fastlane_iac_publish 0.1.0

data/match/lib/match/encryption/interface.rb

@@ -0,0 +1,17 @@
+module Match
+  module Encryption
+    class Interface
+      # Call this method to trigger the actual
+      # encryption
+      def encrypt_files
+        not_implemented(__method__)
+      end
+
+      # Call this method to trigger the actual
+      # decryption
+      def decrypt_files
+        not_implemented(__method__)
+      end
+    end
+  end
+end

data/match/lib/match/encryption/openssl.rb

@@ -0,0 +1,161 @@
+require 'base64'
+require 'openssl'
+require 'securerandom'
+require 'security'
+require 'shellwords'
+
+require_relative '../change_password'
+require_relative '../module'
+
+module Match
+  module Encryption
+    class OpenSSL < Interface
+      attr_accessor :keychain_name
+
+      attr_accessor :working_directory
+
+      def self.configure(params)
+        return self.new(
+          keychain_name: params[:keychain_name],
+          working_directory: params[:working_directory]
+        )
+      end
+
+      # @param keychain_name: The identifier used to store the passphrase in the Keychain
+      # @param working_directory: The path to where the certificates are stored
+      def initialize(keychain_name: nil, working_directory: nil)
+        self.keychain_name = keychain_name
+        self.working_directory = working_directory
+      end
+
+      def encrypt_files
+        files = []
+        iterate(self.working_directory) do |current|
+          files << current
+          encrypt_specific_file(path: current, password: password)
+          UI.success("🔒  Encrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔒  Successfully encrypted certificates repo")
+        return files
+      end
+
+      def decrypt_files
+        files = []
+        iterate(self.working_directory) do |current|
+          files << current
+          begin
+            decrypt_specific_file(path: current, password: password)
+          rescue => ex
+            UI.verbose(ex.to_s)
+            UI.error("Couldn't decrypt the repo, please make sure you enter the right password!")
+            UI.user_error!("Invalid password passed via 'MATCH_PASSWORD'") if ENV["MATCH_PASSWORD"]
+            clear_password
+            self.decrypt_files # call itself
+            return
+          end
+          UI.success("🔓  Decrypted '#{File.basename(current)}'") if FastlaneCore::Globals.verbose?
+        end
+        UI.success("🔓  Successfully decrypted certificates repo")
+        return files
+      end
+
+      def store_password(password)
+        Security::InternetPassword.add(server_name(self.keychain_name), "", password)
+      end
+
+      # removes the password from the keychain again
+      def clear_password
+        Security::InternetPassword.delete(server: server_name(self.keychain_name))
+      end
+
+      private
+
+      def iterate(source_path)
+        Dir[File.join(source_path, "**", "*.{cer,p12,mobileprovision}")].each do |path|
+          next if File.directory?(path)
+          yield(path)
+        end
+      end
+
+      # server name used for accessing the macOS keychain
+      def server_name(keychain_name)
+        ["match", keychain_name].join("_")
+      end
+
+      # Access the MATCH_PASSWORD, either from ENV variable, Keychain or user input
+      def password
+        password = ENV["MATCH_PASSWORD"]
+        unless password
+          item = Security::InternetPassword.find(server: server_name(self.keychain_name))
+          password = item.password if item
+        end
+
+        unless password
+          if !UI.interactive?
+            UI.error("Neither the MATCH_PASSWORD environment variable nor the local keychain contained a password.")
+            UI.error("Bailing out instead of asking for a password, since this is non-interactive mode.")
+            UI.user_error!("Try setting the MATCH_PASSWORD environment variable, or temporarily enable interactive mode to store a password.")
+          else
+            UI.important("Enter the passphrase that should be used to encrypt/decrypt your certificates")
+            UI.important("This passphrase is specific per repository and will be stored in your local keychain")
+            UI.important("Make sure to remember the password, as you'll need it when you run match on a different machine")
+            password = ChangePassword.ask_password(confirm: true)
+            store_password(password)
+          end
+        end
+
+        return password
+      end
+
+      # We encrypt with MD5 because that was the most common default value in older fastlane versions which used the local OpenSSL installation
+      # A more secure key and IV generation is needed in the future
+      # IV should be randomly generated and provided unencrypted
+      # salt should be randomly generated and provided unencrypted (like in the current implementation)
+      # key should be generated with OpenSSL::KDF::pbkdf2_hmac with properly chosen parameters
+      # Short explanation about salt and IV: https://stackoverflow.com/a/1950674/6324550
+      def encrypt_specific_file(path: nil, password: nil)
+        UI.user_error!("No password supplied") if password.to_s.strip.length == 0
+
+        data_to_encrypt = File.binread(path)
+        salt = SecureRandom.random_bytes(8)
+
+        # The :: is important, as there is a name clash
+        cipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        cipher.encrypt
+        cipher.pkcs5_keyivgen(password, salt, 1, "MD5")
+        encrypted_data = "Salted__" + salt + cipher.update(data_to_encrypt) + cipher.final
+
+        File.write(path, Base64.encode64(encrypted_data))
+      rescue FastlaneCore::Interface::FastlaneError
+        raise
+      rescue => error
+        UI.error(error.to_s)
+        UI.crash!("Error encrypting '#{path}'")
+      end
+
+      # The encryption parameters in this implementations reflect the old behaviour which depended on the users' local OpenSSL version
+      # 1.0.x OpenSSL and earlier versions use MD5, 1.1.0c and newer uses SHA256, we try both before giving an error
+      def decrypt_specific_file(path: nil, password: nil, hash_algorithm: "MD5")
+        stored_data = Base64.decode64(File.read(path))
+        salt = stored_data[8..15]
+        data_to_decrypt = stored_data[16..-1]
+
+        decipher = ::OpenSSL::Cipher.new('AES-256-CBC')
+        decipher.decrypt
+        decipher.pkcs5_keyivgen(password, salt, 1, hash_algorithm)
+
+        decrypted_data = decipher.update(data_to_decrypt) + decipher.final
+
+        File.binwrite(path, decrypted_data)
+      rescue => error
+        fallback_hash_algorithm = "SHA256"
+        if hash_algorithm != fallback_hash_algorithm
+          decrypt_specific_file(path: path, password: password, hash_algorithm: fallback_hash_algorithm)
+        else
+          UI.error(error.to_s)
+          UI.crash!("Error decrypting '#{path}'")
+        end
+      end
+    end
+  end
+end

data/match/lib/match/generator.rb

@@ -0,0 +1,91 @@
+require_relative 'module'
+
+module Match
+  # Generate missing resources
+  class Generator
+    def self.generate_certificate(params, cert_type, working_directory)
+      require 'cert/runner'
+      require 'cert/options'
+
+      output_path = File.join(working_directory, "certs", cert_type.to_s)
+
+      arguments = FastlaneCore::Configuration.create(Cert::Options.available_options, {
+        development: params[:type] == "development",
+        output_path: output_path,
+        force: true, # we don't need a certificate without its private key, we only care about a new certificate
+        username: params[:username],
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        keychain_path: FastlaneCore::Helper.keychain_path(params[:keychain_name]),
+        keychain_password: params[:keychain_password]
+      })
+
+      Cert.config = arguments
+
+      begin
+        cert_path = Cert::Runner.new.launch
+      rescue => ex
+        if ex.to_s.include?("You already have a current")
+          UI.user_error!("Could not create a new certificate as you reached the maximum number of certificates for this account. You can use the `fastlane match nuke` command to revoke your existing certificates. More information https://docs.fastlane.tools/actions/match/")
+        else
+          raise ex
+        end
+      end
+
+      # We don't care about the signing request
+      Dir[File.join(working_directory, "**", "*.certSigningRequest")].each { |path| File.delete(path) }
+
+      # we need to return the path
+      # Inside this directory, there is the `.p12` file and the `.cer` file with the same name, but different extension
+      return cert_path
+    end
+
+    # @return (String) The UUID of the newly generated profile
+    def self.generate_provisioning_profile(params: nil, prov_type: nil, certificate_id: nil, app_identifier: nil, working_directory: nil)
+      require 'sigh/manager'
+      require 'sigh/options'
+
+      prov_type = Match.profile_type_sym(params[:type])
+
+      names = ["match", profile_type_name(prov_type), app_identifier]
+
+      if params[:platform].to_s != :ios.to_s # For ios we do not include the platform for backwards compatibility
+        names << params[:platform]
+      end
+
+      profile_name = names.join(" ")
+
+      values = {
+        app_identifier: app_identifier,
+        output_path: File.join(working_directory, "profiles", prov_type.to_s),
+        username: params[:username],
+        force: true,
+        cert_id: certificate_id,
+        provisioning_name: profile_name,
+        ignore_profiles_with_different_name: true,
+        team_id: params[:team_id],
+        team_name: params[:team_name],
+        template_name: params[:template_name]
+      }
+
+      values[:platform] = params[:platform]
+      values[:adhoc] = true if prov_type == :adhoc
+      values[:development] = true if prov_type == :development
+
+      arguments = FastlaneCore::Configuration.create(Sigh::Options.available_options, values)
+
+      Sigh.config = arguments
+      path = Sigh::Manager.start
+      return path
+    end
+
+    # @return the name of the provisioning profile type
+    def self.profile_type_name(type)
+      return "Development" if type == :development
+      return "AdHoc" if type == :adhoc
+      return "AppStore" if type == :appstore
+      return "InHouse" if type == :enterprise
+      return "Unknown"
+    end
+  end
+end

data/match/lib/match/migrate.rb

@@ -0,0 +1,98 @@
+require_relative 'options'
+require_relative 'spaceship_ensure'
+require_relative 'encryption'
+require_relative 'storage'
+require_relative 'module'
+require 'fileutils'
+
+module Match
+  class Migrate
+    def migrate(args, options)
+      params = FastlaneCore::Configuration.create(Match::Options.available_options, options.__hash__)
+      loaded_matchfile = params.load_configuration_file("Matchfile")
+
+      ensure_parameters_are_valid(params)
+
+      # We init the Google storage client before the git client
+      # to ask for all the missing inputs *before* cloning the git repo
+      google_cloud_storage = Storage.for_mode("google_cloud", {
+        google_cloud_bucket_name: params[:google_cloud_bucket_name],
+        google_cloud_keys_file: params[:google_cloud_keys_file],
+        google_cloud_project_id: params[:google_cloud_project_id]
+      })
+
+      git_storage = Storage.for_mode("git", {
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        git_branch: params[:git_branch],
+        clone_branch_directly: params[:clone_branch_directly]
+      })
+      git_storage.download
+
+      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        working_directory: git_storage.working_directory
+      })
+      encryption.decrypt_files if encryption
+      UI.success("Decrypted the git repo to '#{git_storage.working_directory}'")
+
+      google_cloud_storage.download
+
+      # Note how we always prefix the path in Google Cloud with the Team ID
+      # while on Git we recommend using the git branch instead. As there is
+      # no concept of branches in Google Cloud Storage (omg thanks), we use
+      # the team id properly
+      spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name])
+      team_id = spaceship.team_id
+      UI.message("Detected team ID '#{team_id}' to use for Google Cloud Storage...")
+
+      files_to_commit = []
+      Dir.chdir(git_storage.working_directory) do
+        Dir[File.join("**", "*")].each do |current_file|
+          next if File.directory?(current_file)
+
+          to_path = File.join(google_cloud_storage.working_directory, team_id, current_file)
+          FileUtils.mkdir_p(File.expand_path("..", to_path))
+
+          if File.exist?(to_path)
+            UI.user_error!("Looks like file already exists on Google Cloud Storage at path '#{to_path}', stopping the migration process. Please make sure the bucket is empty, or at least doesn't contain any files related to the same Team ID")
+          end
+          FileUtils.cp(current_file, to_path)
+
+          files_to_commit << to_path
+        end
+      end
+
+      google_cloud_storage.save_changes!(files_to_commit: files_to_commit)
+
+      UI.success("Successfully migrated your code signing certificates and provisioning profiles to Google Cloud Storage")
+      UI.success("Make sure to update your configuration to specify the `storage_mode`, as well as the bucket to use.")
+      UI.message("")
+      if loaded_matchfile
+        UI.message("Update your Matchfile at path '#{loaded_matchfile.configfile_path}':")
+        UI.message("")
+        UI.command_output("\t\tstorage_mode \"google_cloud\"")
+        UI.command_output("\t\tgoogle_cloud_bucket_name \"#{google_cloud_storage.bucket_name}\"")
+      else
+        UI.message("Update your Fastfile `match` call to include")
+        UI.message("")
+        UI.command_output("\t\tstorage_mode: \"google_cloud\",")
+        UI.command_output("\t\tgoogle_cloud_bucket_name: \"#{google_cloud_storage.bucket_name}\",")
+      end
+      UI.message("")
+      UI.success("You can also remove the `git_url`, as well as any other git related configurations from your Fastfile and Matchfile")
+      UI.message("")
+      UI.input("Please make sure to read the above and confirm with enter")
+    end
+
+    def ensure_parameters_are_valid(params)
+      if params[:readonly]
+        UI.user_error!("`fastlane match migrate` doesn't work in `readonly` mode")
+      end
+
+      if params[:storage_mode] != "git"
+        UI.user_error!("`fastlane match migrate` only allows migration from `git` to `google_cloud` right now, looks like your currently selected `storage_mode` is '#{params[:storage_mode]}'")
+      end
+    end
+  end
+end

data/match/lib/match/module.rb

@@ -0,0 +1,27 @@
+require 'fastlane_core/helper'
+
+module Match
+  Helper = FastlaneCore::Helper # you gotta love Ruby: Helper.* should use the Helper class contained in FastlaneCore
+  UI = FastlaneCore::UI
+  ROOT = Pathname.new(File.expand_path('../../..', __FILE__))
+  DESCRIPTION = "Easily sync your certificates and profiles across your team"
+
+  def self.environments
+    return %w(appstore adhoc development enterprise)
+  end
+
+  def self.storage_modes
+    return %w(git google_cloud)
+  end
+
+  def self.profile_type_sym(type)
+    return type.to_sym
+  end
+
+  def self.cert_type_sym(type)
+    return :enterprise if type == "enterprise"
+    return :development if type == "development"
+    return :distribution if ["adhoc", "appstore", "distribution"].include?(type)
+    raise "Unknown cert type: '#{type}'"
+  end
+end

data/match/lib/match/nuke.rb

@@ -0,0 +1,260 @@
+require 'terminal-table'
+
+require 'spaceship'
+require 'fastlane_core/provisioning_profile'
+require 'fastlane_core/print_table'
+
+require_relative 'module'
+
+require_relative 'storage'
+require_relative 'encryption'
+
+module Match
+  class Nuke
+    attr_accessor :params
+    attr_accessor :type
+
+    attr_accessor :certs
+    attr_accessor :profiles
+    attr_accessor :files
+
+    attr_accessor :storage
+    attr_accessor :encryption
+
+    def run(params, type: nil)
+      self.params = params
+      self.type = type
+
+      update_optional_values_depending_on_storage_type(params)
+
+      self.storage = Storage.for_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        shallow_clone: params[:shallow_clone],
+        skip_docs: params[:skip_docs],
+        git_branch: params[:git_branch],
+        git_full_name: params[:git_full_name],
+        git_user_email: params[:git_user_email],
+        clone_branch_directly: params[:clone_branch_directly],
+        google_cloud_bucket_name: params[:google_cloud_bucket_name].to_s,
+        google_cloud_keys_file: params[:google_cloud_keys_file].to_s,
+        google_cloud_project_id: params[:google_cloud_project_id].to_s
+      })
+      self.storage.download
+
+      # After the download was complete
+      self.encryption = Encryption.for_storage_mode(params[:storage_mode], {
+        git_url: params[:git_url],
+        working_directory: storage.working_directory
+      })
+      self.encryption.decrypt_files if self.encryption
+
+      had_app_identifier = self.params.fetch(:app_identifier, ask: false)
+      self.params[:app_identifier] = '' # we don't really need a value here
+      FastlaneCore::PrintTable.print_values(config: params,
+                                         hide_keys: [:app_identifier],
+                                             title: "Summary for match nuke #{Fastlane::VERSION}")
+
+      prepare_list
+      print_tables
+
+      if params[:readonly]
+        UI.user_error!("`fastlane match nuke` doesn't delete anything when running with --readonly enabled")
+      end
+
+      if (self.certs + self.profiles + self.files).count > 0
+        unless params[:skip_confirmation]
+          UI.error("---")
+          UI.error("Are you sure you want to completely delete and revoke all the")
+          UI.error("certificates and provisioning profiles listed above? (y/n)")
+          UI.error("Warning: By nuking distribution, both App Store and Ad Hoc profiles will be deleted") if type == "distribution"
+          UI.error("Warning: The :app_identifier value will be ignored - this will delete all profiles for all your apps!") if had_app_identifier
+          UI.error("---")
+        end
+        if params[:skip_confirmation] || UI.confirm("Do you really want to nuke everything listed above?")
+          nuke_it_now!
+          UI.success("Successfully cleaned your account ♻️")
+        else
+          UI.success("Cancelled nuking #thanks 🏠 👨 ‍👩 ‍👧")
+        end
+      else
+        UI.success("No relevant certificates or provisioning profiles found, nothing to nuke here :)")
+      end
+    end
+
+    # Be smart about optional values here
+    # Depending on the storage mode, different values are required
+    def update_optional_values_depending_on_storage_type(params)
+      if params[:storage_mode] != "git"
+        params.option_for_key(:git_url).optional = true
+      end
+    end
+
+    # Collect all the certs/profiles
+    def prepare_list
+      UI.message("Fetching certificates and profiles...")
+      cert_type = Match.cert_type_sym(type)
+
+      prov_types = []
+      prov_types = [:development] if cert_type == :development
+      prov_types = [:appstore, :adhoc] if cert_type == :distribution
+      prov_types = [:enterprise] if cert_type == :enterprise
+
+      Spaceship.login(params[:username])
+      Spaceship.select_team
+
+      if Spaceship.client.in_house? && (type == "distribution" || type == "enterprise")
+        UI.error("---")
+        UI.error("⚠️ Warning: This seems to be an Enterprise account!")
+        UI.error("By nuking your account's distribution, all your apps deployed via ad-hoc will stop working!") if type == "distribution"
+        UI.error("By nuking your account's enterprise, all your in-house apps will stop working!") if type == "enterprise"
+        UI.error("---")
+
+        UI.user_error!("Enterprise account nuke cancelled") unless UI.confirm("Do you really want to nuke your Enterprise account?")
+      end
+
+      self.certs = certificate_type(cert_type).all
+      self.profiles = []
+      prov_types.each do |prov_type|
+        self.profiles += profile_type(prov_type).all
+      end
+
+      certs = Dir[File.join(self.storage.working_directory, "**", cert_type.to_s, "*.cer")]
+      keys = Dir[File.join(self.storage.working_directory, "**", cert_type.to_s, "*.p12")]
+      profiles = []
+      prov_types.each do |prov_type|
+        profiles += Dir[File.join(self.storage.working_directory, "**", prov_type.to_s, "*.mobileprovision")]
+      end
+
+      self.files = certs + keys + profiles
+    end
+
+    # Print tables to ask the user
+    def print_tables
+      puts("")
+      if self.certs.count > 0
+        rows = self.certs.collect do |cert|
+          cert_expiration = cert.expires.nil? ? "Unknown" : cert.expires.strftime("%Y-%m-%d")
+          [cert.name, cert.id, cert.class.to_s.split("::").last, cert_expiration]
+        end
+        puts(Terminal::Table.new({
+          title: "Certificates that are going to be revoked".green,
+          headings: ["Name", "ID", "Type", "Expires"],
+          rows: FastlaneCore::PrintTable.transform_output(rows)
+        }))
+        puts("")
+      end
+
+      if self.profiles.count > 0
+        rows = self.profiles.collect do |p|
+          status = p.status == 'Active' ? p.status.green : p.status.red
+
+          # Expires is somtimes nil
+          expires = p.expires ? p.expires.strftime("%Y-%m-%d") : nil
+          [p.name, p.id, status, p.type, expires]
+        end
+        puts(Terminal::Table.new({
+          title: "Provisioning Profiles that are going to be revoked".green,
+          headings: ["Name", "ID", "Status", "Type", "Expires"],
+          rows: FastlaneCore::PrintTable.transform_output(rows)
+        }))
+        puts("")
+      end
+
+      if self.files.count > 0
+        rows = self.files.collect do |f|
+          components = f.split(File::SEPARATOR)[-3..-1]
+
+          # from "...1o7xtmh/certs/distribution/8K38XUY3AY.cer" to "distribution cert"
+          file_type = components[0..1].reverse.join(" ")[0..-2]
+
+          [file_type, components[2]]
+        end
+
+        puts(Terminal::Table.new({
+          title: "Files that are going to be deleted".green + "\n" + self.storage.human_readable_description,
+          headings: ["Type", "File Name"],
+          rows: rows
+        }))
+        puts("")
+      end
+    end
+
+    def nuke_it_now!
+      UI.header("Deleting #{self.profiles.count} provisioning profiles...") unless self.profiles.count == 0
+      self.profiles.each do |profile|
+        UI.message("Deleting profile '#{profile.name}' (#{profile.id})...")
+        begin
+          profile.delete!
+        rescue => ex
+          UI.message(ex.to_s)
+        end
+        UI.success("Successfully deleted profile")
+      end
+
+      UI.header("Revoking #{self.certs.count} certificates...") unless self.certs.count == 0
+      self.certs.each do |cert|
+        UI.message("Revoking certificate '#{cert.name}' (#{cert.id})...")
+        begin
+          cert.revoke!
+        rescue => ex
+          UI.message(ex.to_s)
+        end
+        UI.success("Successfully deleted certificate")
+      end
+
+      if self.files.count > 0
+        files_to_delete = delete_files!
+      end
+
+      self.encryption.encrypt_files if self.encryption
+
+      # Now we need to commit and push all this too
+      message = ["[fastlane]", "Nuked", "files", "for", type.to_s].join(" ")
+      self.storage.save_changes!(files_to_commit: [],
+                                 files_to_delete: files_to_delete,
+                                 custom_message: message)
+    end
+
+    private
+
+    def delete_files!
+      UI.header("Deleting #{self.files.count} files from the storage...")
+
+      return self.files.collect do |file|
+        UI.message("Deleting file '#{File.basename(file)}'...")
+
+        # Check if the profile is installed on the local machine
+        if file.end_with?("mobileprovision")
+          parsed = FastlaneCore::ProvisioningProfile.parse(file)
+          uuid = parsed["UUID"]
+          path = Dir[File.join(FastlaneCore::ProvisioningProfile.profiles_path, "#{uuid}.mobileprovision")].last
+          File.delete(path) if path
+        end
+
+        File.delete(file)
+        UI.success("Successfully deleted file")
+
+        file
+      end
+    end
+
+    # The kind of certificate we're interested in
+    def certificate_type(type)
+      {
+        distribution: Spaceship.certificate.production,
+        development:  Spaceship.certificate.development,
+        enterprise:   Spaceship.certificate.in_house
+      }[type] ||= raise "Unknown type '#{type}'"
+    end
+
+    # The kind of provisioning profile we're interested in
+    def profile_type(prov_type)
+      {
+        appstore:    Spaceship.provisioning_profile.app_store,
+        development: Spaceship.provisioning_profile.development,
+        enterprise:  Spaceship.provisioning_profile.in_house,
+        adhoc:       Spaceship.provisioning_profile.ad_hoc
+      }[prov_type] ||= raise "Unknown provisioning type '#{prov_type}'"
+    end
+  end
+end