howsigned 0.0.9 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 94583389df0b0759430446202650c8c4b7453a65
-  data.tar.gz: 2e5ca873274a910c2a365f1cb3deda596a11e49e
+SHA256:
+  metadata.gz: 6b35357e3a7d5fede023bc0b0010c8cda63ba024fdb3de8526a4b703385b2728
+  data.tar.gz: 2a207720c330ad476eff671a8e9f6d3c480bede84e4cd334ca0c31edf7e3badb
 SHA512:
-  metadata.gz: 50dee3d0f89a6b349f37f02dae303ff72a65675ce005ef73f3148590d800e40a5facda3579320ca6c2b4b3bf4e9769833b907bbffe3a638c3e4665a439a3433a
-  data.tar.gz: 36a5b835f2caa5d2511b456da921b741e45d2c7657f593000174eaab49358fe309944a68c1109db34c84cd265dfaf3365662e3c0c45995ffaa6652faa4b586a2
+  metadata.gz: 2d6592ef12478f2bb4ed6e233a4f9cad65eede3fbe8a6e7a1a1e38aaa85da9bd4a2d0094869d87c1ca2d2457eeb52e997dfc6ed86260e54343ea87deed47d29d
+  data.tar.gz: c6761223afc9ecb8a043cb388d13424074996b9e920593d0ff8b57da471bba413d039ee9736a68058abb5e71f87dedf84bda0e88e6d2de6879b077948e46ac0f

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Michael MacDougall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,59 @@
+# howsigned
+
+`howsigned` is a macOS CLI for auditing the signing state of Apple IPA archives. It is useful when a TestFlight or App Store submission fails because a nested app, extension, framework, or provisioning profile does not match expectations.
+
+## Install
+
+```sh
+gem install howsigned
+```
+
+The tool requires macOS developer tools (`codesign` and `security`) and Ruby 3.2 or newer.
+
+## Commands
+
+Generate a complete, CI-friendly signing manifest:
+
+```sh
+howsigned manifest MyApp.ipa > signing-manifest.json
+```
+
+Verify every discovered nested binary. Exit status `1` means a signature finding:
+
+```sh
+howsigned verify MyApp.ipa
+```
+
+Inspect entitlements or embedded provisioning profiles:
+
+```sh
+howsigned entitlements MyApp.ipa
+howsigned profiles MyApp.ipa
+howsigned profiles --expiration MyApp.ipa
+```
+
+Compare two builds. Exit status `1` means their manifests differ:
+
+```sh
+howsigned compare Old.ipa New.ipa
+```
+
+All structured output is JSON. Exit status `2` indicates invalid input or usage; `3` indicates an unavailable tool or runtime failure.
+
+## GitHub releases
+
+CI runs on macOS for Ruby 3.2–3.4, executes the test suite, and builds the gem. A tag such as `v2.0.0` invokes the release workflow and publishes to RubyGems using the repository’s `RUBYGEMS_API_KEY` secret. GitHub is the release source of truth; do not upload gems manually.
+
+## Development
+
+```sh
+bundle install
+bundle exec rake
+gem build howsigned.gemspec
+```
+
+The tests use synthetic IPA archives and fake command execution, so they are safe to run without a signed application. The production audit remains macOS-specific because Apple’s signing tools are macOS tools.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/Rakefile

@@ -0,0 +1,9 @@
+#! /usr/bin/env ruby
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+task default: :test
+
+task :test do
+  ruby "-Ilib:test", *Dir["test/**/*_test.rb"]
+end

data/bin/howsigned

@@ -1,13 +1,114 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
-require 'rubygems'
-require 'commander/import'
+require "optparse"
+require "json"
+require "howsigned"
 
-require 'entitlements'
-require 'profiles'
-require 'verify'
-require 'compare'
+module Howsigned
+  class CLI
+    EXIT_OK = 0
+    EXIT_FINDINGS = 1
+    EXIT_USAGE = 2
+    EXIT_RUNTIME = 3
 
-program :version, '0.0.9'
-program :description, 'Utility to determine codesigning on contained binaries in an .ipa'
+    def self.run(argv)
+      new(argv).run
+    rescue OptionParser::ParseError, InputError => e
+      warn "howsigned: #{e.message}"
+      EXIT_USAGE
+    rescue Error => e
+      warn "howsigned: #{e.message}"
+      EXIT_RUNTIME
+    end
 
+    def initialize(argv)
+      @argv = argv.dup
+      @expiration = false
+    end
+
+    def run
+      command = @argv.shift
+      if command.nil? || %w[-h --help help].include?(command)
+        puts global_help
+        return EXIT_OK
+      end
+      if %w[--version -v].include?(command)
+        puts VERSION
+        return EXIT_OK
+      end
+
+      command_parser(command).parse!(@argv)
+      case command
+      when "verify" then run_verify
+      when "entitlements" then run_single { |auditor| auditor.entitlements }
+      when "profiles" then run_single { |auditor| auditor.profiles(expiration_only: @expiration) }
+      when "manifest" then run_single { |auditor| auditor.manifest }
+      when "compare" then run_compare
+      else raise OptionParser::InvalidArgument, "unknown command #{command.inspect}"
+      end
+    end
+
+    private
+
+    def global_help
+      <<~USAGE
+        Usage: howsigned COMMAND [options]
+
+        Commands:
+          manifest       Emit a complete signing manifest as JSON
+          verify         Verify every discovered nested binary
+          entitlements   Print entitlements as JSON
+          profiles       Print embedded provisioning profiles as JSON
+          compare        Compare signing manifests from two IPAs
+
+        Run `howsigned COMMAND --help` for command-specific options.
+      USAGE
+    end
+
+    def command_parser(command)
+      OptionParser.new do |opts|
+        opts.banner = "Usage: howsigned #{command} [options] IPA#{command == 'compare' ? ' IPA' : ''}"
+        opts.on("--expiration", "Print only profile expiration dates") do
+          raise OptionParser::InvalidOption, "--expiration is only valid for profiles" unless command == "profiles"
+          @expiration = true
+        end
+        opts.on("-h", "--help", "Show this help") { puts opts; exit EXIT_OK }
+      end
+    end
+
+    def run_single
+      require_args(1)
+      value = nil
+      Auditor.new(@argv.fetch(0)).with_extracted_ipa { |auditor| value = yield auditor }
+      puts JSON.pretty_generate(value)
+      EXIT_OK
+    end
+
+    def run_verify
+      require_args(1)
+      result = nil
+      Auditor.new(@argv.fetch(0)).with_extracted_ipa { |auditor| result = auditor.verification }
+      puts JSON.pretty_generate(result)
+      result.all? { |entry| entry["valid"] } ? EXIT_OK : EXIT_FINDINGS
+    end
+
+    def run_compare
+      require_args(2)
+      manifests = @argv.first(2).map do |path|
+        value = nil
+        Auditor.new(path).with_extracted_ipa { |auditor| value = auditor.manifest }
+        value
+      end
+      puts JSON.pretty_generate("first" => manifests[0], "second" => manifests[1]) unless manifests[0] == manifests[1]
+      puts JSON.pretty_generate("equal" => true) if manifests[0] == manifests[1]
+      manifests[0] == manifests[1] ? EXIT_OK : EXIT_FINDINGS
+    end
+
+    def require_args(count)
+      raise InputError, "expected #{count} IPA path#{count == 1 ? '' : 's'}" if @argv.length < count
+    end
+  end
+end
+
+exit Howsigned::CLI.run(ARGV)

data/lib/howsigned/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Howsigned
+  VERSION = "2.0.0"
+end

data/lib/howsigned.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "pathname"
+require "tmpdir"
+require "fileutils"
+require "find"
+require "zip"
+require "plist"
+require "howsigned/version"
+
+module Howsigned
+  class Error < StandardError; end
+  class InputError < Error; end
+  class ToolError < Error; end
+  class UnsafeArchiveError < InputError; end
+
+  Result = Struct.new(:stdout, :stderr, :status, keyword_init: true) do
+    def success?
+      status.success?
+    end
+  end
+
+  class CommandRunner
+    def initialize(env: {}, executable_finder: nil)
+      @env = env
+      @executable_finder = executable_finder || ->(name) { name }
+    end
+
+    def run(*args, allow_failure: false)
+      command = [@executable_finder.call(args.first), *args.drop(1)]
+      stdout, stderr, status = Open3.capture3(@env, *command)
+      result = Result.new(stdout: stdout, stderr: stderr, status: status)
+      return result if result.success? || allow_failure
+
+      raise ToolError, "#{command.first} failed (#{status.exitstatus}): #{stderr.strip}"
+    rescue Errno::ENOENT
+      raise ToolError, "Required macOS tool not found: #{args.first}"
+    end
+  end
+
+  class IPAArchive
+    def initialize(path)
+      @path = File.expand_path(path.to_s)
+      raise InputError, "IPA not found: #{@path}" unless File.file?(@path)
+    end
+
+    def extract
+      directory = Dir.mktmpdir("howsigned-")
+      Zip::File.open(@path) do |archive|
+        archive.each do |entry|
+          next if entry.directory?
+
+          relative = safe_relative_path(entry.name)
+          destination = File.expand_path(relative, directory)
+          root = File.expand_path(directory) + File::SEPARATOR
+          raise UnsafeArchiveError, "Archive entry escapes extraction directory: #{entry.name}" unless destination.start_with?(root)
+
+          FileUtils.mkdir_p(File.dirname(destination))
+          raise UnsafeArchiveError, "Archive entry traverses a symlink: #{entry.name}" if symlink_in_path?(directory, relative)
+
+          File.open(destination, "wb") { |file| file.write(entry.get_input_stream.read) }
+        end
+      end
+      directory
+    rescue StandardError
+      FileUtils.remove_entry(directory) if directory && File.exist?(directory)
+      raise
+    end
+
+    private
+
+    def safe_relative_path(name)
+      path = Pathname.new(name.to_s)
+      raise UnsafeArchiveError, "Absolute archive entry is not allowed: #{name}" if path.absolute?
+
+      clean = path.cleanpath.to_s
+      raise UnsafeArchiveError, "Parent archive entry is not allowed: #{name}" if clean == ".." || clean.start_with?("../")
+
+      clean
+    end
+
+    def symlink_in_path?(root, relative)
+      current = root
+      relative.split(File::SEPARATOR)[0...-1].each do |component|
+        current = File.join(current, component)
+        return true if File.symlink?(current)
+      end
+      false
+    end
+  end
+
+  Bundle = Struct.new(:kind, :path, :binary, keyword_init: true) do
+    def relative_path(root)
+      path.delete_prefix("#{root}/")
+    end
+  end
+
+  class BundleScanner
+    EXTENSIONS = {
+      ".app" => :app,
+      ".appex" => :appex,
+      ".framework" => :framework,
+      ".xpc" => :xpc,
+      ".watchkitapp" => :watchkitapp,
+      ".plugin" => :plugin,
+      ".bundle" => :bundle,
+      ".dylib" => :dylib
+    }.freeze
+
+    def initialize(root)
+      @root = File.expand_path(root)
+    end
+
+    def scan
+      candidates = []
+      Find.find(@root) do |path|
+        next unless File.file?(path) || File.directory?(path)
+
+        extension = EXTENSIONS.keys.find { |suffix| path.end_with?(suffix) }
+        next unless extension
+
+        kind = EXTENSIONS.fetch(extension)
+        binary = kind == :dylib ? path : binary_for_bundle(path)
+        candidates << Bundle.new(kind: kind, path: path, binary: binary) if binary && File.exist?(binary)
+      end
+      candidates.uniq { |bundle| bundle.binary }.sort_by(&:path)
+    end
+
+    private
+
+    def binary_for_bundle(path)
+      name = File.basename(path, File.extname(path))
+      candidates = [
+        File.join(path, name),
+        File.join(path, "Contents", "MacOS", name),
+        File.join(path, "Versions", "Current", name)
+      ]
+      candidates.find { |candidate| File.file?(candidate) }
+    end
+  end
+
+  class Auditor
+    attr_reader :ipa, :root, :runner, :bundles
+
+    def initialize(ipa, runner: CommandRunner.new)
+      @ipa = File.expand_path(ipa.to_s)
+      @runner = runner
+    end
+
+    def with_extracted_ipa
+      directory, = IPAArchive.new(@ipa).extract
+      @root = directory
+      @bundles = BundleScanner.new(File.join(directory, "Payload")).scan
+      raise InputError, "IPA contains no recognized signed bundles" if @bundles.empty?
+
+      yield self
+    ensure
+      FileUtils.remove_entry(directory) if directory && File.exist?(directory)
+    end
+
+    def verification
+      bundles.map do |bundle|
+        result = runner.run("codesign", "--verify", "--strict", "--verbose=2", bundle.binary, allow_failure: true)
+        {
+          "path" => bundle.relative_path(root),
+          "binary" => bundle.binary.delete_prefix("#{root}/"),
+          "valid" => result.success?,
+          "message" => result.success? ? nil : [result.stdout, result.stderr].join.strip
+        }
+      end
+    end
+
+    def entitlements
+      collect_plists do |bundle|
+        result = runner.run("codesign", "-d", "--entitlements", ":-", bundle.binary, allow_failure: true)
+        next if result.stdout.strip.empty? && result.stderr.strip.empty?
+
+        xml = [result.stdout, result.stderr].join
+        plist = parse_plist(xml)
+        plist ? { "path" => bundle.relative_path(root), "entitlements" => plist } : nil
+      end
+    end
+
+    def profiles(expiration_only: false)
+      files = Dir.glob(File.join(root, "**", "*.mobileprovision"))
+      files.filter_map do |file|
+        result = runner.run("security", "cms", "-D", "-i", file, allow_failure: true)
+        plist = parse_plist(result.stdout)
+        next unless plist
+
+        value = expiration_only ? plist["ExpirationDate"] : plist
+        { "path" => file.delete_prefix("#{root}/"), "profile" => value }
+      end
+    end
+
+    def manifest
+      {
+        "schema" => "howsigned/v2",
+        "ipa" => File.basename(ipa),
+        "bundles" => bundles.map { |bundle| { "kind" => bundle.kind.to_s, "path" => bundle.relative_path(root), "binary" => bundle.binary.delete_prefix("#{root}/") } },
+        "verification" => verification,
+        "entitlements" => entitlements,
+        "profiles" => profiles
+      }
+    end
+
+    private
+
+    def collect_plists
+      bundles.filter_map { |bundle| yield bundle }
+    end
+
+    def parse_plist(output)
+      text = output.to_s
+      start = text.index("<?xml") || text.index("<plist")
+      finish = text.index("</plist>")
+      return nil unless start && finish
+
+      Plist.parse_xml(text[start..(finish + "</plist>".length - 1)])
+    end
+  end
+end

data/test/howsigned_test.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "tmpdir"
+require "fileutils"
+require "zip"
+require "howsigned"
+
+class HowsignedTest < Minitest::Test
+  FakeResult = Struct.new(:stdout, :stderr) do
+    def success?
+      true
+    end
+  end
+
+  class PassingRunner
+    def run(*_args, allow_failure: false)
+      FakeResult.new("", "")
+    end
+  end
+
+  def ipa_with(entries)
+    path = File.join(Dir.tmpdir, "howsigned-test-#{Process.pid}-#{rand(1_000_000)}.ipa")
+    Zip::File.open(path, create: true) do |zip|
+      entries.each { |name, content| zip.get_output_stream(name) { |stream| stream.write(content) } }
+    end
+    path
+  end
+
+  def test_scanner_finds_app_extensions_frameworks_and_dylibs
+    Dir.mktmpdir do |root|
+      payload = File.join(root, "Payload")
+      paths = [
+        "Demo.app/Demo",
+        "Demo.app/PlugIns/Share.appex/Share",
+        "Demo.app/Frameworks/Kit.framework/Kit",
+        "Demo.app/Frameworks/libKit.dylib"
+      ]
+      paths.each do |path|
+        FileUtils.mkdir_p(File.dirname(File.join(payload, path)))
+        File.write(File.join(payload, path), "binary")
+      end
+
+      bundles = Howsigned::BundleScanner.new(payload).scan
+      assert_equal %i[app appex dylib framework], bundles.map(&:kind).sort
+      assert_includes bundles.map(&:binary), File.join(payload, "Demo.app/Frameworks/libKit.dylib")
+    end
+  end
+
+  def test_archive_rejects_parent_traversal
+    path = ipa_with("../outside" => "nope")
+    assert_raises(Howsigned::UnsafeArchiveError) { Howsigned::IPAArchive.new(path).extract }
+  ensure
+    FileUtils.rm_f(path) if path
+  end
+
+  def test_archive_rejects_absolute_paths
+    archive = Howsigned::IPAArchive.allocate
+    assert_raises(Howsigned::UnsafeArchiveError) { archive.send(:safe_relative_path, "/tmp/outside") }
+  end
+
+  def test_runner_preserves_arguments_without_shell_interpolation
+    runner = Howsigned::CommandRunner.new(executable_finder: ->(_name) { RbConfig.ruby })
+    result = runner.run("ignored", "-e", "puts ARGV.first", "hello world")
+    assert result.success?
+    assert_equal "hello world", result.stdout.strip
+  end
+
+  def test_auditor_generates_manifest_from_synthetic_ipa
+    path = ipa_with(
+      "Payload/Demo.app/Demo" => "binary",
+      "Payload/Demo.app/Info.plist" => "plist"
+    )
+    manifest = nil
+    Howsigned::Auditor.new(path, runner: PassingRunner.new).with_extracted_ipa do |auditor|
+      manifest = auditor.manifest
+    end
+
+    assert_equal "howsigned/v2", manifest["schema"]
+    assert_equal "app", manifest["bundles"].first["kind"]
+    assert_equal true, manifest["verification"].first["valid"]
+  ensure
+    FileUtils.rm_f(path) if path
+  end
+end

metadata

@@ -1,78 +1,77 @@
 --- !ruby/object:Gem::Specification
 name: howsigned
 version: !ruby/object:Gem::Version
-  version: 0.0.9
+  version: 2.0.0
 platform: ruby
 authors:
 - Michael MacDougall
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-11-16 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: plist
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.7'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.1'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
-- !ruby/object:Gem::Dependency
-  name: commander
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: '3.0'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '4.3'
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '4.3'
-description: Utility to see how the contained binaries within an .ipa are signed
-email: mmacdougall@etsy.com
+        version: '4'
+description: Audit code signing, entitlements, and provisioning profiles inside Apple
+  IPA archives
+email: opensource@macdougall.dev
 executables:
 - howsigned
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
+- README.md
+- Rakefile
 - bin/howsigned
-- lib/compare.rb
-- lib/contained_binaries_definition.rb
-- lib/entitlements.rb
-- lib/extract_zip.rb
-- lib/profiles.rb
-- lib/validate_ipa.rb
-- lib/verify.rb
+- lib/howsigned.rb
+- lib/howsigned/version.rb
+- test/howsigned_test.rb
 homepage: https://github.com/macdoum1/howsigned
 licenses:
 - MIT
 metadata:
   source_code_uri: https://github.com/macdoum1/howsigned
-post_install_message: 
+  rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -80,16 +79,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.11
-signing_key: 
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
-summary: Utility to see how the contained binaries within an .ipa are signed
+summary: Inspect and compare the signing state of IPA bundles
 test_files: []

data/lib/compare.rb

@@ -1,49 +0,0 @@
-require 'plist'
-require 'zip'
-require 'zip/filesystem'
-require 'validate_ipa'
-require 'extract_zip'
-require 'entitlements'
-require 'profiles'
-
-def write_plist_to_path(plist, path)
-	File.write(path, plist)
-end
-
-command :compare do |c|
-  c.syntax = 'howsigned compare [.ipa file] [.ipa file]'
-  c.description = 'Prints diff of entitlements of specified .ipa files in plist format, nothing if entitlements are identical'
-  c.action do |args, options|
-	first_file = validate_ipa(args.pop)
-	second_file = validate_ipa(args.pop)
-
-	first_tempdir = ::File.new(Dir.mktmpdir)
-	extract_zip(first_file, first_tempdir)
-
-	second_tempdir = ::File.new(Dir.mktmpdir)
-	extract_zip(second_file, second_tempdir)
-
-	first_entitlements = get_entitlements(first_tempdir.path)
-	second_entitlements = get_entitlements(second_tempdir.path)
-
-	first_profiles = get_profiles(first_tempdir.path, false)
-	second_profiles = get_profiles(second_tempdir.path, false)
-
-	temp_plist_dir = ::File.new(Dir.mktmpdir).path
-	write_plist_to_path(first_entitlements, "#{temp_plist_dir}/entitlements1.plist")
-	write_plist_to_path(second_entitlements, "#{temp_plist_dir}/entitlements2.plist")
-	write_plist_to_path(first_profiles, "#{temp_plist_dir}/profiles1.plist")
-	write_plist_to_path(second_profiles, "#{temp_plist_dir}/profiles2.plist")
-
-	entitlements_diff = `diff "#{temp_plist_dir}/entitlements1.plist" "#{temp_plist_dir}/entitlements2.plist"`
-	profiles_diff = `diff "#{temp_plist_dir}/profiles1.plist" "#{temp_plist_dir}/profiles2.plist"`
-
-	if (entitlements_diff.length > 0)
-		puts entitlements_diff
-	end
-
-	if (profiles_diff.length > 0)
-		puts profiles_diff
-	end
-  end
-end

data/lib/contained_binaries_definition.rb

@@ -1,4 +0,0 @@
-def contained_binary_extensions
-	return ["appex",
-			"app"]
-end

data/lib/entitlements.rb

@@ -1,51 +0,0 @@
-# Heavily inspired by Shenzhen's `ipa info`
-# https://github.com/nomad/shenzhen/blob/master/lib/shenzhen/commands/info.rb
-
-require 'plist'
-require 'zip'
-require 'zip/filesystem'
-require 'validate_ipa'
-require 'extract_zip'
-require 'contained_binaries_definition'
-
-def append_entitlements(path, entitlements_hash)
-	index = 0
-	Dir.glob(path) do |file|
-		entitlements = `codesign -d --entitlements :- "#{file}" 2>&1`
-		plist_entitlements = Plist::parse_xml(entitlements)
-		if (plist_entitlements)
-			application_identifier = plist_entitlements["application-identifier"] ? plist_entitlements["application-identifier"] : index.to_s
-			entitlements_hash[application_identifier] = plist_entitlements
-			index = index + 1
-		end
-	end
-end
-
-def get_entitlements(tempdir_path)
-	entitlements_hash = Hash.new
-
-	contained_binary_extensions().each { |extension|
-		append_entitlements("#{tempdir_path}/**/*.#{extension}", entitlements_hash)
-	}
-
-	if (entitlements_hash.length == 0)
-		abort "No entitlements found on contained binaries"
-	end
-
-	return entitlements_hash.to_plist
-end
-
-command :entitlements do |c|
-  c.syntax = 'howsigned entitlements [.ipa file]'
-  c.description = 'Prints entitlements of specified .ipa in plist format'
-  c.action do |args, options|
-	file = validate_ipa(args.pop)
-
-	tempdir = ::File.new(Dir.mktmpdir)
-	extract_zip(file, tempdir)
-
-	puts get_entitlements(tempdir.path)
-  end
-end
-
-

data/lib/extract_zip.rb

@@ -1,12 +0,0 @@
-require 'zip'
-
-def extract_zip(file, destination)
-  FileUtils.mkdir_p(destination)
-
-  Zip::File.open(file) do |zip_file|
-    zip_file.each do |f|
-      fpath = File.join(destination, f.name)
-      zip_file.extract(f, fpath) unless File.exist?(fpath)
-    end
-  end
-end

data/lib/profiles.rb

@@ -1,46 +0,0 @@
-require 'plist'
-require 'zip'
-require 'zip/filesystem'
-require 'validate_ipa'
-require 'extract_zip'
-
-def get_profiles(tempdir_path, only_expiration)
-	path = "#{tempdir_path}/**/*.mobileprovision"
-	profiles = Hash.new
-	index = 0
-	Dir.glob(path) do |file|
-		profile = `security cms -D -i "#{file}" 2>&1`
-		plist_profile = Plist::parse_xml(profile)
-		if plist_profile
-			app_id = plist_profile["AppIDName"] ? plist_profile["AppIDName"] : index.to_s
-			if only_expiration
-				profiles[app_id] = plist_profile["ExpirationDate"]
-			else
-				profiles[app_id] = plist_profile
-			end
-			index = index + 1
-		end
-	end
-
-	if (profiles.length == 0)
-		abort "No embedded provisioning profiles found"
-	end
-	return profiles.to_plist
-end
-
-command :profiles do |c|
-  c.syntax = 'howsigned profiles [.ipa file]'
-  c.description = 'Prints embedded profiles of specified .ipa in plist format'
-  c.option '--expiration', "When specified, will print only the expiration dates of embedded profiles"
-  c.action do |args, options|
-	file = validate_ipa(args.pop)
-	only_expiration = options.expiration || false
-
-	tempdir = ::File.new(Dir.mktmpdir)
-	extract_zip(file, tempdir)
-
-	puts get_profiles(tempdir.path, only_expiration)
-  end
-end
-
-

data/lib/validate_ipa.rb

@@ -1,4 +0,0 @@
-def validate_ipa(file)
-	puts "Missing or unspecified .ipa file" and abort unless file and ::File.exist?(file)
-	return file
-end

data/lib/verify.rb

@@ -1,34 +0,0 @@
-require 'plist'
-require 'zip'
-require 'zip/filesystem'
-require 'validate_ipa'
-require 'extract_zip'
-require 'contained_binaries_definition'
-
-def verify_binaries(path)
-	Dir.glob(path) do |file|
-		codesign = `codesign --verify "#{file}" 2>&1`
-		if (!codesign.to_s.empty?)
-			puts codesign
-		end
-	end
-end
-
-command :verify do |c|
-  c.syntax = 'howsigned verify [.ipa file]'
-  c.description = 'Verifies the code signature of all binaries contained within the .ipa, will return nothing if signed correctly'
-  c.action do |args, options|
-	file = validate_ipa(args.pop)
-
-	tempdir = ::File.new(Dir.mktmpdir)
-	extract_zip(file, tempdir)
-
-	entitlements_hash = Hash.new
-
-	contained_binary_extensions().each { |extension|
-		verify_binaries("#{tempdir.path}/**/*.#{extension}")
-	}
-  end
-end
-
-