protool 3.0.0__tar.gz → 3.0.1__tar.gz

{protool-3.0.0 → protool-3.0.1}/PKG-INFO

@@ -1,9 +1,9 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: protool
-Version: 3.0.0
+Version: 3.0.1
 Summary: A tool for dealing with provisioning profiles
-Home-page: https://github.com/Microsoft/protool
 License: MIT
+License-File: LICENSE
 Keywords: provisioning,profiles,apple,ios,xcode,mobileprovision
 Author: Dale Myers
 Author-email: dalemy@microsoft.com
@@ -17,12 +17,14 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Software Development
 Classifier: Topic :: Utilities
 Requires-Dist: pyOpenSSL (>=25.1.0,<26.0.0)
+Project-URL: Homepage, https://github.com/Microsoft/protool
 Project-URL: Repository, https://github.com/Microsoft/protool
 Description-Content-Type: text/markdown
 
@@ -72,6 +74,13 @@ Alternatively, from the command line:
     # Get the raw XML (identical to using `security cms -D -i /path/to/profile`)
     protool decode --profile /path/to/profile
 
+Custom diff commands (`tool_override` in Python or `--tool` on the command line)
+accept an executable and optional arguments, for example `--tool 'diff -u'`.
+Quote executable paths or arguments containing spaces within the command string,
+for example `--tool '"/path with spaces/diff" -u'`. Commands run directly, without
+a shell: pipes, redirection, environment-variable expansion, and command
+substitution are not supported. Profile paths are always passed as literal arguments.
+
 
 # Contributing
 

{protool-3.0.0 → protool-3.0.1}/README.md

@@ -44,6 +44,13 @@ Alternatively, from the command line:
     # Get the raw XML (identical to using `security cms -D -i /path/to/profile`)
     protool decode --profile /path/to/profile
 
+Custom diff commands (`tool_override` in Python or `--tool` on the command line)
+accept an executable and optional arguments, for example `--tool 'diff -u'`.
+Quote executable paths or arguments containing spaces within the command string,
+for example `--tool '"/path with spaces/diff" -u'`. Commands run directly, without
+a shell: pipes, redirection, environment-variable expansion, and command
+substitution are not supported. Profile paths are always passed as literal arguments.
+
 
 # Contributing
 

{protool-3.0.0 → protool-3.0.1}/protool/__init__.py

@@ -8,7 +8,7 @@ import copy
 import datetime
 import os
 import plistlib
-import shutil
+import shlex
 import subprocess
 import sys
 import tempfile
@@ -201,9 +201,9 @@ class ProvisioningProfile:
         if not os.path.exists(self.file_path):
             raise Exception(f"File does not exist: {self.file_path}")
 
-        security_cmd = f'security cms -D -i "{self.file_path}" 2> /dev/null'
+        security_cmd = ["security", "cms", "-D", "-i", self.file_path]
         return subprocess.check_output(
-            security_cmd, universal_newlines=True, shell=True
+            security_cmd, universal_newlines=True, stderr=subprocess.DEVNULL
         ).strip()
 
 
@@ -239,14 +239,17 @@ def diff(
     ignore_keys: list[str] | None = None,
     tool_override: str | None = None,
 ) -> str:
-    """Diff two provisioning profiles."""
+    """Diff two provisioning profiles without shell expansion of tool_override."""
 
     # pylint: disable=too-many-locals
 
     if tool_override is None:
-        diff_tool = "opendiff"
+        diff_command = ["opendiff"]
     else:
-        diff_tool = tool_override
+        diff_command = shlex.split(tool_override)
+
+    if not diff_command or not diff_command[0]:
+        raise ValueError("Diff command must include an executable")
 
     profile_a = ProvisioningProfile(a_path, sort_keys=sort_keys)
     profile_b = ProvisioningProfile(b_path, sort_keys=sort_keys)
@@ -271,31 +274,26 @@ def diff(
         a_xml = plistlib.dumps(a_dict).decode("utf-8")
         b_xml = plistlib.dumps(b_dict).decode("utf-8")
 
-    temp_dir = tempfile.mkdtemp()
-
-    a_temp_path = os.path.join(temp_dir, profile_a.file_name)
-    b_temp_path = os.path.join(temp_dir, profile_b.file_name)
-
-    with open(a_temp_path, "w", encoding="utf-8") as temp_profile:
-        temp_profile.write(a_xml)
+    with tempfile.TemporaryDirectory() as temp_dir:
+        a_temp_path = os.path.join(temp_dir, profile_a.file_name)
+        b_temp_path = os.path.join(temp_dir, profile_b.file_name)
 
-    with open(b_temp_path, "w", encoding="utf-8") as temp_profile:
-        temp_profile.write(b_xml)
+        with open(a_temp_path, "w", encoding="utf-8") as temp_profile:
+            temp_profile.write(a_xml)
 
-    # We deliberately don't wrap the tool so that arguments work as well
-    diff_command = f'{diff_tool} "{a_temp_path}" "{b_temp_path}"'
+        with open(b_temp_path, "w", encoding="utf-8") as temp_profile:
+            temp_profile.write(b_xml)
 
-    try:
-        diff_contents = subprocess.check_output(
-            diff_command, universal_newlines=True, shell=True
-        ).strip()
-    except subprocess.CalledProcessError as ex:
-        # Diff tools usually return a non-0 exit code if there are differences,
-        # so we just swallow this error
-        diff_contents = ex.output
+        diff_command.extend([a_temp_path, b_temp_path])
 
-    # Cleanup
-    shutil.rmtree(temp_dir)
+        try:
+            diff_contents = subprocess.check_output(
+                diff_command, universal_newlines=True
+            ).strip()
+        except subprocess.CalledProcessError as ex:
+            # Diff tools usually return a non-0 exit code if there are differences,
+            # so we just swallow this error
+            diff_contents = ex.output
 
     return diff_contents
 

{protool-3.0.0 → protool-3.0.1}/protool/command_line.py

@@ -131,7 +131,7 @@ def _handle_arguments() -> int:
         dest="tool",
         action="store",
         default=None,
-        help="Specify a diff command to use. It should take two file paths as the final two arguments. Defaults to opendiff",  # pylint: disable=line-too-long
+        help="Specify a diff executable with optional quoted arguments (no shell expansion). It should take two file paths as the final two arguments. Defaults to opendiff",  # pylint: disable=line-too-long
     )
 
     diff_parser.add_argument(
@@ -177,7 +177,7 @@ def _handle_arguments() -> int:
         dest="tool",
         action="store",
         default=None,
-        help="Specify a diff command to use. It should take two file paths as the final two arguments. Defaults to opendiff",  # pylint: disable=line-too-long
+        help="Specify a diff executable with optional quoted arguments (no shell expansion). It should take two file paths as the final two arguments. Defaults to opendiff",  # pylint: disable=line-too-long
     )
 
     gitdiff_parser.add_argument(

{protool-3.0.0 → protool-3.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "protool"
-version = "3.0.0"
+version = "3.0.1"
 description = "A tool for dealing with provisioning profiles"
 
 license = "MIT"
@@ -46,7 +46,7 @@ pyOpenSSL = "^25.1.0"
 black = "^26.1.0"
 mypy = "^1.19.1"
 pylint = "^4.0.4"
-pytest = "^9.0.2"
+pytest = "^9.0.3"
 pytest-cov = "^7.0.0"
 types-pyOpenSSL = "^24.1.0.20240722"