forked from akai/readest
Huang Xin
81802a7c72
The App Store export re-sign (xcodebuild -exportArchive, automatic signing) stripped com.apple.security.application-groups from the ReadestWidget and ShareExtension binaries because both targets set CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION: YES. The provisioning profiles and source entitlements both grant the group, but the signed extension binaries did not, so the widget read an empty snapshot from the shared App Group container and showed only the placeholder book icon. Dev builds were unaffected. Remove the flag from both extension targets (the main app already ships the group correctly without it) so signing uses the exact CODE_SIGN_ENTITLEMENTS content. Add scripts/verify-ios-appstore-entitlements.sh and run it from release-ios-appstore.sh before upload so a stripped App Group fails the release instead of shipping a dead widget. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
1.7 KiB
Bash
Executable File
50 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Verify the App Store IPA's app extensions carry the App Group entitlement.
|
|
#
|
|
# group.com.bilingify.readest is how the main app hands the reading-widget
|
|
# snapshot (and the share extension its shared state) to its extensions via the
|
|
# shared App Group container. Automatic App Store signing re-signs embedded
|
|
# extensions during `xcodebuild -exportArchive`; if a target sets
|
|
# CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION=YES, that re-sign silently strips
|
|
# com.apple.security.application-groups from the extension binary even though
|
|
# the provisioning profile and source .entitlements both grant it. The widget
|
|
# then reads an empty snapshot and shows only a placeholder book icon, with no
|
|
# build error. This guard fails the release before upload so it can't ship
|
|
# broken again.
|
|
set -euo pipefail
|
|
|
|
IPA="${1:-src-tauri/gen/apple/build/arm64/Readest.ipa}"
|
|
GROUP="group.com.bilingify.readest"
|
|
EXTS=(ReadestWidget ShareExtension)
|
|
|
|
if [ ! -f "$IPA" ]; then
|
|
echo "verify-ios-appstore-entitlements: IPA not found at $IPA" >&2
|
|
exit 1
|
|
fi
|
|
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
unzip -q "$IPA" -d "$WORK"
|
|
APP="$WORK/Payload/Readest.app"
|
|
|
|
fail=0
|
|
for ext in "${EXTS[@]}"; do
|
|
appex="$APP/PlugIns/$ext.appex"
|
|
if codesign -d --entitlements :- "$appex" 2>/dev/null | grep -q "$GROUP"; then
|
|
echo "OK $ext.appex carries $GROUP"
|
|
else
|
|
echo "FAIL $ext.appex is MISSING $GROUP (App Group access broken)"
|
|
fail=1
|
|
fi
|
|
done
|
|
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo "" >&2
|
|
echo "App Group entitlement missing from an extension binary. Do NOT set" >&2
|
|
echo "CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION on extension targets in" >&2
|
|
echo "src-tauri/gen/apple/project.yml." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "All app extensions carry the App Group entitlement."
|