fastlane_pricing_fix 2.212.1

data/match/lib/match/storage/git_storage.rb

@@ -0,0 +1,254 @@
+require 'fastlane_core/command_executor'
+
+require_relative '../module'
+require_relative './interface'
+
+module Match
+  module Storage
+    # Store the code signing identities in a git repo
+    class GitStorage < Interface
+      # User provided values
+      attr_accessor :git_url
+      attr_accessor :shallow_clone
+      attr_accessor :skip_docs
+      attr_accessor :branch
+      attr_accessor :git_full_name
+      attr_accessor :git_user_email
+      attr_accessor :clone_branch_directly
+      attr_accessor :type
+      attr_accessor :platform
+      attr_accessor :git_basic_authorization
+      attr_accessor :git_bearer_authorization
+      attr_accessor :git_private_key
+
+      def self.configure(params)
+        return self.new(
+          type: params[:type].to_s,
+          platform: params[:platform].to_s,
+          git_url: params[:git_url],
+          shallow_clone: params[:shallow_clone],
+          skip_docs: params[:skip_docs],
+          branch: params[:git_branch],
+          git_full_name: params[:git_full_name],
+          git_user_email: params[:git_user_email],
+          clone_branch_directly: params[:clone_branch_directly],
+          git_basic_authorization: params[:git_basic_authorization],
+          git_bearer_authorization: params[:git_bearer_authorization],
+          git_private_key: params[:git_private_key]
+        )
+      end
+
+      def initialize(type: nil,
+                     platform: nil,
+                     git_url: nil,
+                     shallow_clone: nil,
+                     skip_docs: false,
+                     branch: "master",
+                     git_full_name: nil,
+                     git_user_email: nil,
+                     clone_branch_directly: false,
+                     git_basic_authorization: nil,
+                     git_bearer_authorization: nil,
+                     git_private_key: nil)
+        self.git_url = git_url
+        self.shallow_clone = shallow_clone
+        self.skip_docs = skip_docs
+        self.branch = branch
+        self.git_full_name = git_full_name
+        self.git_user_email = git_user_email
+        self.clone_branch_directly = clone_branch_directly
+        self.git_basic_authorization = git_basic_authorization
+        self.git_bearer_authorization = git_bearer_authorization
+        self.git_private_key = git_private_key
+
+        self.type = type if type
+        self.platform = platform if platform
+      end
+
+      def prefixed_working_directory
+        return working_directory
+      end
+
+      def download
+        # Check if we already have a functional working_directory
+        return if @working_directory
+
+        # No existing working directory, creating a new one now
+        self.working_directory = Dir.mktmpdir
+
+        command = "git clone #{self.git_url.shellescape} #{self.working_directory.shellescape}"
+        # HTTP headers are supposed to be be case insensitive but
+        # Bitbucket requires `Authorization: Basic` and `Authorization Bearer` to work
+        # https://github.com/fastlane/fastlane/pull/15928
+        command << " -c http.extraheader='Authorization: Basic #{self.git_basic_authorization}'" unless self.git_basic_authorization.nil?
+        command << " -c http.extraheader='Authorization: Bearer #{self.git_bearer_authorization}'" unless self.git_bearer_authorization.nil?
+
+        if self.shallow_clone
+          command << " --depth 1 --no-single-branch"
+        elsif self.clone_branch_directly
+          command += " -b #{self.branch.shellescape} --single-branch"
+        end
+
+        command = command_from_private_key(command) unless self.git_private_key.nil?
+
+        UI.message("Cloning remote git repo...")
+        if self.branch && !self.clone_branch_directly
+          UI.message("If cloning the repo takes too long, you can use the `clone_branch_directly` option in match.")
+        end
+
+        begin
+          # GIT_TERMINAL_PROMPT will fail the `git clone` command if user credentials are missing
+          Helper.with_env_values('GIT_TERMINAL_PROMPT' => '0') do
+            FastlaneCore::CommandExecutor.execute(command: command,
+                                                print_all: FastlaneCore::Globals.verbose?,
+                                            print_command: FastlaneCore::Globals.verbose?)
+          end
+        rescue
+          UI.error("Error cloning certificates repo, please make sure you have read access to the repository you want to use")
+          if self.branch && self.clone_branch_directly
+            UI.error("You passed '#{self.branch}' as branch in combination with the `clone_branch_directly` flag. Please remove `clone_branch_directly` flag on the first run for _match_ to create the branch.")
+          end
+          UI.error("Run the following command manually to make sure you're properly authenticated:")
+          UI.command(command)
+          UI.user_error!("Error cloning certificates git repo, please make sure you have access to the repository - see instructions above")
+        end
+
+        add_user_config(self.git_full_name, self.git_user_email)
+
+        unless File.directory?(self.working_directory)
+          UI.user_error!("Error cloning repo, make sure you have access to it '#{self.git_url}'")
+        end
+
+        checkout_branch
+      end
+
+      def human_readable_description
+        "Git Repo [#{self.git_url}]"
+      end
+
+      def delete_files(files_to_delete: [], custom_message: nil)
+        # No specific list given, e.g. this happens on `fastlane match nuke`
+        # We just want to run `git add -A` to commit everything
+        git_push(commands: ["git add -A"], commit_message: custom_message)
+      end
+
+      def upload_files(files_to_upload: [], custom_message: nil)
+        commands = files_to_upload.map do |current_file|
+          "git add #{current_file.shellescape}"
+        end
+
+        git_push(commands: commands, commit_message: custom_message)
+      end
+
+      # Generate the commit message based on the user's parameters
+      def generate_commit_message
+        [
+          "[fastlane]",
+          "Updated",
+          self.type,
+          "and platform",
+          self.platform
+        ].join(" ")
+      end
+
+      def generate_matchfile_content
+        UI.important("Please create a new, private git repository to store the certificates and profiles there")
+        url = UI.input("URL of the Git Repo: ")
+
+        return "git_url(\"#{url}\")"
+      end
+
+      def list_files(file_name: "", file_ext: "")
+        Dir[File.join(working_directory, "**", file_name, "*.#{file_ext}")]
+      end
+
+      def command_from_private_key(command)
+        if File.file?(self.git_private_key)
+          ssh_add = File.expand_path(self.git_private_key).shellescape.to_s
+        else
+          UI.message("Private key file does not exist, will continue by using it as a raw key.")
+          ssh_add = "- <<< \"#{self.git_private_key}\""
+        end
+        return "ssh-agent bash -c 'ssh-add #{ssh_add}; #{command}'"
+      end
+
+      private
+
+      # Create and checkout an specific branch in the git repo
+      def checkout_branch
+        return unless self.working_directory
+
+        commands = []
+        if branch_exists?(self.branch)
+          # Checkout the branch if it already exists
+          commands << "git checkout #{self.branch.shellescape}"
+        else
+          # If a new branch is being created, we create it as an 'orphan' to not inherit changes from the master branch.
+          commands << "git checkout --orphan #{self.branch.shellescape}"
+          # We also need to reset the working directory to not transfer any uncommitted changes to the new branch.
+          commands << "git reset --hard"
+        end
+
+        UI.message("Checking out branch #{self.branch}...")
+
+        Dir.chdir(self.working_directory) do
+          commands.each do |command|
+            FastlaneCore::CommandExecutor.execute(command: command,
+                                                  print_all: FastlaneCore::Globals.verbose?,
+                                                  print_command: FastlaneCore::Globals.verbose?)
+          end
+        end
+      end
+
+      # Checks if a specific branch exists in the git repo
+      def branch_exists?(branch)
+        return unless self.working_directory
+
+        result = Dir.chdir(self.working_directory) do
+          FastlaneCore::CommandExecutor.execute(command: "git --no-pager branch --list origin/#{branch.shellescape} --no-color -r",
+                                                print_all: FastlaneCore::Globals.verbose?,
+                                                print_command: FastlaneCore::Globals.verbose?)
+        end
+        return !result.empty?
+      end
+
+      def add_user_config(user_name, user_email)
+        # Add git config if needed
+        commands = []
+        commands << "git config user.name \"#{user_name}\"" unless user_name.nil?
+        commands << "git config user.email \"#{user_email}\"" unless user_email.nil?
+
+        return if commands.empty?
+
+        UI.message("Add git user config to local git repo...")
+        Dir.chdir(self.working_directory) do
+          commands.each do |command|
+            FastlaneCore::CommandExecutor.execute(command: command,
+                                                  print_all: FastlaneCore::Globals.verbose?,
+                                                  print_command: FastlaneCore::Globals.verbose?)
+          end
+        end
+      end
+
+      def git_push(commands: [], commit_message: nil)
+        commit_message ||= generate_commit_message
+        commands << "git commit -m #{commit_message.shellescape}"
+        git_push_command = "git push origin #{self.branch.shellescape}"
+        git_push_command = command_from_private_key(git_push_command) unless self.git_private_key.nil?
+        commands << git_push_command
+
+        UI.message("Pushing changes to remote git repo...")
+        Helper.with_env_values('GIT_TERMINAL_PROMPT' => '0') do
+          commands.each do |command|
+            FastlaneCore::CommandExecutor.execute(command: command,
+                                                print_all: FastlaneCore::Globals.verbose?,
+                                            print_command: FastlaneCore::Globals.verbose?)
+          end
+        end
+      rescue => ex
+        UI.error("Couldn't commit or push changes back to git...")
+        UI.error(ex)
+      end
+    end
+  end
+end

data/match/lib/match/storage/gitlab/client.rb

@@ -0,0 +1,102 @@
+require 'net/http/post/multipart'
+require 'securerandom'
+
+require_relative '../../module'
+require_relative './secure_file'
+
+module Match
+  module Storage
+    class GitLab
+      class Client
+        def initialize(api_v4_url:, project_id:, job_token: nil, private_token: nil)
+          @job_token      = job_token
+          @private_token  = private_token
+          @api_v4_url     = api_v4_url
+          @project_id     = project_id
+
+          UI.important("JOB_TOKEN and PRIVATE_TOKEN both defined, using JOB_TOKEN to execute this job.") if @job_token && @private_token
+        end
+
+        def base_url
+          return "#{@api_v4_url}/projects/#{CGI.escape(@project_id)}/secure_files"
+        end
+
+        def authentication_key
+          if @job_token
+            return "JOB-TOKEN"
+          elsif @private_token
+            return "PRIVATE-TOKEN"
+          end
+        end
+
+        def authentication_value
+          if @job_token
+            return @job_token
+          elsif @private_token
+            return @private_token
+          end
+        end
+
+        def files
+          @files ||= begin
+            url = URI.parse(base_url)
+
+            request = Net::HTTP::Get.new(url.request_uri)
+
+            res = execute_request(url, request)
+
+            data = []
+
+            JSON.parse(res.body).each do |file|
+              data << SecureFile.new(client: self, file: file)
+            end
+
+            data
+          end
+        end
+
+        def find_file_by_name(name)
+          files.select { |secure_file| secure_file.file.name == name }.first
+        end
+
+        def upload_file(current_file, target_file)
+          url = URI.parse(base_url)
+
+          File.open(current_file) do |file|
+            request = Net::HTTP::Post::Multipart.new(
+              url.path,
+              "file" => UploadIO.new(file, "application/octet-stream"),
+              "name" => target_file
+            )
+
+            response = execute_request(url, request)
+
+            log_upload_error(response, target_file) if response.code != "201"
+          end
+        end
+
+        def log_upload_error(response, target_file)
+          begin
+            response_body = JSON.parse(response.body)
+          rescue JSON::ParserError
+            response_body = response.body
+          end
+
+          if response_body["message"] && (response_body["message"]["name"] == ["has already been taken"])
+            UI.error("#{target_file} already exists in GitLab project #{@project_id}, file not uploaded")
+          else
+            UI.error("Upload error for #{target_file}: #{response_body}")
+          end
+        end
+
+        def execute_request(url, request)
+          request[authentication_key] = authentication_value
+
+          http = Net::HTTP.new(url.host, url.port)
+          http.use_ssl = url.instance_of?(URI::HTTPS)
+          http.request(request)
+        end
+      end
+    end
+  end
+end

data/match/lib/match/storage/gitlab/secure_file.rb

@@ -0,0 +1,65 @@
+require 'open-uri'
+
+require_relative '../../module'
+
+module Match
+  module Storage
+    class GitLab
+      class SecureFile
+        attr_reader :client, :file
+
+        def initialize(file:, client:)
+          @file   = OpenStruct.new(file)
+          @client = client
+        end
+
+        def file_url
+          "#{@client.base_url}/#{@file.id}"
+        end
+
+        def create_subfolders(working_directory)
+          FileUtils.mkdir_p("#{working_directory}/#{destination_file_path}")
+        end
+
+        def destination_file_path
+          filename = @file.name.split('/').last
+
+          @file.name.gsub(filename, '').gsub(%r{^/}, '')
+        end
+
+        def valid_checksum?(file)
+          Digest::SHA256.hexdigest(File.read(file)) == @file.checksum
+        end
+
+        def download(working_directory)
+          url = URI("#{file_url}/download")
+
+          begin
+            destination_file = "#{working_directory}/#{@file.name}"
+
+            create_subfolders(working_directory)
+            File.open(destination_file, "wb") do |saved_file|
+              URI.open(url, "rb", { @client.authentication_key => @client.authentication_value }) do |data|
+                saved_file.write(data.read)
+              end
+
+              FileUtils.chmod('u=rw,go-r', destination_file)
+            end
+
+            UI.crash!("Checksum validation failed for #{@file.name}") unless valid_checksum?(destination_file)
+          rescue OpenURI::HTTPError => msg
+            UI.error("Unable to download #{@file.name} - #{msg}")
+          end
+        end
+
+        def delete
+          url = URI(file_url)
+
+          request = Net::HTTP::Delete.new(url.request_uri)
+
+          @client.execute_request(url, request)
+        end
+      end
+    end
+  end
+end

data/match/lib/match/storage/gitlab_secure_files.rb

@@ -0,0 +1,182 @@
+require 'fastlane_core/command_executor'
+require 'fastlane_core/configuration/configuration'
+require 'net/http/post/multipart'
+
+require_relative './gitlab/client'
+require_relative './gitlab/secure_file'
+
+require_relative '../options'
+require_relative '../module'
+require_relative '../spaceship_ensure'
+require_relative './interface'
+
+module Match
+  module Storage
+    # Store the code signing identities in GitLab Secure Files
+    class GitLabSecureFiles < Interface
+      attr_reader :gitlab_client
+      attr_reader :project_id
+      attr_reader :readonly
+      attr_reader :username
+      attr_reader :team_id
+      attr_reader :team_name
+      attr_reader :api_key_path
+      attr_reader :api_key
+
+      def self.configure(params)
+        api_v4_url     = params[:api_v4_url] || ENV['CI_API_V4_URL'] || 'https://gitlab.com/api/v4'
+        project_id     = params[:gitlab_project] || ENV['GITLAB_PROJECT'] || ENV['CI_PROJECT_ID']
+        job_token      = params[:job_token] || ENV['CI_JOB_TOKEN']
+        private_token  = params[:private_token] || ENV['PRIVATE_TOKEN']
+
+        if params[:git_url].to_s.length > 0
+          UI.important("Looks like you still define a `git_url` somewhere, even though")
+          UI.important("you use GitLab Secure Files. You can remove the `git_url`")
+          UI.important("from your Matchfile and Fastfile")
+          UI.message("The above is just a warning, fastlane will continue as usual now...")
+        end
+
+        return self.new(
+          api_v4_url: api_v4_url,
+          project_id: project_id,
+          job_token: job_token,
+          private_token: private_token,
+          readonly: params[:readonly],
+          username: params[:username],
+          team_id: params[:team_id],
+          team_name: params[:team_name],
+          api_key_path: params[:api_key_path],
+          api_key: params[:api_key]
+        )
+      end
+
+      def initialize(api_v4_url: nil,
+                     project_id: nil,
+                     job_token: nil,
+                     private_token: nil,
+                     readonly: nil,
+                     username: nil,
+                     team_id: nil,
+                     team_name: nil,
+                     api_key_path: nil,
+                     api_key: nil)
+
+        @readonly = readonly
+        @username = username
+        @team_id = team_id
+        @team_name = team_name
+        @api_key_path = api_key_path
+        @api_key = api_key
+
+        @job_token = job_token
+        @private_token = private_token
+        @api_v4_url = api_v4_url
+        @project_id = project_id
+        @gitlab_client = GitLab::Client.new(job_token: job_token, private_token: private_token, project_id: project_id, api_v4_url: api_v4_url)
+
+        UI.message("Initializing match for GitLab project #{@project_id}")
+      end
+
+      # To make debugging easier, we have a custom exception here
+      def prefixed_working_directory
+        # We fall back to "*", which means certificates and profiles
+        # from all teams that use this bucket would be installed. This is not ideal, but
+        # unless the user provides a `team_id`, we can't know which one to use
+        # This only happens if `readonly` is activated, and no `team_id` was provided
+        @_folder_prefix ||= currently_used_team_id
+        if @_folder_prefix.nil?
+          # We use a `@_folder_prefix` variable, to keep state between multiple calls of this
+          # method, as the value won't change. This way the warning is only printed once
+          UI.important("Looks like you run `match` in `readonly` mode, and didn't provide a `team_id`. This will still work, however it is recommended to provide a `team_id` in your Appfile or Matchfile")
+          @_folder_prefix = "*"
+        end
+        return File.join(working_directory, @_folder_prefix)
+      end
+
+      def download
+        # Check if we already have a functional working_directory
+        return if @working_directory
+
+        # No existing working directory, creating a new one now
+        self.working_directory = Dir.mktmpdir
+
+        @gitlab_client.files.each do |secure_file|
+          secure_file.download(self.working_directory)
+        end
+
+        UI.verbose("Successfully downloaded all Secure Files from GitLab to #{self.working_directory}")
+      end
+
+      def currently_used_team_id
+        if self.readonly
+          # In readonly mode, we still want to see if the user provided a team_id
+          # see `prefixed_working_directory` comments for more details
+          return self.team_id
+        else
+          UI.user_error!("The `team_id` option is required. fastlane cannot automatically determine portal team id via the App Store Connect API (yet)") if self.team_id.to_s.empty?
+
+          spaceship = SpaceshipEnsure.new(self.username, self.team_id, self.team_name, api_token)
+          return spaceship.team_id
+        end
+      end
+
+      def api_token
+        api_token = Spaceship::ConnectAPI::Token.from(hash: self.api_key, filepath: self.api_key_path)
+        api_token ||= Spaceship::ConnectAPI.token
+        return api_token
+      end
+
+      # Returns a short string describing + identifing the current
+      # storage backend. This will be printed when nuking a storage
+      def human_readable_description
+        "GitLab Secure Files Storage [#{self.project_id}]"
+      end
+
+      def upload_files(files_to_upload: [], custom_message: nil)
+        # `files_to_upload` is an array of files that need to be uploaded to GitLab Secure Files
+        # Those doesn't mean they're new, it might just be they're changed
+        # Either way, we'll upload them using the same technique
+
+        files_to_upload.each do |current_file|
+          # Go from
+          #   "/var/folders/px/bz2kts9n69g8crgv4jpjh6b40000gn/T/d20181026-96528-1av4gge/profiles/development/Development_me.mobileprovision"
+          # to
+          #   "profiles/development/Development_me.mobileprovision"
+          #
+
+          # We also remove the trailing `/`
+          target_file = current_file.gsub(self.working_directory + "/", "")
+          UI.verbose("Uploading '#{target_file}' to GitLab Secure Files...")
+          @gitlab_client.upload_file(current_file, target_file)
+        end
+      end
+
+      def delete_files(files_to_delete: [], custom_message: nil)
+        files_to_delete.each do |current_file|
+          target_path = current_file.gsub(self.working_directory + "/", "")
+
+          secure_file = @gitlab_client.find_file_by_name(target_path)
+          UI.message("Deleting '#{target_path}' from GitLab Secure Files...")
+          secure_file.delete
+        end
+      end
+
+      def skip_docs
+        true
+      end
+
+      def list_files(file_name: "", file_ext: "")
+        Dir[File.join(working_directory, self.team_id, "**", file_name, "*.#{file_ext}")]
+      end
+
+      # Implement this for the `fastlane match init` command
+      # This method must return the content of the Matchfile
+      # that should be generated
+      def generate_matchfile_content(template: nil)
+        project = UI.input("What is your GitLab Project (i.e. gitlab-org/gitlab): ")
+
+        return "gitlab_project(\"#{project}\")"
+      end
+    end
+  end
+end