end
+
+    # Call this method to ask the user to re-enter the credentials
+    # @param force: if false, the user is asked before it gets deleted
+    # @return: Did the user decide to remove the old entry and enter a new password?
+    def invalid_credentials(force: false)
+      puts("The login credentials for '#{user}' seem to be wrong".red)
+
+      if fetch_password_from_env
+        puts("The password was taken from the environment variable")
+        puts("Please make sure it is correct")
+        return false
+      end
+
+      if force || agree("Do you want to re-enter your password? (y/n)", true)
+        puts("Removing Keychain entry for user '#{user}'...".yellow) if mac?
+        remove_from_keychain
+        ask_for_login
+        return true
+      end
+      false
+    end
+
+    def add_to_keychain
+      if options
+        Security::InternetPassword.add(server_name, user, password, options)
+      else
+        Security::InternetPassword.add(server_name, user, password)
+      end
+    end
+
+    def remove_from_keychain
+      Security::InternetPassword.delete(server: server_name)
+      @password = nil
+    end
+
+    def server_name
+      "#{@prefix}.#{user}"
+    end
+
+    # Use env variables from this method to augment internet password item with additional data.
+    # These variables are used by Xamarin Studio to authenticate Apple developers.
+    def options
+      hash = {}
+      hash[:p] = ENV["FASTLANE_PATH"] if ENV["FASTLANE_PATH"]
+      hash[:P] = ENV["FASTLANE_PORT"] if ENV["FASTLANE_PORT"]
+      hash[:r] = ENV["FASTLANE_PROTOCOL"] if ENV["FASTLANE_PROTOCOL"]
+      hash.empty? ? nil : hash
+    end
+
+    private
+
+    def ask_for_login
+      if ENV["FASTLANE_HIDE_LOGIN_INFORMATION"].to_s.length == 0
+        puts("-------------------------------------------------------------------------------------".green)
+        puts("Please provide your Apple Developer Program account credentials".green)
+        puts("The login information you enter will be stored in your macOS Keychain".green) if mac?
+        if default_prefix?
+          # We don't want to show this message, if we ask for the application specific password
+          # which has a different prefix
+          puts("You can also pass the password using the `FASTLANE_PASSWORD` environment variable".green)
+          puts("See more information about it on GitHub: https://github.com/fastlane/fastlane/tree/master/credentials_manager".green) if mac?
+        end
+        puts("-------------------------------------------------------------------------------------".green)
+      end
+
+      if @user.to_s.length == 0
+        raise "Missing username, and running in non-interactive shell" if $stdout.isatty == false
+        prompt_text = "Username"
+        prompt_text += " (#{@note})" if @note
+        prompt_text += ": "
+        @user = ask(prompt_text) while @user.to_s.length == 0
+        # Returning here since only the username was asked for. This method will be called again when a password is needed.
+        return
+      end
+
+      while @password.to_s.length == 0
+        raise "Missing password for user #{@user}, and running in non-interactive shell" if $stdout.isatty == false
+        note = @note + " " if @note
+        @password = ask("Password (#{note}for #{@user}): ") { |q| q.echo = "*" }
+      end
+
+      return true if ENV["FASTLANE_DONT_STORE_PASSWORD"]
+      return true unless mac?
+
+      # Now we store this information in the keychain
+      if add_to_keychain
+        return true
+      else
+        puts("Could not store password in keychain".red)
+        return false
+      end
+    end
+
+    # Helper.mac? - but we don't have access to the helper here
+    def mac?
+      (/darwin/ =~ RUBY_PLATFORM) != nil
+    end
+  end
+end

data/credentials_manager/lib/credentials_manager/appfile_config.rb

@@ -0,0 +1,192 @@
+require 'fastlane_core/globals'
+
+module CredentialsManager
+  # Access the content of the app file (e.g. app identifier and Apple ID)
+  class AppfileConfig
+    def self.try_fetch_value(key)
+      # We need to load the file every time we call this method
+      # to support the `for_lane` keyword
+      begin
+        return self.new.data[key]
+      rescue => ex
+        puts(ex.to_s)
+        return nil
+      end
+      nil
+    end
+
+    def self.default_path
+      ["./fastlane/Appfile", "./.fastlane/Appfile", "./Appfile"].each do |current|
+        return current if File.exist?(current)
+      end
+      nil
+    end
+
+    def initialize(path = nil)
+      if path
+        raise "Could not find Appfile at path '#{path}'".red unless File.exist?(File.expand_path(path))
+      end
+
+      path ||= self.class.default_path
+
+      if path && File.exist?(path) # it might not exist, we still want to use the default values
+        full_path = File.expand_path(path)
+        Dir.chdir(File.expand_path('..', path)) do
+          content = File.read(full_path, encoding: "utf-8")
+
+          # From https://github.com/orta/danger/blob/master/lib/danger/danger_core/dangerfile.rb
+          if content.tr!('“”‘’‛', %(""'''))
+            puts("Your #{File.basename(path)} has had smart quotes sanitised. " \
+                 'To avoid issues in the future, you should not use ' \
+                 'TextEdit for editing it. If you are not using TextEdit, ' \
+                 'you should turn off smart quotes in your editor of choice.'.red)
+          end
+
+          # rubocop:disable Security/Eval
+          eval(content)
+          # rubocop:enable Security/Eval
+
+          print_debug_information(path: full_path) if FastlaneCore::Globals.verbose?
+        end
+      end
+
+      fallback_to_default_values
+    end
+
+    def print_debug_information(path: nil)
+      self.class.already_printed_debug_information ||= {}
+      return if self.class.already_printed_debug_information[self.data]
+      # self.class.already_printed_debug_information is a hash, we use to detect if we already printed this data
+      # this is necessary, as on the course of a fastlane run, the values might change, e.g. when using
+      # the `for_lane` keyword.
+
+      puts("Successfully loaded Appfile at path '#{path}'".yellow)
+
+      self.data.each do |key, value|
+        puts("- #{key.to_s.cyan}: '#{value.to_s.green}'")
+      end
+      puts("-------")
+
+      self.class.already_printed_debug_information[self.data] = true
+    end
+
+    def self.already_printed_debug_information
+      @already_printed_debug_information ||= {}
+    end
+
+    def fallback_to_default_values
+      data[:apple_id] ||= ENV["FASTLANE_USER"] || ENV["DELIVER_USER"] || ENV["DELIVER_USERNAME"]
+    end
+
+    def data
+      @data ||= {}
+    end
+
+    # Setters
+
+    # iOS
+    def app_identifier(*args, &block)
+      setter(:app_identifier, *args, &block)
+    end
+
+    def apple_id(*args, &block)
+      setter(:apple_id, *args, &block)
+    end
+
+    def apple_dev_portal_id(*args, &block)
+      setter(:apple_dev_portal_id, *args, &block)
+    end
+
+    def itunes_connect_id(*args, &block)
+      setter(:itunes_connect_id, *args, &block)
+    end
+
+    # Developer Portal
+    def team_id(*args, &block)
+      setter(:team_id, *args, &block)
+    end
+
+    def team_name(*args, &block)
+      setter(:team_name, *args, &block)
+    end
+
+    # App Store Connect
+    def itc_team_id(*args, &block)
+      setter(:itc_team_id, *args, &block)
+    end
+
+    def itc_team_name(*args, &block)
+      setter(:itc_team_name, *args, &block)
+    end
+
+    # Android
+    def json_key_file(*args, &block)
+      setter(:json_key_file, *args, &block)
+    end
+
+    def json_key_data_raw(*args, &block)
+      setter(:json_key_data_raw, *args, &block)
+    end
+
+    def issuer(*args, &block)
+      puts("Appfile: DEPRECATED issuer: use json_key_file instead".red)
+      setter(:issuer, *args, &block)
+    end
+
+    def package_name(*args, &block)
+      setter(:package_name, *args, &block)
+    end
+
+    def keyfile(*args, &block)
+      puts("Appfile: DEPRECATED keyfile: use json_key_file instead".red)
+      setter(:keyfile, *args, &block)
+    end
+
+    # Override Appfile configuration for a specific lane.
+    #
+    # lane_name  - Symbol representing a lane name. (Can be either :name, 'name' or 'platform name')
+    # block - Block to execute to override configuration values.
+    #
+    # Discussion If received lane name does not match the lane name available as environment variable, no changes will
+    #             be applied.
+    def for_lane(lane_name)
+      if lane_name.to_s.split(" ").count > 1
+        # That's the legacy syntax 'platform name'
+        puts("You use deprecated syntax '#{lane_name}' in your Appfile.".yellow)
+        puts("Please follow the Appfile guide: https://docs.fastlane.tools/advanced/#appfile".yellow)
+        platform, lane_name = lane_name.split(" ")
+
+        return unless platform == ENV["FASTLANE_PLATFORM_NAME"]
+        # the lane name will be verified below
+      end
+
+      if ENV["FASTLANE_LANE_NAME"] == lane_name.to_s
+        yield
+      end
+    end
+
+    # Override Appfile configuration for a specific platform.
+    #
+    # platform_name  - Symbol representing a platform name.
+    # block - Block to execute to override configuration values.
+    #
+    # Discussion If received platform name does not match the platform name available as environment variable, no changes will
+    #             be applied.
+    def for_platform(platform_name)
+      if ENV["FASTLANE_PLATFORM_NAME"] == platform_name.to_s
+        yield
+      end
+    end
+
+    private
+
+    def setter(key, *args)
+      if block_given?
+        value = yield
+      else
+        value = args.shift
+      end
+      data[key] = value if value && value.to_s.length > 0
+    end
+  end
+end