mysigner 0.1.2 → 0.1.4

data/lib/mysigner/build/android_executor.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+
+require 'English'
 require 'fileutils'
 require 'tempfile'
 
@@ -20,7 +23,8 @@ module Mysigner
       #   - key_alias: Key alias in keystore
       #   - key_password: Key password (defaults to keystore_password)
       #   - version_code: Override version code (passed via gradle property)
-      def build_aab!(variant: 'release', keystore_path: nil, keystore_password: nil, key_alias: nil, key_password: nil, version_code: nil)
+      def build_aab!(variant: 'release', keystore_path: nil, keystore_password: nil, key_alias: nil, key_password: nil,
+                     version_code: nil)
         @variant = variant
         @keystore_path = keystore_path
         @keystore_password = keystore_password
@@ -34,13 +38,11 @@ module Mysigner
         # Build
         success = run_gradle_build(task)
 
-        unless success
-          raise BuildError, "Android build failed. Check output above for errors."
-        end
+        raise BuildError, 'Android build failed. Check output above for errors.' unless success
 
         # Find output AAB
         aab_path = find_aab_output(variant)
-        
+
         unless aab_path && File.exist?(aab_path)
           raise BuildError, "Build reported success but AAB not found. Expected at: #{@parser.aab_output_path(variant)}"
         end
@@ -63,13 +65,11 @@ module Mysigner
         # Build
         success = run_gradle_build(task)
 
-        unless success
-          raise BuildError, "Android build failed. Check output above for errors."
-        end
+        raise BuildError, 'Android build failed. Check output above for errors.' unless success
 
         # Find output APK
         apk_path = find_apk_output(variant)
-        
+
         unless apk_path && File.exist?(apk_path)
           raise BuildError, "Build reported success but APK not found. Expected at: #{@parser.apk_output_path(variant)}"
         end
@@ -91,15 +91,27 @@ module Mysigner
         # Handle framework-specific pre-build steps
         run_pre_build_steps
 
-        # Build command with signing properties
-        cmd = build_gradle_command(task)
+        # Phase 0: inject signing via Gradle init-script + env vars. Passwords
+        # never appear in argv (no -Pandroid.injected.signing.*=PLAINTEXT).
+        injector = nil
+        if @keystore_path && File.exist?(@keystore_path)
+          require 'mysigner/signing/gradle_signing_injector'
+          injector = Mysigner::Signing::GradleSigningInjector.new
+          @signing_init_script_path = injector.write_init_script!
+        end
 
-        # Execute build
-        execute_with_output(cmd)
+        begin
+          # Build command with signing properties referencing the init script
+          cmd = build_gradle_command(task)
+          execute_with_output(cmd)
+        ensure
+          injector&.cleanup!
+          @signing_init_script_path = nil
+        end
       end
 
       def ensure_java_home!
-        java_home = ENV['JAVA_HOME']
+        java_home = ENV.fetch('JAVA_HOME', nil)
 
         # Check if JAVA_HOME is set and valid
         if java_home && !java_home.empty? && Dir.exist?(java_home)
@@ -112,8 +124,8 @@ module Mysigner
             ENV['JAVA_HOME'] = detected
           elsif java_home && !java_home.empty?
             raise BuildError, "JAVA_HOME is set to invalid directory: #{java_home}\n" \
-                             "Run 'mysigner doctor' to fix, or set JAVA_HOME manually:\n" \
-                             "  export JAVA_HOME=$(/usr/libexec/java_home -v 17)"
+                              "Run 'mysigner doctor' to fix, or set JAVA_HOME manually:\n  " \
+                              'export JAVA_HOME=$(/usr/libexec/java_home -v 17)'
           end
         end
 
@@ -122,12 +134,10 @@ module Mysigner
       end
 
       def ensure_android_home!
-        android_home = ENV['ANDROID_HOME'] || ENV['ANDROID_SDK_ROOT']
+        android_home = ENV['ANDROID_HOME'] || ENV.fetch('ANDROID_SDK_ROOT', nil)
 
         # Check if already valid
-        if android_home && !android_home.empty? && Dir.exist?(android_home)
-          return
-        end
+        return if android_home && !android_home.empty? && Dir.exist?(android_home)
 
         # Try to detect Android SDK
         detected = detect_android_home
@@ -137,8 +147,8 @@ module Mysigner
           ENV['ANDROID_SDK_ROOT'] = detected
         else
           raise BuildError, "Android SDK not found.\n" \
-                           "Run 'mysigner doctor' to diagnose, or set ANDROID_HOME:\n" \
-                           "  export ANDROID_HOME=~/Library/Android/sdk"
+                            "Run 'mysigner doctor' to diagnose, or set ANDROID_HOME:\n  " \
+                            'export ANDROID_HOME=~/Library/Android/sdk'
         end
       end
 
@@ -190,7 +200,7 @@ module Mysigner
         case @project_info[:framework]
         when :capacitor
           # Capacitor: sync before build
-          puts "🔄 Syncing Capacitor..."
+          puts '🔄 Syncing Capacitor...'
           Dir.chdir(@project_info[:directory]) do
             system('npx cap sync android > /dev/null 2>&1')
           end
@@ -199,14 +209,14 @@ module Mysigner
           if File.exist?(File.join(@project_info[:directory], 'node_modules'))
             # Dependencies already installed
           else
-            puts "📦 Installing npm dependencies..."
+            puts '📦 Installing npm dependencies...'
             Dir.chdir(@project_info[:directory]) do
               system('npm install > /dev/null 2>&1') || system('yarn install > /dev/null 2>&1')
             end
           end
         when :flutter
           # Flutter: ensure dependencies are fetched
-          puts "📦 Getting Flutter dependencies..."
+          puts '📦 Getting Flutter dependencies...'
           Dir.chdir(@project_info[:directory]) do
             system('flutter pub get > /dev/null 2>&1')
           end
@@ -218,45 +228,57 @@ module Mysigner
         gradle_cmd = @parser.gradle_command
 
         cmd_parts = []
-        
+
         # Export JAVA_HOME if we detected/fixed it
-        java_home = ENV['JAVA_HOME']
+        java_home = ENV.fetch('JAVA_HOME', nil)
         if java_home && Dir.exist?(java_home)
           cmd_parts << "export JAVA_HOME=#{shell_escape(java_home)}"
-          cmd_parts << "&&"
+          cmd_parts << '&&'
         end
 
         # Export ANDROID_HOME if we detected/fixed it
-        android_home = ENV['ANDROID_HOME']
+        android_home = ENV.fetch('ANDROID_HOME', nil)
         if android_home && Dir.exist?(android_home)
           cmd_parts << "export ANDROID_HOME=#{shell_escape(android_home)}"
-          cmd_parts << "&&"
+          cmd_parts << '&&'
           cmd_parts << "export ANDROID_SDK_ROOT=#{shell_escape(android_home)}"
-          cmd_parts << "&&"
+          cmd_parts << '&&'
         end
-        
+
+        # Phase 0: export signing env vars inline so they're only visible to
+        # the child process, not in argv. The Gradle init script below reads
+        # MYSIGNER_STORE_FILE / MYSIGNER_STORE_PASSWORD / MYSIGNER_KEY_ALIAS /
+        # MYSIGNER_KEY_PASSWORD and configures signingConfigs.release.
+        if @keystore_path && File.exist?(@keystore_path) && @signing_init_script_path
+          cmd_parts << "export MYSIGNER_STORE_FILE=#{shell_escape(File.absolute_path(@keystore_path))}"
+          cmd_parts << '&&'
+          cmd_parts << "export MYSIGNER_STORE_PASSWORD=#{shell_escape(@keystore_password)}" if @keystore_password
+          cmd_parts << '&&' if @keystore_password
+          cmd_parts << "export MYSIGNER_KEY_ALIAS=#{shell_escape(@key_alias)}" if @key_alias
+          cmd_parts << '&&' if @key_alias
+          cmd_parts << "export MYSIGNER_KEY_PASSWORD=#{shell_escape(@key_password)}" if @key_password
+          cmd_parts << '&&' if @key_password
+        end
+
         # Change to android directory and run gradle
         cmd_parts << "cd #{shell_escape(android_dir)}"
-        cmd_parts << "&&"
+        cmd_parts << '&&'
         cmd_parts << gradle_cmd
-        cmd_parts << task
 
-        # Add signing properties if provided
-        if @keystore_path && File.exist?(@keystore_path)
-          cmd_parts << "-Pandroid.injected.signing.store.file=#{shell_escape(File.absolute_path(@keystore_path))}"
-          cmd_parts << "-Pandroid.injected.signing.store.password=#{shell_escape(@keystore_password)}" if @keystore_password
-          cmd_parts << "-Pandroid.injected.signing.key.alias=#{shell_escape(@key_alias)}" if @key_alias
-          cmd_parts << "-Pandroid.injected.signing.key.password=#{shell_escape(@key_password)}" if @key_password
+        # Reference the init script (contains the signing-config override)
+        if @signing_init_script_path
+          cmd_parts << '--init-script'
+          cmd_parts << shell_escape(@signing_init_script_path)
         end
-        
+
+        cmd_parts << task
+
         # Add version code override if provided (no file modification needed)
-        if @version_code
-          cmd_parts << "-PversionCode=#{@version_code}"
-        end
+        cmd_parts << "-PversionCode=#{@version_code}" if @version_code
 
         # Standard build options
-        cmd_parts << "--no-daemon"  # Avoid daemon issues in CI
-        cmd_parts << "-q"           # Quiet mode (less noise)
+        cmd_parts << '--no-daemon'  # Avoid daemon issues in CI
+        cmd_parts << '-q'           # Quiet mode (less noise)
 
         cmd_parts.join(' ')
       end
@@ -266,29 +288,29 @@ module Mysigner
         gradle_cmd = @parser.gradle_command
 
         exports = []
-        java_home = ENV['JAVA_HOME']
+        java_home = ENV.fetch('JAVA_HOME', nil)
         exports << "export JAVA_HOME=#{shell_escape(java_home)}" if java_home && Dir.exist?(java_home)
-        
-        android_home = ENV['ANDROID_HOME']
+
+        android_home = ENV.fetch('ANDROID_HOME', nil)
         if android_home && Dir.exist?(android_home)
           exports << "export ANDROID_HOME=#{shell_escape(android_home)}"
           exports << "export ANDROID_SDK_ROOT=#{shell_escape(android_home)}"
         end
-        
-        export_str = exports.any? ? exports.join(' && ') + ' && ' : ''
+
+        export_str = exports.any? ? "#{exports.join(' && ')} && " : ''
         cmd = "#{export_str}cd #{shell_escape(android_dir)} && #{gradle_cmd} #{task} --no-daemon -q"
         system(cmd)
       end
 
       def execute_with_output(cmd)
         puts "🏗️  Running: gradle #{@variant}..."
-        puts ""
+        puts ''
 
         # Run command and capture output in real-time
         IO.popen("#{cmd} 2>&1", 'r') do |io|
           io.each_line do |line|
             next if line.strip.empty?
-            
+
             # Show errors and warnings
             if line.include?('FAILURE') || line.include?('ERROR') || line.include?('error:')
               puts line
@@ -304,14 +326,14 @@ module Mysigner
           end
         end
 
-        puts "" # New line after dots
+        puts '' # New line after dots
 
-        $?.success?
+        $CHILD_STATUS.success?
       end
 
       def find_aab_output(variant)
         android_dir = @parser.android_directory
-        
+
         # Search patterns for AAB files
         patterns = [
           File.join(android_dir, "app/build/outputs/bundle/#{variant}/*.aab"),
@@ -332,7 +354,7 @@ module Mysigner
 
       def find_apk_output(variant)
         android_dir = @parser.android_directory
-        
+
         # Search patterns for APK files
         patterns = [
           File.join(android_dir, "app/build/outputs/apk/#{variant}/*.apk"),
@@ -353,14 +375,12 @@ module Mysigner
 
       def shell_escape(str)
         return "''" if str.nil? || str.empty?
-        
+
         # If string contains no special characters, return as-is
-        if str =~ /\A[a-zA-Z0-9_.\-\/]+\z/
-          return str
-        end
-        
+        return str if str =~ %r{\A[a-zA-Z0-9_.\-/]+\z}
+
         # Otherwise, quote it
-        "'" + str.gsub("'", "'\\''") + "'"
+        "'#{str.gsub("'", "'\\''")}'"
       end
     end
   end

data/lib/mysigner/build/android_parser.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Mysigner
   module Build
     class AndroidParser
@@ -57,42 +59,41 @@ module Mysigner
       # Get all build types (debug, release, etc.)
       def build_types
         types = []
-        
+
         # Match buildTypes block
         if @gradle_content =~ /buildTypes\s*\{(.*?)\n\s*\}/m
-          block = $1
+          block = ::Regexp.last_match(1)
           # Find all type names (e.g., "release {" or "debug {")
           block.scan(/(\w+)\s*\{/) do |match|
             types << match[0] unless %w[debug release].include?(match[0]) && types.include?(match[0])
             types << match[0]
           end
         end
-        
+
         # Default build types if none found
-        types = ['debug', 'release'] if types.empty?
+        types = %w[debug release] if types.empty?
         types.uniq
       end
 
       # Get all product flavors
       def product_flavors
         flavors = []
-        
+
         if @gradle_content =~ /productFlavors\s*\{(.*?)\n\s{4}\}/m
-          block = $1
+          block = ::Regexp.last_match(1)
           block.scan(/(\w+)\s*\{/) do |match|
             flavors << match[0]
           end
         end
-        
+
         flavors
       end
 
       # Get signing config for a build type
       def signing_config(build_type = 'release')
         # Look for signingConfig in the build type block
-        if @gradle_content =~ /#{build_type}\s*\{[^}]*signingConfig\s*(?:=\s*)?signingConfigs\.(\w+)/m
-          return $1
-        end
+        return ::Regexp.last_match(1) if @gradle_content =~ /#{build_type}\s*\{[^}]*signingConfig\s*(?:=\s*)?signingConfigs\.(\w+)/m
+
         nil
       end
 
@@ -104,30 +105,28 @@ module Mysigner
       # Get signing configs defined in the project
       def signing_configs
         configs = []
-        
+
         if @gradle_content =~ /signingConfigs\s*\{(.*?)\n\s{4}\}/m
-          block = $1
+          block = ::Regexp.last_match(1)
           block.scan(/(\w+)\s*\{/) do |match|
             configs << match[0]
           end
         end
-        
+
         configs
       end
 
       # Get keystore path from signing config
       def keystore_path(config_name = 'release')
-        if @gradle_content =~ /#{config_name}\s*\{[^}]*storeFile\s*(?:=\s*)?(?:file\()?"?([^")\n]+)"?\)?/m
-          return $1
-        end
+        return ::Regexp.last_match(1) if @gradle_content =~ /#{config_name}\s*\{[^}]*storeFile\s*(?:=\s*)?(?:file\()?"?([^")\n]+)"?\)?/m
+
         nil
       end
 
       # Get keystore alias from signing config
       def keystore_alias(config_name = 'release')
-        if @gradle_content =~ /#{config_name}\s*\{[^}]*keyAlias\s*(?:=\s*)?["']?([^"'\n]+)["']?/m
-          return $1.strip
-        end
+        return ::Regexp.last_match(1).strip if @gradle_content =~ /#{config_name}\s*\{[^}]*keyAlias\s*(?:=\s*)?["']?([^"'\n]+)["']?/m
+
         nil
       end
 
@@ -137,15 +136,11 @@ module Mysigner
         strings_path = File.join(android_directory, 'app/src/main/res/values/strings.xml')
         if File.exist?(strings_path)
           content = File.read(strings_path)
-          if content =~ /<string\s+name="app_name"[^>]*>([^<]+)<\/string>/
-            return $1
-          end
+          return ::Regexp.last_match(1) if content =~ %r{<string\s+name="app_name"[^>]*>([^<]+)</string>}
         end
 
         # Fallback to manifest label
-        if @manifest_content && @manifest_content =~ /android:label="([^"]+)"/
-          return $1
-        end
+        return ::Regexp.last_match(1) if @manifest_content && @manifest_content =~ /android:label="([^"]+)"/
 
         # Fallback to directory name
         File.basename(@project_info[:directory])
@@ -217,7 +212,7 @@ module Mysigner
 
       def read_gradle_file
         gradle_path = @project_info[:app_build_gradle]
-        
+
         unless gradle_path && File.exist?(gradle_path)
           # Try to find it
           android_dir = android_directory
@@ -228,12 +223,14 @@ module Mysigner
         end
 
         return '' unless File.exist?(gradle_path)
+
         File.read(gradle_path)
       end
 
       def read_manifest_file
         manifest_path = File.join(android_directory, 'app/src/main/AndroidManifest.xml')
         return nil unless File.exist?(manifest_path)
+
         File.read(manifest_path)
       end
 
@@ -241,7 +238,7 @@ module Mysigner
         # Handle both Groovy and Kotlin DSL syntax
         # Groovy: applicationId "com.example.app" or applicationId = "com.example.app"
         # Kotlin: applicationId = "com.example.app"
-        
+
         patterns = [
           /#{property}\s*=?\s*["']([^"']+)["']/,
           /#{property}\s+["']([^"']+)["']/,
@@ -250,9 +247,7 @@ module Mysigner
         ]
 
         patterns.each do |pattern|
-          if @gradle_content =~ pattern
-            return $1
-          end
+          return ::Regexp.last_match(1) if @gradle_content =~ pattern
         end
 
         nil
@@ -260,11 +255,9 @@ module Mysigner
 
       def extract_package_from_manifest
         return nil unless @manifest_content
-        
-        if @manifest_content =~ /package="([^"]+)"/
-          return $1
-        end
-        
+
+        return ::Regexp.last_match(1) if @manifest_content =~ /package="([^"]+)"/
+
         nil
       end
 
@@ -272,19 +265,19 @@ module Mysigner
         # Check for app.json in project root
         project_dir = @project_info[:directory]
         app_json_path = File.join(project_dir, 'app.json')
-        
+
         return nil unless File.exist?(app_json_path)
-        
+
         begin
           require 'json'
           config = JSON.parse(File.read(app_json_path))
-          
+
           # Expo config can be nested under 'expo' key or at root
           expo_config = config['expo'] || config
-          
+
           # Get Android package name
           expo_config.dig('android', 'package')
-        rescue
+        rescue StandardError
           nil
         end
       end

data/lib/mysigner/build/configurator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Mysigner
   module Build
     class Configurator
@@ -15,7 +17,7 @@ module Mysigner
         target = @parser.find_target(target_name)
         bundle_id = @parser.bundle_id(target_name, configuration)
 
-        raise "Bundle ID not found in project" if bundle_id.to_s.empty?
+        raise 'Bundle ID not found in project' if bundle_id.to_s.empty?
 
         # Map build type to profile type
         profile_type = map_build_type_to_profile_type(build_type)
@@ -30,21 +32,21 @@ module Mysigner
         # Set manual signing
         config.build_settings['CODE_SIGN_STYLE'] = 'Manual'
         config.build_settings['PROVISIONING_PROFILE_SPECIFIER'] = profile['name']
-        
+
         # Set code sign identity based on type
         code_sign_identity = case build_type
-        when :development
-          'iPhone Developer'
-        else
-          'iPhone Distribution'
-        end
+                             when :development
+                               'iPhone Developer'
+                             else
+                               'iPhone Distribution'
+                             end
         config.build_settings['CODE_SIGN_IDENTITY'] = code_sign_identity
 
         # Ensure development team is set
         team_id = @parser.team_id(target_name, configuration)
-        if team_id.to_s.empty?
+        if team_id.to_s.empty? && profile['team_id']
           # Try to get from profile or use organization default
-          config.build_settings['DEVELOPMENT_TEAM'] = profile['team_id'] if profile['team_id']
+          config.build_settings['DEVELOPMENT_TEAM'] = profile['team_id']
         end
 
         # Save project
@@ -93,9 +95,9 @@ module Mysigner
               type: profile_type
             }
           )
-          
+
           return response[:profile] if response[:profile]
-        rescue Mysigner::NotFoundError => e
+        rescue Mysigner::NotFoundError
           # Profile matching returned no match, fall through to manual search
         end
 
@@ -110,11 +112,11 @@ module Mysigner
         )
 
         profiles = response[:profiles] || []
-        
+
         if profiles.empty?
-          raise ProfileNotFoundError, 
-            "No active #{profile_type} profile found for bundle ID '#{bundle_id}'. " \
-            "Create one at the My Signer dashboard or run 'mysigner profiles'"
+          raise ProfileNotFoundError,
+                "No active #{profile_type} profile found for bundle ID '#{bundle_id}'. " \
+                "Create one at the My Signer dashboard or run 'mysigner profiles'"
         end
 
         # Return the profile expiring furthest in the future
@@ -123,4 +125,3 @@ module Mysigner
     end
   end
 end
-