Implement Sign + Sideload in super-sideloader (65cd6c1) - apple-crates · Git

Implement Sign + Sideload in super-sideloader

Dadoum commited on 2026-07-09 23:34:01
Showing 40 changed files, with 8859 additions and 273 deletions.

Cargo.lock 154eb38..4444e09
apple-codesign-quick/Cargo.toml 42e2962..b77cb26
apple-codesign-quick/assets/AppleIncRootCertificate.cer 0000000..8a9ff24
apple-codesign-quick/assets/AppleWWDRCAG3.cer 0000000..32f96f8
apple-codesign-quick/src/bundle.rs 0000000..5c8c339
apple-codesign-quick/src/error.rs 0000000..7c740ce
apple-codesign-quick/src/file_bytes.rs 0000000..1fd9fa1
apple-codesign-quick/src/lib.rs 0000000..b0e806d
apple-codesign-quick/src/macho.rs 0000000..08e7b54
apple-codesign-quick/src/main.rs caf8f77..d3cc660
apple-codesign-quick/src/provisioning.rs 0000000..f4c3677
apple-codesign-quick/src/rustcrypto_cms.rs 0000000..d57c897
apple-codesign-quick/src/signature.rs 0000000..175ec7f
super-sideloader/Cargo.toml dbe5264..f1b175e
super-sideloader/src/app/effects.rs 604f529..554a0d1
super-sideloader/src/app/entitlements.rs 67f98bb..23c050a
super-sideloader/src/app/models.rs e941be8..179dd4a
super-sideloader/src/app/preferences.rs f155549..06ba9ea
super-sideloader/src/app/selection.rs 351f804..f50c754
super-sideloader/src/app/state.rs 7715980..d7e6faa
super-sideloader/src/app/view_models.rs 8c1061e..74ef3cc
super-sideloader/src/backend/developer/accounts.rs d90365a..51f4023
super-sideloader/src/backend/developer/cache.rs 41ccf31..27df5a4
super-sideloader/src/backend/developer/certificates.rs 6ce94dc..c44917a
super-sideloader/src/backend/developer/keychain.rs 7cba587..d2de359
super-sideloader/src/backend/developer/repository.rs abd7c97..3314ac1
super-sideloader/src/backend/developer/service.rs 103c4fa..7b36493
super-sideloader/src/backend/device.rs e092aa0..7be6c72
super-sideloader/src/backend/error.rs aafcb66..f705764
super-sideloader/src/backend/icon.rs 0000000..f035723
super-sideloader/src/backend/ipa.rs 17b8ca5..2c1f4a4
super-sideloader/src/backend/mod.rs 1209633..666552a
super-sideloader/src/domain/developer.rs b9f60c8..29f5c57
super-sideloader/src/domain/device.rs 085dfab..665ea94
super-sideloader/src/domain/ipa.rs a7566ae..aa096a1
super-sideloader/src/domain/mod.rs f36ddcd..315dfbe
super-sideloader/src/ui/main_view.rs 48557c9..7780c7a
super-sideloader/src/ui/settings.rs b777973..8623252
super-sideloader/src/ui/settings/app_view.rs ded2460..36d74c1
super-sideloader/src/ui/settings/developer_view.rs ec6001a..70d3450

Cargo.lock

@@ -3544,7 +3544,9 @@ version = "0.1.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48e95040e91503e7425835843e5e985ab1ea440db9b965972021e7b845c2a6ae"
 dependencies = [
+ "async_zip",
  "base64",
+ "chrono",
  "futures",
  "libc",
  "plist",
@@ -7084,12 +7086,15 @@ dependencies = [
  "adi",
  "adid-proxy",
  "android-coreadi",
+ "apple-codesign",
  "async_zip",
  "chrono",
  "core-foundation 0.10.0",
+ "crc32fast",
  "directories",
  "dlopen2",
  "env_logger",
+ "flate2",
  "futures",
  "futures-lite 2.6.1",
  "gpui",
@@ -7097,20 +7102,24 @@ dependencies = [
  "gpui_platform",
  "grandslam",
  "idevice",
+ "image",
  "keyring",
  "libc",
  "library-coreadi",
  "log",
  "ouroboros",
+ "pem-rfc7468",
  "plist",
  "rand 0.10.2",
  "reqwest",
  "serde",
  "sha1 0.11.0",
+ "tempfile",
  "thiserror 2.0.18",
  "tokio",
  "toml 0.8.23",
  "uuid",
+ "walkdir",
  "xcode",
 ]
 

apple-codesign-quick/Cargo.toml

View file @ 65cd6c1

@@ -5,10 +5,17 @@ edition = "2024"
 
 [dependencies]
 plist.workspace = true
-
-tokio.workspace = true
-lief = "0.17"
+thiserror.workspace = true
 sha1.workspace = true
 sha2.workspace = true
-futures = "0.3.31"
-log = "0.4.28"
+byteorder = "1.5"
+cms = { version = "0.2.3", features = ["builder", "rsa", "sha2"] }
+const-oid = { version = "0.9.6", features = ["db"] }
+der = { version = "0.7.10", features = ["alloc", "derive", "std"] }
+memmap2 = "0.9"
+pem-rfc7468 = { version = "0.7", features = ["alloc"] }
+rayon = "1.12"
+rsa = { version = "0.9.9", features = ["sha2"] }
+sha2_010 = { package = "sha2", version = "0.10" }
+spki = "0.7.3"
+x509-cert = "0.2.5"

apple-codesign-quick/assets/AppleIncRootCertificate.cer

View file @ 65cd6c1

apple-codesign-quick/assets/AppleWWDRCAG3.cer

View file @ 65cd6c1

apple-codesign-quick/src/bundle.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,684 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use crate::file_bytes::read_file_bytes;
	3	+use crate::macho::{DEFAULT_CMS_BLOB_RESERVATION, MachOSigningConfig, sign_macho_file};
	4	+use crate::signature::CmsSigner;
	5	+use plist::{Dictionary, Value};
	6	+use rayon::prelude::*;
	7	+use sha1::Digest as _;
	8	+use std::collections::BTreeMap;
	9	+use std::fs;
	10	+use std::path::{Path, PathBuf};
	11	+
	12	+const FAIRPLAY_DIR: &str = "SC_Info";
	13	+const CODE_SIGNATURE_DIR: &str = "_CodeSignature";
	14	+const CODE_RESOURCES_FILE: &str = "CodeResources";
	15	+
	16	+pub struct BundleSigningSettings<'a> {
	17	+ pub team_id: String,
	18	+ pub main_entitlements: Dictionary,
	19	+ pub entitlements_by_bundle_id: BTreeMap<String, Dictionary>,
	20	+ pub cms_signer: Option<&'a dyn CmsSigner>,
	21	+ pub embedded_mobileprovision: Option<&'a [u8]>,
	22	+ pub embedded_mobileprovisions_by_bundle_id: BTreeMap<String, &'a [u8]>,
	23	+ pub cms_blob_reservation: usize,
	24	+}
	25	+
	26	+impl<'a> BundleSigningSettings<'a> {
	27	+ pub fn new(
	28	+ team_id: impl Into<String>,
	29	+ main_entitlements: Dictionary,
	30	+ cms_signer: Option<&'a dyn CmsSigner>,
	31	+ ) -> Self {
	32	+ Self {
	33	+ team_id: team_id.into(),
	34	+ main_entitlements,
	35	+ entitlements_by_bundle_id: BTreeMap::new(),
	36	+ cms_signer,
	37	+ embedded_mobileprovision: None,
	38	+ embedded_mobileprovisions_by_bundle_id: BTreeMap::new(),
	39	+ cms_blob_reservation: DEFAULT_CMS_BLOB_RESERVATION,
	40	+ }
	41	+ }
	42	+}
	43	+
	44	+#[derive(Debug)]
	45	+pub struct Bundle {
	46	+ path: PathBuf,
	47	+ app_info: Dictionary,
	48	+}
	49	+
	50	+impl Bundle {
	51	+ pub fn open(path: impl Into<PathBuf>) -> Result<Self> {
	52	+ let path = path.into();
	53	+ let info_path = path.join("Info.plist");
	54	+ if !info_path.exists() {
	55	+ return Err(CodeSignError::MissingInfoPlist(info_path));
	56	+ }
	57	+
	58	+ let file =
	59	+ fs::File::open(&info_path).map_err(\|source\| CodeSignError::io(&info_path, source))?;
	60	+ let app_info = match Value::from_reader(file)? {
	61	+ Value::Dictionary(dict) => dict,
	62	+ _ => {
	63	+ return Err(CodeSignError::macho(
	64	+ &info_path,
	65	+ "Info.plist is not a dictionary",
	66	+ ));
	67	+ }
	68	+ };
	69	+
	70	+ Ok(Self { path, app_info })
	71	+ }
	72	+
	73	+ pub fn path(&self) -> &Path {
	74	+ &self.path
	75	+ }
	76	+
	77	+ pub fn bundle_identifier(&self) -> Result<&str> {
	78	+ self.info_string("CFBundleIdentifier")
	79	+ }
	80	+
	81	+ pub fn executable_name(&self) -> Result<&str> {
	82	+ self.info_string("CFBundleExecutable")
	83	+ }
	84	+
	85	+ pub fn sign(&mut self, settings: &BundleSigningSettings<'_>) -> Result<CodeResourcesMaps> {
	86	+ self.sign_inner(settings, true)
	87	+ }
	88	+
	89	+ fn sign_inner(
	90	+ &mut self,
	91	+ settings: &BundleSigningSettings<'_>,
	92	+ is_root: bool,
	93	+ ) -> Result<CodeResourcesMaps> {
	94	+ remove_fairplay_dir(&self.path)?;
	95	+
	96	+ let bundle_id = self.bundle_identifier()?.to_string();
	97	+ let executable = self.executable_name()?.to_string();
	98	+ let sub_bundles = self.sub_bundles()?;
	99	+ let sub_bundles_for_hashing = sub_bundles.clone();
	100	+
	101	+ let code_signature_dir = self.path.join(CODE_SIGNATURE_DIR);
	102	+ fs::create_dir_all(&code_signature_dir)
	103	+ .map_err(\|source\| CodeSignError::io(&code_signature_dir, source))?;
	104	+
	105	+ let code_resources_path = code_signature_dir.join(CODE_RESOURCES_FILE);
	106	+ if code_resources_path.exists() {
	107	+ fs::remove_file(&code_resources_path)
	108	+ .map_err(\|source\| CodeSignError::io(&code_resources_path, source))?;
	109	+ }
	110	+
	111	+ let info_data = encode_binary_plist(&self.app_info)?;
	112	+ let info_path = self.path.join("Info.plist");
	113	+ fs::write(&info_path, &info_data)
	114	+ .map_err(\|source\| CodeSignError::io(&info_path, source))?;
	115	+ let mobileprovision = settings
	116	+ .embedded_mobileprovisions_by_bundle_id
	117	+ .get(&bundle_id)
	118	+ .copied()
	119	+ .or_else(\|\| {
	120	+ if is_root {
	121	+ settings.embedded_mobileprovision
	122	+ } else {
	123	+ None
	124	+ }
	125	+ });
	126	+ if let Some(mobileprovision) = mobileprovision {
	127	+ let profile_path = self.path.join("embedded.mobileprovision");
	128	+ fs::write(&profile_path, mobileprovision)
	129	+ .map_err(\|source\| CodeSignError::io(&profile_path, source))?;
	130	+ }
	131	+
	132	+ let (sub_results, bundle_files) = rayon::join(
	133	+ \|\| sign_sub_bundles(&self.path, sub_bundles, settings),
	134	+ \|\| collect_own_bundle_files(&self.path, &executable, &sub_bundles_for_hashing),
	135	+ );
	136	+ let sub_results = sub_results?;
	137	+ let bundle_files = bundle_files?;
	138	+ sign_libraries(&bundle_files.libraries, settings)?;
	139	+ let resource_hashes = hash_resource_files(&self.path, &bundle_files.resource_files)?;
	140	+
	141	+ let mut maps = CodeResourcesMaps::default();
	142	+
	143	+ for sub in &sub_results {
	144	+ merge_sub_bundle_resources(&mut maps, &self.path, sub)?;
	145	+ }
	146	+
	147	+ for hash in resource_hashes {
	148	+ maps.insert_hash(hash);
	149	+ }
	150	+
	151	+ let code_resources = encode_code_resources(&maps)?;
	152	+ fs::write(&code_resources_path, &code_resources)
	153	+ .map_err(\|source\| CodeSignError::io(&code_resources_path, source))?;
	154	+
	155	+ let empty_entitlements = Dictionary::new();
	156	+ let bundle_entitlements = settings
	157	+ .entitlements_by_bundle_id
	158	+ .get(&bundle_id)
	159	+ .or_else(\|\| is_root.then_some(&settings.main_entitlements))
	160	+ .unwrap_or(&empty_entitlements);
	161	+
	162	+ let mut config = MachOSigningConfig::new(
	163	+ &bundle_id,
	164	+ &settings.team_id,
	165	+ bundle_entitlements,
	166	+ settings.cms_signer,
	167	+ );
	168	+ config.cms_blob_reservation = settings.cms_blob_reservation;
	169	+ config.info_plist = Some(&info_data);
	170	+ config.code_resources = Some(&code_resources);
	171	+ sign_macho_file(&self.path.join(&executable), &config)?;
	172	+
	173	+ Ok(maps)
	174	+ }
	175	+
	176	+ fn info_string(&self, key: &'static str) -> Result<&str> {
	177	+ self.app_info
	178	+ .get(key)
	179	+ .and_then(Value::as_string)
	180	+ .ok_or(CodeSignError::MissingInfoString(key))
	181	+ }
	182	+
	183	+ fn sub_bundles(&self) -> Result<Vec<PathBuf>> {
	184	+ let mut bundles = Vec::new();
	185	+ for folder in ["Frameworks", "PlugIns"] {
	186	+ let dir = self.path.join(folder);
	187	+ if !dir.exists() {
	188	+ continue;
	189	+ }
	190	+
	191	+ for entry in fs::read_dir(&dir).map_err(\|source\| CodeSignError::io(&dir, source))? {
	192	+ let entry = entry.map_err(\|source\| CodeSignError::io(&dir, source))?;
	193	+ let path = entry.path();
	194	+ if entry
	195	+ .file_type()
	196	+ .map_err(\|source\| CodeSignError::io(&path, source))?
	197	+ .is_dir()
	198	+ && path.join("Info.plist").exists()
	199	+ {
	200	+ bundles.push(path);
	201	+ }
	202	+ }
	203	+ }
	204	+ bundles.sort();
	205	+ Ok(bundles)
	206	+ }
	207	+}
	208	+
	209	+#[derive(Debug)]
	210	+struct SubBundleResult {
	211	+ path: PathBuf,
	212	+ relative_root: String,
	213	+ executable: String,
	214	+ resources: CodeResourcesMaps,
	215	+}
	216	+
	217	+#[derive(Clone, Debug)]
	218	+struct FileHash {
	219	+ relative_path: String,
	220	+ sha1: [u8; 20],
	221	+ sha256: [u8; 32],
	222	+ optional: bool,
	223	+}
	224	+
	225	+#[derive(Debug)]
	226	+struct BundleFiles {
	227	+ resource_files: Vec<PathBuf>,
	228	+ libraries: Vec<PathBuf>,
	229	+}
	230	+
	231	+fn merge_sub_bundle_resources(
	232	+ maps: &mut CodeResourcesMaps,
	233	+ parent_path: &Path,
	234	+ sub: &SubBundleResult,
	235	+) -> Result<()> {
	236	+ maps.merge_rerooted(&sub.relative_root, &sub.resources);
	237	+ maps.insert_hash(hash_bundle_file(
	238	+ parent_path,
	239	+ &sub.path.join(&sub.executable),
	240	+ )?);
	241	+ maps.insert_hash(hash_bundle_file(
	242	+ parent_path,
	243	+ &sub.path.join(CODE_SIGNATURE_DIR).join(CODE_RESOURCES_FILE),
	244	+ )?);
	245	+ Ok(())
	246	+}
	247	+
	248	+#[derive(Clone, Debug, Default)]
	249	+pub struct CodeResourcesMaps {
	250	+ pub files: Dictionary,
	251	+ pub files2: Dictionary,
	252	+ hashes: Vec<FileHash>,
	253	+}
	254	+
	255	+impl CodeResourcesMaps {
	256	+ fn insert_hash(&mut self, hash: FileHash) {
	257	+ self.hashes.push(hash.clone());
	258	+ let sha1 = hash.sha1.to_vec();
	259	+ if !omit_from_files(&hash.relative_path) {
	260	+ if hash.optional {
	261	+ let mut file = Dictionary::new();
	262	+ file.insert("hash".to_string(), Value::Data(sha1.clone()));
	263	+ file.insert("optional".to_string(), Value::Boolean(true));
	264	+ self.files
	265	+ .insert(hash.relative_path.clone(), Value::Dictionary(file));
	266	+ } else {
	267	+ self.files
	268	+ .insert(hash.relative_path.clone(), Value::Data(sha1.clone()));
	269	+ }
	270	+ }
	271	+
	272	+ if !omit_from_files2(&hash.relative_path) {
	273	+ let mut file2 = Dictionary::new();
	274	+ file2.insert("hash".to_string(), Value::Data(sha1));
	275	+ file2.insert("hash2".to_string(), Value::Data(hash.sha256.to_vec()));
	276	+ if hash.optional {
	277	+ file2.insert("optional".to_string(), Value::Boolean(true));
	278	+ }
	279	+ self.files2
	280	+ .insert(hash.relative_path, Value::Dictionary(file2));
	281	+ }
	282	+ }
	283	+
	284	+ fn merge_rerooted(&mut self, root: &str, other: &Self) {
	285	+ for hash in &other.hashes {
	286	+ let mut hash = hash.clone();
	287	+ hash.relative_path = join_relative(root, &hash.relative_path);
	288	+ self.insert_hash(hash);
	289	+ }
	290	+ }
	291	+}
	292	+
	293	+fn omit_from_files(relative_path: &str) -> bool {
	294	+ relative_path.ends_with(".lproj/locversion.plist")
	295	+}
	296	+
	297	+fn omit_from_files2(relative_path: &str) -> bool {
	298	+ omit_from_files(relative_path)
	299	+ \|\| relative_path == "Info.plist"
	300	+ \|\| relative_path == "PkgInfo"
	301	+ \|\| relative_path == ".DS_Store"
	302	+ \|\| relative_path.ends_with("/.DS_Store")
	303	+}
	304	+
	305	+pub fn sign_bundle(path: impl Into<PathBuf>, settings: &BundleSigningSettings<'_>) -> Result<()> {
	306	+ let mut bundle = Bundle::open(path)?;
	307	+ bundle.sign(settings)?;
	308	+ Ok(())
	309	+}
	310	+
	311	+fn sign_sub_bundles(
	312	+ root_path: &Path,
	313	+ sub_bundles: Vec<PathBuf>,
	314	+ settings: &BundleSigningSettings<'_>,
	315	+) -> Result<Vec<SubBundleResult>> {
	316	+ sub_bundles
	317	+ .into_par_iter()
	318	+ .map(\|path\| {
	319	+ let mut bundle = Bundle::open(&path)?;
	320	+ let result = bundle.sign_inner(settings, false)?;
	321	+ let relative_root = relative_path_string(root_path, &path)?;
	322	+ let executable = bundle.executable_name()?.to_string();
	323	+ Ok(SubBundleResult {
	324	+ path,
	325	+ relative_root,
	326	+ executable,
	327	+ resources: result,
	328	+ })
	329	+ })
	330	+ .collect()
	331	+}
	332	+
	333	+fn collect_own_bundle_files(
	334	+ bundle_path: &Path,
	335	+ executable: &str,
	336	+ sub_bundles: &[PathBuf],
	337	+) -> Result<BundleFiles> {
	338	+ let mut resource_files = Vec::new();
	339	+ let mut libraries = Vec::new();
	340	+
	341	+ walk_files_pruned(
	342	+ bundle_path,
	343	+ &mut \|dir\| !sub_bundles.iter().any(\|sub_bundle\| sub_bundle == dir),
	344	+ &mut \|path\| {
	345	+ let relative = relative_path_string(bundle_path, path)?;
	346	+ if path.extension().and_then(\|value\| value.to_str()) == Some("dylib") {
	347	+ libraries.push(path.to_path_buf());
	348	+ }
	349	+ if should_hash_resource(&relative, executable) {
	350	+ resource_files.push(path.to_path_buf());
	351	+ }
	352	+ Ok(())
	353	+ },
	354	+ )?;
	355	+
	356	+ resource_files.sort();
	357	+ libraries.sort();
	358	+
	359	+ Ok(BundleFiles {
	360	+ resource_files,
	361	+ libraries,
	362	+ })
	363	+}
	364	+
	365	+fn sign_libraries(libraries: &[PathBuf], settings: &BundleSigningSettings<'_>) -> Result<()> {
	366	+ libraries
	367	+ .par_iter()
	368	+ .map(\|path\| {
	369	+ let identifier = path
	370	+ .file_name()
	371	+ .and_then(\|value\| value.to_str())
	372	+ .ok_or_else(\|\| CodeSignError::InvalidBundlePath(path.clone()))?;
	373	+ let entitlements = Dictionary::new();
	374	+ let mut config = MachOSigningConfig::new(
	375	+ identifier,
	376	+ &settings.team_id,
	377	+ &entitlements,
	378	+ settings.cms_signer,
	379	+ );
	380	+ config.cms_blob_reservation = settings.cms_blob_reservation;
	381	+ sign_macho_file(path, &config)
	382	+ })
	383	+ .collect::<Result<Vec<_>>>()?;
	384	+ Ok(())
	385	+}
	386	+
	387	+fn hash_resource_files(bundle_path: &Path, resource_files: &[PathBuf]) -> Result<Vec<FileHash>> {
	388	+ resource_files
	389	+ .par_iter()
	390	+ .map(\|path\| hash_bundle_file(bundle_path, path))
	391	+ .collect()
	392	+}
	393	+
	394	+fn remove_fairplay_dir(bundle_path: &Path) -> Result<()> {
	395	+ let fairplay_path = bundle_path.join(FAIRPLAY_DIR);
	396	+ if fairplay_path.exists() {
	397	+ fs::remove_dir_all(&fairplay_path)
	398	+ .map_err(\|source\| CodeSignError::io(&fairplay_path, source))?;
	399	+ }
	400	+ Ok(())
	401	+}
	402	+
	403	+fn walk_files_pruned(
	404	+ root: &Path,
	405	+ should_descend: &mut impl FnMut(&Path) -> bool,
	406	+ visitor: &mut impl FnMut(&Path) -> Result<()>,
	407	+) -> Result<()> {
	408	+ let mut stack = vec![root.to_path_buf()];
	409	+ while let Some(dir) = stack.pop() {
	410	+ for entry in fs::read_dir(&dir).map_err(\|source\| CodeSignError::io(&dir, source))? {
	411	+ let entry = entry.map_err(\|source\| CodeSignError::io(&dir, source))?;
	412	+ let path = entry.path();
	413	+ let file_type = entry
	414	+ .file_type()
	415	+ .map_err(\|source\| CodeSignError::io(&path, source))?;
	416	+ if file_type.is_dir() && should_descend(&path) {
	417	+ stack.push(path);
	418	+ } else if file_type.is_file() {
	419	+ visitor(&path)?;
	420	+ }
	421	+ }
	422	+ }
	423	+ Ok(())
	424	+}
	425	+
	426	+fn should_hash_resource(relative: &str, executable: &str) -> bool {
	427	+ if relative == executable \|\| relative.starts_with(FAIRPLAY_DIR) {
	428	+ return false;
	429	+ }
	430	+
	431	+ for nested_root in ["Frameworks/", "PlugIns/"] {
	432	+ if let Some(rest) = relative.strip_prefix(nested_root)
	433	+ && rest.contains('/')
	434	+ {
	435	+ return false;
	436	+ }
	437	+ }
	438	+
	439	+ true
	440	+}
	441	+
	442	+fn hash_bundle_file(bundle_path: &Path, path: &Path) -> Result<FileHash> {
	443	+ let relative_path = relative_path_string(bundle_path, path)?;
	444	+ let data = read_file_bytes(path)?;
	445	+ let (sha1, sha256) = hash_file_data(data.as_slice());
	446	+ Ok(FileHash {
	447	+ optional: relative_path.contains(".lproj"),
	448	+ relative_path,
	449	+ sha1,
	450	+ sha256,
	451	+ })
	452	+}
	453	+
	454	+fn hash_file_data(data: &[u8]) -> ([u8; 20], [u8; 32]) {
	455	+ if data.len() >= 1024 * 1024 {
	456	+ rayon::join(
	457	+ \|\| sha1::Sha1::digest(data).into(),
	458	+ \|\| sha2::Sha256::digest(data).into(),
	459	+ )
	460	+ } else {
	461	+ (
	462	+ sha1::Sha1::digest(data).into(),
	463	+ sha2::Sha256::digest(data).into(),
	464	+ )
	465	+ }
	466	+}
	467	+
	468	+fn encode_code_resources(maps: &CodeResourcesMaps) -> Result<Vec<u8>> {
	469	+ let mut code_resources = Dictionary::new();
	470	+ code_resources.insert("files".to_string(), Value::Dictionary(maps.files.clone()));
	471	+ code_resources.insert("files2".to_string(), Value::Dictionary(maps.files2.clone()));
	472	+ code_resources.insert("rules".to_string(), rules());
	473	+ code_resources.insert("rules2".to_string(), rules2());
	474	+
	475	+ let mut data = Vec::new();
	476	+ plist::to_writer_xml(&mut data, &Value::Dictionary(code_resources))?;
	477	+ Ok(data)
	478	+}
	479	+
	480	+fn rules() -> Value {
	481	+ let mut rules = Dictionary::new();
	482	+ rules.insert("^.*".to_string(), Value::Boolean(true));
	483	+ rules.insert(
	484	+ "^.*\\.lproj/".to_string(),
	485	+ weighted_rule([("optional", Value::Boolean(true))], 1000.0),
	486	+ );
	487	+ rules.insert(
	488	+ "^.*\\.lproj/locversion.plist$".to_string(),
	489	+ weighted_rule([("omit", Value::Boolean(true))], 1100.0),
	490	+ );
	491	+ rules.insert("^Base\\.lproj/".to_string(), weight_only_rule(1010.0));
	492	+ rules.insert("^version.plist$".to_string(), Value::Boolean(true));
	493	+ Value::Dictionary(rules)
	494	+}
	495	+
	496	+fn rules2() -> Value {
	497	+ let mut rules = Dictionary::new();
	498	+ rules.insert(".*\\.dSYM($\|/)".to_string(), weight_only_rule(11.0));
	499	+ rules.insert(
	500	+ "^(.*/)?\\.DS_Store$".to_string(),
	501	+ weighted_rule([("omit", Value::Boolean(true))], 2000.0),
	502	+ );
	503	+ rules.insert("^.*".to_string(), Value::Boolean(true));
	504	+ rules.insert(
	505	+ "^.*\\.lproj/".to_string(),
	506	+ weighted_rule([("optional", Value::Boolean(true))], 1000.0),
	507	+ );
	508	+ rules.insert(
	509	+ "^.*\\.lproj/locversion.plist$".to_string(),
	510	+ weighted_rule([("omit", Value::Boolean(true))], 1100.0),
	511	+ );
	512	+ rules.insert("^Base\\.lproj/".to_string(), weight_only_rule(1010.0));
	513	+ rules.insert(
	514	+ "^Info\\.plist$".to_string(),
	515	+ weighted_rule([("omit", Value::Boolean(true))], 20.0),
	516	+ );
	517	+ rules.insert(
	518	+ "^PkgInfo$".to_string(),
	519	+ weighted_rule([("omit", Value::Boolean(true))], 20.0),
	520	+ );
	521	+ rules.insert(
	522	+ "^embedded\\.provisionprofile$".to_string(),
	523	+ weight_only_rule(20.0),
	524	+ );
	525	+ rules.insert("^version\\.plist$".to_string(), weight_only_rule(20.0));
	526	+ Value::Dictionary(rules)
	527	+}
	528	+
	529	+fn weighted_rule<const N: usize>(entries: [(&str, Value); N], weight: f64) -> Value {
	530	+ let mut dict = Dictionary::new();
	531	+ for (key, value) in entries {
	532	+ dict.insert(key.to_string(), value);
	533	+ }
	534	+ dict.insert("weight".to_string(), Value::Real(weight));
	535	+ Value::Dictionary(dict)
	536	+}
	537	+
	538	+fn weight_only_rule(weight: f64) -> Value {
	539	+ weighted_rule::<0>([], weight)
	540	+}
	541	+
	542	+fn encode_binary_plist(dict: &Dictionary) -> Result<Vec<u8>> {
	543	+ let mut data = Vec::new();
	544	+ plist::to_writer_binary(&mut data, &Value::Dictionary(dict.clone()))?;
	545	+ Ok(data)
	546	+}
	547	+
	548	+fn relative_path_string(root: &Path, path: &Path) -> Result<String> {
	549	+ let relative = path
	550	+ .strip_prefix(root)
	551	+ .map_err(\|_\| CodeSignError::InvalidBundlePath(path.to_path_buf()))?;
	552	+ path_to_forward_slashes(relative)
	553	+}
	554	+
	555	+fn path_to_forward_slashes(path: &Path) -> Result<String> {
	556	+ let mut parts = Vec::new();
	557	+ for component in path.components() {
	558	+ parts.push(
	559	+ component
	560	+ .as_os_str()
	561	+ .to_str()
	562	+ .ok_or_else(\|\| CodeSignError::InvalidBundlePath(path.to_path_buf()))?,
	563	+ );
	564	+ }
	565	+ Ok(parts.join("/"))
	566	+}
	567	+
	568	+fn join_relative(root: &str, child: &str) -> String {
	569	+ if root.is_empty() {
	570	+ child.to_string()
	571	+ } else if child.is_empty() {
	572	+ root.to_string()
	573	+ } else {
	574	+ format!("{root}/{child}")
	575	+ }
	576	+}
	577	+
	578	+#[cfg(test)]
	579	+mod tests {
	580	+ use super::*;
	581	+
	582	+ fn test_hash(relative_path: &str) -> FileHash {
	583	+ FileHash {
	584	+ relative_path: relative_path.to_string(),
	585	+ sha1: [1; 20],
	586	+ sha256: [2; 32],
	587	+ optional: false,
	588	+ }
	589	+ }
	590	+
	591	+ #[test]
	592	+ fn files2_omits_only_the_current_bundles_info_and_pkginfo() {
	593	+ let mut child = CodeResourcesMaps::default();
	594	+ child.insert_hash(test_hash("Info.plist"));
	595	+ child.insert_hash(test_hash("PkgInfo"));
	596	+
	597	+ assert!(child.files.contains_key("Info.plist"));
	598	+ assert!(!child.files2.contains_key("Info.plist"));
	599	+ assert!(!child.files2.contains_key("PkgInfo"));
	600	+
	601	+ let mut parent = CodeResourcesMaps::default();
	602	+ parent.merge_rerooted("PlugIns/Widget.appex", &child);
	603	+
	604	+ assert!(
	605	+ parent
	606	+ .files2
	607	+ .contains_key("PlugIns/Widget.appex/Info.plist")
	608	+ );
	609	+ assert!(parent.files2.contains_key("PlugIns/Widget.appex/PkgInfo"));
	610	+ }
	611	+
	612	+ #[test]
	613	+ fn direct_dylibs_are_hashed_from_their_final_signed_contents() {
	614	+ let test_root = std::env::temp_dir().join(format!(
	615	+ "apple-codesign-dylib-resources-{}-{}",
	616	+ std::process::id(),
	617	+ std::time::SystemTime::now()
	618	+ .duration_since(std::time::UNIX_EPOCH)
	619	+ .unwrap()
	620	+ .as_nanos()
	621	+ ));
	622	+ let dylib = test_root.join("Frameworks/Patch.dylib");
	623	+ fs::create_dir_all(dylib.parent().unwrap()).unwrap();
	624	+ fs::write(&dylib, b"unsigned").unwrap();
	625	+
	626	+ let bundle_files = collect_own_bundle_files(&test_root, "Main", &[]).unwrap();
	627	+ assert_eq!(bundle_files.libraries, vec![dylib.clone()]);
	628	+ assert_eq!(bundle_files.resource_files, vec![dylib.clone()]);
	629	+
	630	+ fs::write(&dylib, b"signed").unwrap();
	631	+ let hashes = hash_resource_files(&test_root, &bundle_files.resource_files).unwrap();
	632	+ let expected_sha256: [u8; 32] = sha2::Sha256::digest(b"signed").into();
	633	+ assert_eq!(hashes[0].sha256, expected_sha256);
	634	+
	635	+ fs::remove_dir_all(test_root).unwrap();
	636	+ }
	637	+
	638	+ #[test]
	639	+ fn parent_seals_nested_bundle_code_resources() {
	640	+ let test_root = std::env::temp_dir().join(format!(
	641	+ "apple-codesign-nested-resources-{}-{}",
	642	+ std::process::id(),
	643	+ std::time::SystemTime::now()
	644	+ .duration_since(std::time::UNIX_EPOCH)
	645	+ .unwrap()
	646	+ .as_nanos()
	647	+ ));
	648	+ let child_path = test_root.join("Frameworks/Example.framework");
	649	+ let signature_path = child_path.join(CODE_SIGNATURE_DIR);
	650	+ fs::create_dir_all(&signature_path).unwrap();
	651	+ fs::write(child_path.join("Example"), b"executable").unwrap();
	652	+ fs::write(signature_path.join(CODE_RESOURCES_FILE), b"resources").unwrap();
	653	+
	654	+ let mut child_resources = CodeResourcesMaps::default();
	655	+ child_resources.insert_hash(test_hash("Resource.txt"));
	656	+ let child = SubBundleResult {
	657	+ path: child_path,
	658	+ relative_root: "Frameworks/Example.framework".to_string(),
	659	+ executable: "Example".to_string(),
	660	+ resources: child_resources,
	661	+ };
	662	+ let mut parent = CodeResourcesMaps::default();
	663	+
	664	+ merge_sub_bundle_resources(&mut parent, &test_root, &child).unwrap();
	665	+
	666	+ assert!(
	667	+ parent
	668	+ .files2
	669	+ .contains_key("Frameworks/Example.framework/Resource.txt")
	670	+ );
	671	+ assert!(
	672	+ parent
	673	+ .files2
	674	+ .contains_key("Frameworks/Example.framework/Example")
	675	+ );
	676	+ assert!(
	677	+ parent
	678	+ .files2
	679	+ .contains_key("Frameworks/Example.framework/_CodeSignature/CodeResources")
	680	+ );
	681	+
	682	+ fs::remove_dir_all(test_root).unwrap();
	683	+ }
	684	+}

apple-codesign-quick/src/error.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,72 @@
	1	+use std::path::PathBuf;
	2	+
	3	+#[derive(Debug, thiserror::Error)]
	4	+pub enum CodeSignError {
	5	+ #[error("I/O error for {path}: {source}")]
	6	+ Io {
	7	+ path: PathBuf,
	8	+ #[source]
	9	+ source: std::io::Error,
	10	+ },
	11	+
	12	+ #[error("plist error: {0}")]
	13	+ Plist(#[from] plist::Error),
	14	+
	15	+ #[error("bundle is missing Info.plist: {0}")]
	16	+ MissingInfoPlist(PathBuf),
	17	+
	18	+ #[error("Info.plist is missing string key {0}")]
	19	+ MissingInfoString(&'static str),
	20	+
	21	+ #[error("invalid UTF-8 path inside bundle: {0}")]
	22	+ InvalidBundlePath(PathBuf),
	23	+
	24	+ #[error("argument error: {0}")]
	25	+ Argument(String),
	26	+
	27	+ #[error("Mach-O error in {path}: {message}")]
	28	+ MachO { path: PathBuf, message: String },
	29	+
	30	+ #[error(
	31	+ "Mach-O in {path} has no safe header padding for a new LC_CODE_SIGNATURE load command; requested signature reservation is {signature_len} bytes"
	32	+ )]
	33	+ NeedsCodeSignatureAllocation { path: PathBuf, signature_len: usize },
	34	+
	35	+ #[error("unsupported entitlement value for key {0}")]
	36	+ UnsupportedEntitlement(String),
	37	+
	38	+ #[error("CMS signing error: {0}")]
	39	+ Cms(String),
	40	+
	41	+ #[error("provisioning profile error: {0}")]
	42	+ ProvisioningProfile(String),
	43	+
	44	+ #[error("CMS signature blob is {actual} bytes, exceeding the {reserved} byte reservation")]
	45	+ SignatureTooLarge { actual: usize, reserved: usize },
	46	+}
	47	+
	48	+impl CodeSignError {
	49	+ pub(crate) fn io(path: impl Into<PathBuf>, source: std::io::Error) -> Self {
	50	+ Self::Io {
	51	+ path: path.into(),
	52	+ source,
	53	+ }
	54	+ }
	55	+
	56	+ pub(crate) fn macho(path: impl Into<PathBuf>, message: impl Into<String>) -> Self {
	57	+ Self::MachO {
	58	+ path: path.into(),
	59	+ message: message.into(),
	60	+ }
	61	+ }
	62	+
	63	+ pub(crate) fn cms(message: impl Into<String>) -> Self {
	64	+ Self::Cms(message.into())
	65	+ }
	66	+
	67	+ pub(crate) fn provisioning_profile(message: impl Into<String>) -> Self {
	68	+ Self::ProvisioningProfile(message.into())
	69	+ }
	70	+}
	71	+
	72	+pub type Result<T> = std::result::Result<T, CodeSignError>;

apple-codesign-quick/src/file_bytes.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,44 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use memmap2::{Mmap, MmapOptions};
	3	+use std::fs;
	4	+use std::path::Path;
	5	+
	6	+pub(crate) enum FileBytes {
	7	+ Mapped(Mmap),
	8	+ Owned(Vec<u8>),
	9	+}
	10	+
	11	+impl FileBytes {
	12	+ pub(crate) fn as_slice(&self) -> &[u8] {
	13	+ match self {
	14	+ Self::Mapped(map) => map,
	15	+ Self::Owned(bytes) => bytes,
	16	+ }
	17	+ }
	18	+}
	19	+
	20	+pub(crate) fn read_file_bytes(path: &Path) -> Result<FileBytes> {
	21	+ let file = fs::File::open(path).map_err(\|source\| CodeSignError::io(path, source))?;
	22	+ let len = file
	23	+ .metadata()
	24	+ .map_err(\|source\| CodeSignError::io(path, source))?
	25	+ .len();
	26	+
	27	+ if len == 0 {
	28	+ return Ok(FileBytes::Owned(Vec::new()));
	29	+ }
	30	+
	31	+ // SAFETY: every mapped read in this crate is created from a file opened for
	32	+ // read-only use and is only exposed as an immutable byte slice. During our
	33	+ // own signing flow, files are mapped after any planned in-process rewrites
	34	+ // for that file and before we write the signed replacement. Concurrent
	35	+ // external mutation of the bundle while signing is outside the supported
	36	+ // contract, matching the same precondition as the D MmFile implementation.
	37	+ let mapped = unsafe { MmapOptions::new().map(&file) };
	38	+ match mapped {
	39	+ Ok(map) => Ok(FileBytes::Mapped(map)),
	40	+ Err(_) => fs::read(path)
	41	+ .map(FileBytes::Owned)
	42	+ .map_err(\|source\| CodeSignError::io(path, source)),
	43	+ }
	44	+}

apple-codesign-quick/src/lib.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,16 @@
	1	+pub mod bundle;
	2	+pub mod error;
	3	+mod file_bytes;
	4	+pub mod macho;
	5	+pub mod provisioning;
	6	+pub mod rustcrypto_cms;
	7	+pub mod signature;
	8	+
	9	+pub use bundle::{Bundle, BundleSigningSettings, CodeResourcesMaps, sign_bundle};
	10	+pub use error::{CodeSignError, Result};
	11	+pub use macho::{
	12	+ DEFAULT_CMS_BLOB_RESERVATION, MachOSigningConfig, sign_macho_data, sign_macho_file,
	13	+};
	14	+pub use provisioning::ProvisioningProfile;
	15	+pub use rustcrypto_cms::RustCryptoCmsSigner;
	16	+pub use signature::{CmsSigner, CmsSigningRequest, EncodedCodeDirectory, HashAlgorithm};

apple-codesign-quick/src/macho.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,1175 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use crate::file_bytes::read_file_bytes;
	3	+use crate::signature::{
	4	+ CmsSigner, CodeDirectoryParams, ExecutableSegment, SuperblobSizePlan, der_entitlements_blob,
	5	+ empty_requirements_blob, encode_embedded_signature, entitlement_exec_flags, entitlements_blob,
	6	+ entitlements_xml, planned_superblob_len_from_parts,
	7	+};
	8	+use byteorder::{BigEndian, ByteOrder, LittleEndian};
	9	+use plist::Dictionary;
	10	+use rayon::prelude::*;
	11	+use std::fs;
	12	+use std::path::{Path, PathBuf};
	13	+
	14	+const MH_MAGIC: u32 = 0xfeed_face;
	15	+const MH_MAGIC_64: u32 = 0xfeed_facf;
	16	+const MH_EXECUTE: u32 = 0x2;
	17	+
	18	+const FAT_MAGIC: u32 = 0xcafe_babe;
	19	+const FAT_MAGIC_64: u32 = 0xcafe_babf;
	20	+
	21	+const LC_SEGMENT: u32 = 0x1;
	22	+const LC_SEGMENT_64: u32 = 0x19;
	23	+const LC_CODE_SIGNATURE: u32 = 0x1d;
	24	+
	25	+const LINKEDIT_DATA_COMMAND_SIZE: usize = 16;
	26	+const FAT_HEADER_SIZE: usize = 8;
	27	+const FAT_ARCH_SIZE: usize = 20;
	28	+const PAGE_SIZE: usize = 16 * 1024;
	29	+const CODE_SIGNATURE_ALIGNMENT: usize = 16;
	30	+const SECTION_TYPE: u32 = 0xff;
	31	+const S_ZEROFILL: u32 = 0x1;
	32	+const S_THREAD_LOCAL_ZEROFILL: u32 = 0x11;
	33	+
	34	+pub const DEFAULT_CMS_BLOB_RESERVATION: usize = 16 * 1024;
	35	+
	36	+#[derive(Clone)]
	37	+pub struct MachOSigningConfig<'a> {
	38	+ pub identifier: &'a str,
	39	+ pub team_id: &'a str,
	40	+ pub entitlements: &'a Dictionary,
	41	+ pub info_plist: Option<&'a [u8]>,
	42	+ pub code_resources: Option<&'a [u8]>,
	43	+ pub cms_signer: Option<&'a dyn CmsSigner>,
	44	+ pub cms_blob_reservation: usize,
	45	+}
	46	+
	47	+impl<'a> MachOSigningConfig<'a> {
	48	+ pub fn new(
	49	+ identifier: &'a str,
	50	+ team_id: &'a str,
	51	+ entitlements: &'a Dictionary,
	52	+ cms_signer: Option<&'a dyn CmsSigner>,
	53	+ ) -> Self {
	54	+ Self {
	55	+ identifier,
	56	+ team_id,
	57	+ entitlements,
	58	+ info_plist: None,
	59	+ code_resources: None,
	60	+ cms_signer,
	61	+ cms_blob_reservation: DEFAULT_CMS_BLOB_RESERVATION,
	62	+ }
	63	+ }
	64	+}
	65	+
	66	+pub fn sign_macho_file(path: &Path, config: &MachOSigningConfig<'_>) -> Result<()> {
	67	+ let original = read_file_bytes(path)?;
	68	+ let signed = sign_macho_data(path, original.as_slice(), config)?;
	69	+ fs::write(path, signed).map_err(\|source\| CodeSignError::io(path, source))?;
	70	+ Ok(())
	71	+}
	72	+
	73	+pub fn sign_macho_data(
	74	+ path: &Path,
	75	+ data: &[u8],
	76	+ config: &MachOSigningConfig<'_>,
	77	+) -> Result<Vec<u8>> {
	78	+ sign_macho_owned(path, data.to_vec(), config)
	79	+}
	80	+
	81	+fn sign_macho_owned(
	82	+ path: &Path,
	83	+ data: Vec<u8>,
	84	+ config: &MachOSigningConfig<'_>,
	85	+) -> Result<Vec<u8>> {
	86	+ if let Some(fat_arches) = parse_fat_arches(path, &data)? {
	87	+ let signed_arches = fat_arches
	88	+ .par_iter()
	89	+ .map(\|arch\| {
	90	+ let bytes = data[arch.offset..arch.offset + arch.size].to_vec();
	91	+ let signed = sign_thin_macho(path, bytes, config)?;
	92	+ Ok(SignedArch {
	93	+ cputype: signed.cputype,
	94	+ cpusubtype: signed.cpusubtype,
	95	+ align: arch.align,
	96	+ data: signed.data,
	97	+ })
	98	+ })
	99	+ .collect::<Result<Vec<_>>>()?;
	100	+
	101	+ rebuild_fat(path, &signed_arches)
	102	+ } else {
	103	+ Ok(sign_thin_macho(path, data, config)?.data)
	104	+ }
	105	+}
	106	+
	107	+fn sign_thin_macho(
	108	+ path: &Path,
	109	+ data: Vec<u8>,
	110	+ config: &MachOSigningConfig<'_>,
	111	+) -> Result<SignedThin> {
	112	+ let mut macho = ThinMachO::parse(path, data)?;
	113	+
	114	+ let requirements = empty_requirements_blob();
	115	+ let entitlements_xml = entitlements_xml(config.entitlements)?;
	116	+ let entitlements = entitlements_blob(&entitlements_xml);
	117	+ let der_entitlements = if macho.is_executable() {
	118	+ Some(der_entitlements_blob(config.entitlements)?)
	119	+ } else {
	120	+ None
	121	+ };
	122	+
	123	+ let mut cms_blob_reservation = config.cms_blob_reservation;
	124	+
	125	+ for _ in 0..8 {
	126	+ let code_limit = macho.code_signature_offset().unwrap_or(macho.data.len());
	127	+ let planned_len = planned_superblob_len_from_parts(SuperblobSizePlan {
	128	+ identifier: config.identifier,
	129	+ team_id: config.team_id,
	130	+ code_limit,
	131	+ is_executable: macho.is_executable(),
	132	+ requirements_blob_len: requirements.len(),
	133	+ entitlements_blob_len: entitlements.len(),
	134	+ der_entitlements_blob_len: der_entitlements.as_ref().map(Vec::len),
	135	+ has_cms_signature: config.cms_signer.is_some(),
	136	+ cms_blob_reservation,
	137	+ });
	138	+
	139	+ macho.reserve_code_signature(planned_len)?;
	140	+
	141	+ let code_limit = macho
	142	+ .code_signature_offset()
	143	+ .ok_or_else(\|\| CodeSignError::macho(path, "missing LC_CODE_SIGNATURE after reserve"))?;
	144	+ let exec_flags = entitlement_exec_flags(config.entitlements, macho.is_executable());
	145	+ let params = CodeDirectoryParams {
	146	+ identifier: config.identifier,
	147	+ team_id: config.team_id,
	148	+ macho_data: &macho.data,
	149	+ code_limit,
	150	+ executable_segment: ExecutableSegment {
	151	+ base: macho.exec_segment.base,
	152	+ limit: macho.exec_segment.limit,
	153	+ flags: exec_flags,
	154	+ },
	155	+ is_executable: macho.is_executable(),
	156	+ requirements_blob: &requirements,
	157	+ entitlements_blob: &entitlements,
	158	+ der_entitlements_blob: der_entitlements.as_deref(),
	159	+ info_plist: config.info_plist,
	160	+ code_resources: config.code_resources,
	161	+ };
	162	+
	163	+ match encode_embedded_signature(&params, config.cms_signer, cms_blob_reservation) {
	164	+ Ok(signature) => {
	165	+ macho.write_code_signature(&signature)?;
	166	+ return Ok(SignedThin {
	167	+ cputype: macho.cputype,
	168	+ cpusubtype: macho.cpusubtype,
	169	+ data: macho.data,
	170	+ });
	171	+ }
	172	+ Err(CodeSignError::SignatureTooLarge { actual, .. }) => {
	173	+ cms_blob_reservation = next_reservation(cms_blob_reservation, actual);
	174	+ }
	175	+ Err(err) => return Err(err),
	176	+ }
	177	+ }
	178	+
	179	+ Err(CodeSignError::macho(
	180	+ path,
	181	+ "CMS signature did not fit after repeated reservation growth",
	182	+ ))
	183	+}
	184	+
	185	+fn next_reservation(current: usize, actual: usize) -> usize {
	186	+ let doubled = current.saturating_mul(2).max(DEFAULT_CMS_BLOB_RESERVATION);
	187	+ align_to(doubled.max(actual), 4096)
	188	+}
	189	+
	190	+#[derive(Debug)]
	191	+struct ThinMachO {
	192	+ path: PathBuf,
	193	+ data: Vec<u8>,
	194	+ cputype: i32,
	195	+ cpusubtype: i32,
	196	+ filetype: u32,
	197	+ ncmds: u32,
	198	+ sizeofcmds: u32,
	199	+ header_size: usize,
	200	+ code_signature_command_offset: Option<usize>,
	201	+ linkedit_command_offset: Option<usize>,
	202	+ header_pad_limit: usize,
	203	+ exec_segment: SegmentBounds,
	204	+}
	205	+
	206	+#[derive(Clone, Copy, Debug, Default)]
	207	+struct SegmentBounds {
	208	+ base: u64,
	209	+ limit: u64,
	210	+}
	211	+
	212	+impl ThinMachO {
	213	+ fn parse(path: &Path, data: Vec<u8>) -> Result<Self> {
	214	+ ensure_len(path, &data, 28, "Mach-O header")?;
	215	+
	216	+ let magic = LittleEndian::read_u32(&data[0..4]);
	217	+ let is_64 = match magic {
	218	+ MH_MAGIC => false,
	219	+ MH_MAGIC_64 => true,
	220	+ _ => {
	221	+ return Err(CodeSignError::macho(
	222	+ path,
	223	+ format!("unsupported Mach-O magic 0x{magic:08x}"),
	224	+ ));
	225	+ }
	226	+ };
	227	+
	228	+ let header_size = if is_64 { 32 } else { 28 };
	229	+ ensure_len(path, &data, header_size, "Mach-O header")?;
	230	+
	231	+ let cputype = LittleEndian::read_i32(&data[4..8]);
	232	+ let cpusubtype = LittleEndian::read_i32(&data[8..12]);
	233	+ let filetype = LittleEndian::read_u32(&data[12..16]);
	234	+ let ncmds = LittleEndian::read_u32(&data[16..20]);
	235	+ let sizeofcmds = LittleEndian::read_u32(&data[20..24]);
	236	+ let commands_end = checked_add(path, header_size, sizeofcmds as usize, "load commands")?;
	237	+ ensure_len(path, &data, commands_end, "load commands")?;
	238	+
	239	+ let mut offset = header_size;
	240	+ let mut code_signature_command_offset = None;
	241	+ let mut linkedit_command_offset = None;
	242	+ let mut first_section_offset = None;
	243	+ let mut exec_segment = SegmentBounds::default();
	244	+
	245	+ for _ in 0..ncmds {
	246	+ ensure_len(path, &data, offset + 8, "load command")?;
	247	+ let cmd = LittleEndian::read_u32(&data[offset..offset + 4]);
	248	+ let cmdsize = LittleEndian::read_u32(&data[offset + 4..offset + 8]) as usize;
	249	+ if cmdsize < 8 {
	250	+ return Err(CodeSignError::macho(
	251	+ path,
	252	+ "load command is smaller than 8 bytes",
	253	+ ));
	254	+ }
	255	+ let command_end = checked_add(path, offset, cmdsize, "load command")?;
	256	+ if command_end > commands_end {
	257	+ return Err(CodeSignError::macho(
	258	+ path,
	259	+ "load command extends beyond sizeofcmds",
	260	+ ));
	261	+ }
	262	+
	263	+ match cmd {
	264	+ LC_SEGMENT => {
	265	+ parse_segment_32(
	266	+ path,
	267	+ &data,
	268	+ offset,
	269	+ cmdsize,
	270	+ &mut linkedit_command_offset,
	271	+ &mut exec_segment,
	272	+ &mut first_section_offset,
	273	+ )?;
	274	+ }
	275	+ LC_SEGMENT_64 => {
	276	+ parse_segment_64(
	277	+ path,
	278	+ &data,
	279	+ offset,
	280	+ cmdsize,
	281	+ &mut linkedit_command_offset,
	282	+ &mut exec_segment,
	283	+ &mut first_section_offset,
	284	+ )?;
	285	+ }
	286	+ LC_CODE_SIGNATURE => {
	287	+ if cmdsize < LINKEDIT_DATA_COMMAND_SIZE {
	288	+ return Err(CodeSignError::macho(path, "LC_CODE_SIGNATURE is too small"));
	289	+ }
	290	+ code_signature_command_offset = Some(offset);
	291	+ }
	292	+ _ => {}
	293	+ }
	294	+
	295	+ offset = command_end;
	296	+ }
	297	+
	298	+ let header_pad_limit = first_section_offset
	299	+ .filter(\|offset\| *offset > commands_end)
	300	+ .unwrap_or(data.len())
	301	+ .min(data.len());
	302	+
	303	+ Ok(Self {
	304	+ path: path.to_path_buf(),
	305	+ data,
	306	+ cputype,
	307	+ cpusubtype,
	308	+ filetype,
	309	+ ncmds,
	310	+ sizeofcmds,
	311	+ header_size,
	312	+ code_signature_command_offset,
	313	+ linkedit_command_offset,
	314	+ header_pad_limit,
	315	+ exec_segment,
	316	+ })
	317	+ }
	318	+
	319	+ fn is_executable(&self) -> bool {
	320	+ self.filetype == MH_EXECUTE
	321	+ }
	322	+
	323	+ fn code_signature_offset(&self) -> Option<usize> {
	324	+ self.code_signature_command_offset
	325	+ .map(\|offset\| LittleEndian::read_u32(&self.data[offset + 8..offset + 12]) as usize)
	326	+ }
	327	+
	328	+ fn reserve_code_signature(&mut self, signature_len: usize) -> Result<()> {
	329	+ if self.code_signature_command_offset.is_none() {
	330	+ self.install_code_signature_command(signature_len)?;
	331	+ }
	332	+
	333	+ let command_offset = self
	334	+ .code_signature_command_offset
	335	+ .ok_or_else(\|\| CodeSignError::macho(&self.path, "missing LC_CODE_SIGNATURE"))?;
	336	+ let dataoff =
	337	+ LittleEndian::read_u32(&self.data[command_offset + 8..command_offset + 12]) as usize;
	338	+ let datasize =
	339	+ LittleEndian::read_u32(&self.data[command_offset + 12..command_offset + 16]) as usize;
	340	+
	341	+ if datasize == 0 {
	342	+ return self.allocate_code_signature(command_offset, signature_len);
	343	+ }
	344	+
	345	+ if signature_len <= datasize {
	346	+ self.zero_signature_region(dataoff, datasize)?;
	347	+ return Ok(());
	348	+ }
	349	+
	350	+ let old_end = checked_add(&self.path, dataoff, datasize, "code signature")?;
	351	+ if old_end < self.data.len() {
	352	+ return Err(CodeSignError::macho(
	353	+ &self.path,
	354	+ "cannot grow a code signature that is not at the end of the Mach-O slice",
	355	+ ));
	356	+ }
	357	+
	358	+ let linkedit_offset = self.linkedit_command_offset.ok_or_else(\|\| {
	359	+ CodeSignError::macho(&self.path, "missing __LINKEDIT segment for code signature")
	360	+ })?;
	361	+
	362	+ let extra_file_size = signature_len - datasize;
	363	+ let extra_vm_size = page_ceil(signature_len).saturating_sub(page_ceil(datasize));
	364	+ self.grow_linkedit_segment(linkedit_offset, extra_file_size, extra_vm_size)?;
	365	+
	366	+ self.data.truncate(dataoff);
	367	+ self.data.resize(dataoff + signature_len, 0);
	368	+ LittleEndian::write_u32(
	369	+ &mut self.data[command_offset + 8..command_offset + 12],
	370	+ dataoff.try_into().map_err(\|_\| {
	371	+ CodeSignError::macho(&self.path, "code signature offset exceeds u32")
	372	+ })?,
	373	+ );
	374	+ LittleEndian::write_u32(
	375	+ &mut self.data[command_offset + 12..command_offset + 16],
	376	+ signature_len
	377	+ .try_into()
	378	+ .map_err(\|_\| CodeSignError::macho(&self.path, "code signature size exceeds u32"))?,
	379	+ );
	380	+
	381	+ Ok(())
	382	+ }
	383	+
	384	+ fn install_code_signature_command(&mut self, signature_len: usize) -> Result<()> {
	385	+ let command_offset = self.header_size + self.sizeofcmds as usize;
	386	+ let command_end = command_offset + LINKEDIT_DATA_COMMAND_SIZE;
	387	+
	388	+ if command_end > self.header_pad_limit {
	389	+ return Err(CodeSignError::NeedsCodeSignatureAllocation {
	390	+ path: self.path.clone(),
	391	+ signature_len,
	392	+ });
	393	+ }
	394	+
	395	+ if command_end > self.data.len() {
	396	+ return Err(CodeSignError::macho(
	397	+ &self.path,
	398	+ "Mach-O ended before available load command padding",
	399	+ ));
	400	+ }
	401	+
	402	+ if self.data[command_offset..command_end]
	403	+ .iter()
	404	+ .any(\|byte\| *byte != 0)
	405	+ {
	406	+ return Err(CodeSignError::NeedsCodeSignatureAllocation {
	407	+ path: self.path.clone(),
	408	+ signature_len,
	409	+ });
	410	+ }
	411	+
	412	+ LittleEndian::write_u32(
	413	+ &mut self.data[command_offset..command_offset + 4],
	414	+ LC_CODE_SIGNATURE,
	415	+ );
	416	+ LittleEndian::write_u32(
	417	+ &mut self.data[command_offset + 4..command_offset + 8],
	418	+ LINKEDIT_DATA_COMMAND_SIZE as u32,
	419	+ );
	420	+ LittleEndian::write_u32(&mut self.data[command_offset + 8..command_offset + 12], 0);
	421	+ LittleEndian::write_u32(&mut self.data[command_offset + 12..command_offset + 16], 0);
	422	+
	423	+ self.ncmds += 1;
	424	+ self.sizeofcmds += LINKEDIT_DATA_COMMAND_SIZE as u32;
	425	+ LittleEndian::write_u32(&mut self.data[16..20], self.ncmds);
	426	+ LittleEndian::write_u32(&mut self.data[20..24], self.sizeofcmds);
	427	+ self.code_signature_command_offset = Some(command_offset);
	428	+
	429	+ Ok(())
	430	+ }
	431	+
	432	+ fn allocate_code_signature(
	433	+ &mut self,
	434	+ command_offset: usize,
	435	+ signature_len: usize,
	436	+ ) -> Result<()> {
	437	+ let linkedit_offset = self.linkedit_command_offset.ok_or_else(\|\| {
	438	+ CodeSignError::macho(&self.path, "missing __LINKEDIT segment for code signature")
	439	+ })?;
	440	+ let linkedit_end = self.linkedit_file_end(linkedit_offset)?;
	441	+ if linkedit_end > self.data.len() {
	442	+ return Err(CodeSignError::macho(
	443	+ &self.path,
	444	+ "__LINKEDIT extends beyond the Mach-O slice",
	445	+ ));
	446	+ }
	447	+
	448	+ let dataoff = align_to(linkedit_end, CODE_SIGNATURE_ALIGNMENT);
	449	+ let padding = dataoff - linkedit_end;
	450	+ self.resize_linkedit_for_new_signature(linkedit_offset, padding, signature_len)?;
	451	+
	452	+ self.data.truncate(linkedit_end);
	453	+ self.data.resize(dataoff + signature_len, 0);
	454	+
	455	+ LittleEndian::write_u32(
	456	+ &mut self.data[command_offset + 8..command_offset + 12],
	457	+ dataoff.try_into().map_err(\|_\| {
	458	+ CodeSignError::macho(&self.path, "code signature offset exceeds u32")
	459	+ })?,
	460	+ );
	461	+ LittleEndian::write_u32(
	462	+ &mut self.data[command_offset + 12..command_offset + 16],
	463	+ signature_len
	464	+ .try_into()
	465	+ .map_err(\|_\| CodeSignError::macho(&self.path, "code signature size exceeds u32"))?,
	466	+ );
	467	+
	468	+ Ok(())
	469	+ }
	470	+
	471	+ fn write_code_signature(&mut self, signature: &[u8]) -> Result<()> {
	472	+ let command_offset = self
	473	+ .code_signature_command_offset
	474	+ .ok_or_else(\|\| CodeSignError::macho(&self.path, "missing LC_CODE_SIGNATURE"))?;
	475	+ let dataoff =
	476	+ LittleEndian::read_u32(&self.data[command_offset + 8..command_offset + 12]) as usize;
	477	+ let datasize =
	478	+ LittleEndian::read_u32(&self.data[command_offset + 12..command_offset + 16]) as usize;
	479	+
	480	+ if signature.len() > datasize {
	481	+ return Err(CodeSignError::macho(
	482	+ &self.path,
	483	+ "encoded signature exceeded reserved LC_CODE_SIGNATURE size",
	484	+ ));
	485	+ }
	486	+
	487	+ let end = checked_add(&self.path, dataoff, datasize, "code signature")?;
	488	+ ensure_len(&self.path, &self.data, end, "code signature")?;
	489	+ self.data[dataoff..dataoff + signature.len()].copy_from_slice(signature);
	490	+ self.data[dataoff + signature.len()..end].fill(0);
	491	+ Ok(())
	492	+ }
	493	+
	494	+ fn zero_signature_region(&mut self, dataoff: usize, datasize: usize) -> Result<()> {
	495	+ let end = checked_add(&self.path, dataoff, datasize, "code signature")?;
	496	+ ensure_len(&self.path, &self.data, end, "code signature")?;
	497	+ self.data[dataoff..end].fill(0);
	498	+ Ok(())
	499	+ }
	500	+
	501	+ fn grow_linkedit_segment(
	502	+ &mut self,
	503	+ command_offset: usize,
	504	+ extra_file_size: usize,
	505	+ extra_vm_size: usize,
	506	+ ) -> Result<()> {
	507	+ let cmd = LittleEndian::read_u32(&self.data[command_offset..command_offset + 4]);
	508	+ match cmd {
	509	+ LC_SEGMENT => {
	510	+ let filesize_offset = command_offset + 36;
	511	+ let vmsize_offset = command_offset + 28;
	512	+ let filesize =
	513	+ LittleEndian::read_u32(&self.data[filesize_offset..filesize_offset + 4])
	514	+ as usize;
	515	+ let vmsize =
	516	+ LittleEndian::read_u32(&self.data[vmsize_offset..vmsize_offset + 4]) as usize;
	517	+ LittleEndian::write_u32(
	518	+ &mut self.data[filesize_offset..filesize_offset + 4],
	519	+ checked_add(&self.path, filesize, extra_file_size, "__LINKEDIT filesize")?
	520	+ .try_into()
	521	+ .map_err(\|_\| {
	522	+ CodeSignError::macho(&self.path, "__LINKEDIT filesize exceeds u32")
	523	+ })?,
	524	+ );
	525	+ LittleEndian::write_u32(
	526	+ &mut self.data[vmsize_offset..vmsize_offset + 4],
	527	+ checked_add(&self.path, vmsize, extra_vm_size, "__LINKEDIT vmsize")?
	528	+ .try_into()
	529	+ .map_err(\|_\| {
	530	+ CodeSignError::macho(&self.path, "__LINKEDIT vmsize exceeds u32")
	531	+ })?,
	532	+ );
	533	+ }
	534	+ LC_SEGMENT_64 => {
	535	+ let filesize_offset = command_offset + 48;
	536	+ let vmsize_offset = command_offset + 32;
	537	+ let filesize =
	538	+ LittleEndian::read_u64(&self.data[filesize_offset..filesize_offset + 8]);
	539	+ let vmsize = LittleEndian::read_u64(&self.data[vmsize_offset..vmsize_offset + 8]);
	540	+ LittleEndian::write_u64(
	541	+ &mut self.data[filesize_offset..filesize_offset + 8],
	542	+ filesize
	543	+ .checked_add(extra_file_size as u64)
	544	+ .ok_or_else(\|\| {
	545	+ CodeSignError::macho(&self.path, "__LINKEDIT filesize overflow")
	546	+ })?,
	547	+ );
	548	+ LittleEndian::write_u64(
	549	+ &mut self.data[vmsize_offset..vmsize_offset + 8],
	550	+ vmsize.checked_add(extra_vm_size as u64).ok_or_else(\|\| {
	551	+ CodeSignError::macho(&self.path, "__LINKEDIT vmsize overflow")
	552	+ })?,
	553	+ );
	554	+ }
	555	+ _ => {
	556	+ return Err(CodeSignError::macho(
	557	+ &self.path,
	558	+ "__LINKEDIT command was not a segment command",
	559	+ ));
	560	+ }
	561	+ }
	562	+
	563	+ Ok(())
	564	+ }
	565	+
	566	+ fn linkedit_file_end(&self, command_offset: usize) -> Result<usize> {
	567	+ let cmd = LittleEndian::read_u32(&self.data[command_offset..command_offset + 4]);
	568	+ match cmd {
	569	+ LC_SEGMENT => {
	570	+ let fileoff =
	571	+ LittleEndian::read_u32(&self.data[command_offset + 32..command_offset + 36])
	572	+ as usize;
	573	+ let filesize =
	574	+ LittleEndian::read_u32(&self.data[command_offset + 36..command_offset + 40])
	575	+ as usize;
	576	+ checked_add(&self.path, fileoff, filesize, "__LINKEDIT end")
	577	+ }
	578	+ LC_SEGMENT_64 => {
	579	+ let fileoff =
	580	+ LittleEndian::read_u64(&self.data[command_offset + 40..command_offset + 48]);
	581	+ let filesize =
	582	+ LittleEndian::read_u64(&self.data[command_offset + 48..command_offset + 56]);
	583	+ let end = fileoff
	584	+ .checked_add(filesize)
	585	+ .ok_or_else(\|\| CodeSignError::macho(&self.path, "__LINKEDIT end overflow"))?;
	586	+ usize::try_from(end)
	587	+ .map_err(\|_\| CodeSignError::macho(&self.path, "__LINKEDIT end exceeds usize"))
	588	+ }
	589	+ _ => Err(CodeSignError::macho(
	590	+ &self.path,
	591	+ "__LINKEDIT command was not a segment command",
	592	+ )),
	593	+ }
	594	+ }
	595	+
	596	+ fn resize_linkedit_for_new_signature(
	597	+ &mut self,
	598	+ command_offset: usize,
	599	+ padding: usize,
	600	+ signature_len: usize,
	601	+ ) -> Result<()> {
	602	+ let extra_file_size = checked_add(
	603	+ &self.path,
	604	+ padding,
	605	+ signature_len,
	606	+ "__LINKEDIT code signature growth",
	607	+ )?;
	608	+ let cmd = LittleEndian::read_u32(&self.data[command_offset..command_offset + 4]);
	609	+
	610	+ match cmd {
	611	+ LC_SEGMENT => {
	612	+ let filesize_offset = command_offset + 36;
	613	+ let vmsize_offset = command_offset + 28;
	614	+ let filesize =
	615	+ LittleEndian::read_u32(&self.data[filesize_offset..filesize_offset + 4])
	616	+ as usize;
	617	+ let vmsize =
	618	+ LittleEndian::read_u32(&self.data[vmsize_offset..vmsize_offset + 4]) as usize;
	619	+ let new_filesize =
	620	+ checked_add(&self.path, filesize, extra_file_size, "__LINKEDIT filesize")?;
	621	+ let new_vmsize = vmsize.max(page_ceil(new_filesize));
	622	+
	623	+ LittleEndian::write_u32(
	624	+ &mut self.data[filesize_offset..filesize_offset + 4],
	625	+ new_filesize.try_into().map_err(\|_\| {
	626	+ CodeSignError::macho(&self.path, "__LINKEDIT filesize exceeds u32")
	627	+ })?,
	628	+ );
	629	+ LittleEndian::write_u32(
	630	+ &mut self.data[vmsize_offset..vmsize_offset + 4],
	631	+ new_vmsize.try_into().map_err(\|_\| {
	632	+ CodeSignError::macho(&self.path, "__LINKEDIT vmsize exceeds u32")
	633	+ })?,
	634	+ );
	635	+ }
	636	+ LC_SEGMENT_64 => {
	637	+ let filesize_offset = command_offset + 48;
	638	+ let vmsize_offset = command_offset + 32;
	639	+ let filesize =
	640	+ LittleEndian::read_u64(&self.data[filesize_offset..filesize_offset + 8]);
	641	+ let vmsize = LittleEndian::read_u64(&self.data[vmsize_offset..vmsize_offset + 8]);
	642	+ let new_filesize =
	643	+ filesize
	644	+ .checked_add(extra_file_size as u64)
	645	+ .ok_or_else(\|\| {
	646	+ CodeSignError::macho(&self.path, "__LINKEDIT filesize overflow")
	647	+ })?;
	648	+ let new_vmsize = vmsize.max(page_ceil_u64(new_filesize));
	649	+
	650	+ LittleEndian::write_u64(
	651	+ &mut self.data[filesize_offset..filesize_offset + 8],
	652	+ new_filesize,
	653	+ );
	654	+ LittleEndian::write_u64(
	655	+ &mut self.data[vmsize_offset..vmsize_offset + 8],
	656	+ new_vmsize,
	657	+ );
	658	+ }
	659	+ _ => {
	660	+ return Err(CodeSignError::macho(
	661	+ &self.path,
	662	+ "__LINKEDIT command was not a segment command",
	663	+ ));
	664	+ }
	665	+ }
	666	+
	667	+ Ok(())
	668	+ }
	669	+}
	670	+
	671	+#[derive(Debug)]
	672	+struct SignedThin {
	673	+ cputype: i32,
	674	+ cpusubtype: i32,
	675	+ data: Vec<u8>,
	676	+}
	677	+
	678	+#[derive(Clone, Debug)]
	679	+struct FatArch {
	680	+ offset: usize,
	681	+ size: usize,
	682	+ align: u32,
	683	+}
	684	+
	685	+#[derive(Debug)]
	686	+struct SignedArch {
	687	+ cputype: i32,
	688	+ cpusubtype: i32,
	689	+ align: u32,
	690	+ data: Vec<u8>,
	691	+}
	692	+
	693	+fn parse_fat_arches(path: &Path, data: &[u8]) -> Result<Option<Vec<FatArch>>> {
	694	+ if data.len() < 4 {
	695	+ return Err(CodeSignError::macho(path, "file is too small"));
	696	+ }
	697	+
	698	+ let magic = BigEndian::read_u32(&data[0..4]);
	699	+ if magic == FAT_MAGIC_64 {
	700	+ return Err(CodeSignError::macho(
	701	+ path,
	702	+ "64-bit fat Mach-O headers are not supported yet",
	703	+ ));
	704	+ }
	705	+ if magic != FAT_MAGIC {
	706	+ return Ok(None);
	707	+ }
	708	+
	709	+ ensure_len(path, data, FAT_HEADER_SIZE, "fat header")?;
	710	+ let nfat_arch = BigEndian::read_u32(&data[4..8]) as usize;
	711	+ let table_len = checked_mul(path, nfat_arch, FAT_ARCH_SIZE, "fat architecture table")?;
	712	+ ensure_len(
	713	+ path,
	714	+ data,
	715	+ FAT_HEADER_SIZE + table_len,
	716	+ "fat architecture table",
	717	+ )?;
	718	+
	719	+ let mut arches = Vec::with_capacity(nfat_arch);
	720	+ for index in 0..nfat_arch {
	721	+ let offset = FAT_HEADER_SIZE + index * FAT_ARCH_SIZE;
	722	+ let arch_offset = BigEndian::read_u32(&data[offset + 8..offset + 12]) as usize;
	723	+ let size = BigEndian::read_u32(&data[offset + 12..offset + 16]) as usize;
	724	+ let align = BigEndian::read_u32(&data[offset + 16..offset + 20]);
	725	+ ensure_len(path, data, arch_offset + size, "fat architecture slice")?;
	726	+ arches.push(FatArch {
	727	+ offset: arch_offset,
	728	+ size,
	729	+ align,
	730	+ });
	731	+ }
	732	+
	733	+ Ok(Some(arches))
	734	+}
	735	+
	736	+fn rebuild_fat(path: &Path, arches: &[SignedArch]) -> Result<Vec<u8>> {
	737	+ let table_len = checked_mul(path, arches.len(), FAT_ARCH_SIZE, "fat architecture table")?;
	738	+ let mut records = Vec::with_capacity(arches.len());
	739	+ let mut cursor = FAT_HEADER_SIZE + table_len;
	740	+
	741	+ for arch in arches {
	742	+ let alignment = arch_alignment(path, arch.align)?;
	743	+ cursor = align_to(cursor, alignment);
	744	+ records.push((cursor, arch));
	745	+ cursor = checked_add(path, cursor, arch.data.len(), "fat Mach-O data")?;
	746	+ }
	747	+
	748	+ if cursor > u32::MAX as usize {
	749	+ return Err(CodeSignError::macho(
	750	+ path,
	751	+ "fat Mach-O exceeds 32-bit offsets",
	752	+ ));
	753	+ }
	754	+
	755	+ let mut out = vec![0; FAT_HEADER_SIZE + table_len];
	756	+ BigEndian::write_u32(&mut out[0..4], FAT_MAGIC);
	757	+ BigEndian::write_u32(&mut out[4..8], arches.len() as u32);
	758	+
	759	+ for (index, (offset, arch)) in records.iter().enumerate() {
	760	+ let record_offset = FAT_HEADER_SIZE + index * FAT_ARCH_SIZE;
	761	+ BigEndian::write_i32(&mut out[record_offset..record_offset + 4], arch.cputype);
	762	+ BigEndian::write_i32(
	763	+ &mut out[record_offset + 4..record_offset + 8],
	764	+ arch.cpusubtype,
	765	+ );
	766	+ BigEndian::write_u32(
	767	+ &mut out[record_offset + 8..record_offset + 12],
	768	+ *offset as u32,
	769	+ );
	770	+ BigEndian::write_u32(
	771	+ &mut out[record_offset + 12..record_offset + 16],
	772	+ arch.data.len() as u32,
	773	+ );
	774	+ BigEndian::write_u32(&mut out[record_offset + 16..record_offset + 20], arch.align);
	775	+ }
	776	+
	777	+ for (offset, arch) in records {
	778	+ out.resize(offset, 0);
	779	+ out.extend_from_slice(&arch.data);
	780	+ }
	781	+
	782	+ Ok(out)
	783	+}
	784	+
	785	+fn parse_segment_32(
	786	+ path: &Path,
	787	+ data: &[u8],
	788	+ offset: usize,
	789	+ cmdsize: usize,
	790	+ linkedit_command_offset: &mut Option<usize>,
	791	+ exec_segment: &mut SegmentBounds,
	792	+ first_section_offset: &mut Option<usize>,
	793	+) -> Result<()> {
	794	+ if cmdsize < 56 {
	795	+ return Err(CodeSignError::macho(path, "LC_SEGMENT is too small"));
	796	+ }
	797	+
	798	+ let name = segment_name(&data[offset + 8..offset + 24]);
	799	+ let fileoff = LittleEndian::read_u32(&data[offset + 32..offset + 36]) as u64;
	800	+ let filesize = LittleEndian::read_u32(&data[offset + 36..offset + 40]) as u64;
	801	+ let nsects = LittleEndian::read_u32(&data[offset + 48..offset + 52]) as usize;
	802	+ if name == "__TEXT" {
	803	+ exec_segment.base = fileoff;
	804	+ exec_segment.limit = fileoff + filesize;
	805	+ } else if name == "__LINKEDIT" {
	806	+ *linkedit_command_offset = Some(offset);
	807	+ }
	808	+
	809	+ let sections_offset = offset + 56;
	810	+ let sections_size = checked_mul(path, nsects, 68, "LC_SEGMENT sections")?;
	811	+ if sections_offset + sections_size > offset + cmdsize {
	812	+ return Err(CodeSignError::macho(
	813	+ path,
	814	+ "LC_SEGMENT sections exceed cmdsize",
	815	+ ));
	816	+ }
	817	+
	818	+ if nsects == 0 {
	819	+ if fileoff != 0 && filesize != 0 {
	820	+ record_first_section_offset(first_section_offset, fileoff as usize);
	821	+ }
	822	+ } else {
	823	+ for index in 0..nsects {
	824	+ let section_offset = sections_offset + index * 68;
	825	+ let size = LittleEndian::read_u32(&data[section_offset + 36..section_offset + 40]);
	826	+ let file_offset =
	827	+ LittleEndian::read_u32(&data[section_offset + 40..section_offset + 44]) as usize;
	828	+ let flags = LittleEndian::read_u32(&data[section_offset + 56..section_offset + 60]);
	829	+ if section_has_file_contents(size as u64, flags) {
	830	+ record_first_section_offset(first_section_offset, file_offset);
	831	+ }
	832	+ }
	833	+ }
	834	+
	835	+ Ok(())
	836	+}
	837	+
	838	+fn parse_segment_64(
	839	+ path: &Path,
	840	+ data: &[u8],
	841	+ offset: usize,
	842	+ cmdsize: usize,
	843	+ linkedit_command_offset: &mut Option<usize>,
	844	+ exec_segment: &mut SegmentBounds,
	845	+ first_section_offset: &mut Option<usize>,
	846	+) -> Result<()> {
	847	+ if cmdsize < 72 {
	848	+ return Err(CodeSignError::macho(path, "LC_SEGMENT_64 is too small"));
	849	+ }
	850	+
	851	+ let name = segment_name(&data[offset + 8..offset + 24]);
	852	+ let fileoff = LittleEndian::read_u64(&data[offset + 40..offset + 48]);
	853	+ let filesize = LittleEndian::read_u64(&data[offset + 48..offset + 56]);
	854	+ let nsects = LittleEndian::read_u32(&data[offset + 64..offset + 68]) as usize;
	855	+
	856	+ if name == "__TEXT" {
	857	+ exec_segment.base = fileoff;
	858	+ exec_segment.limit = fileoff + filesize;
	859	+ } else if name == "__LINKEDIT" {
	860	+ *linkedit_command_offset = Some(offset);
	861	+ }
	862	+
	863	+ let sections_offset = offset + 72;
	864	+ let sections_size = checked_mul(path, nsects, 80, "LC_SEGMENT_64 sections")?;
	865	+ if sections_offset + sections_size > offset + cmdsize {
	866	+ return Err(CodeSignError::macho(
	867	+ path,
	868	+ "LC_SEGMENT_64 sections exceed cmdsize",
	869	+ ));
	870	+ }
	871	+
	872	+ if nsects == 0 {
	873	+ if fileoff != 0 && filesize != 0 {
	874	+ record_first_section_offset(
	875	+ first_section_offset,
	876	+ usize::try_from(fileoff)
	877	+ .map_err(\|_\| CodeSignError::macho(path, "segment file offset exceeds usize"))?,
	878	+ );
	879	+ }
	880	+ } else {
	881	+ for index in 0..nsects {
	882	+ let section_offset = sections_offset + index * 80;
	883	+ let size = LittleEndian::read_u64(&data[section_offset + 40..section_offset + 48]);
	884	+ let file_offset =
	885	+ LittleEndian::read_u32(&data[section_offset + 48..section_offset + 52]) as usize;
	886	+ let flags = LittleEndian::read_u32(&data[section_offset + 68..section_offset + 72]);
	887	+ if section_has_file_contents(size, flags) {
	888	+ record_first_section_offset(first_section_offset, file_offset);
	889	+ }
	890	+ }
	891	+ }
	892	+
	893	+ Ok(())
	894	+}
	895	+
	896	+fn section_has_file_contents(size: u64, flags: u32) -> bool {
	897	+ let section_type = flags & SECTION_TYPE;
	898	+ size != 0 && section_type != S_ZEROFILL && section_type != S_THREAD_LOCAL_ZEROFILL
	899	+}
	900	+
	901	+fn record_first_section_offset(first_section_offset: &mut Option<usize>, file_offset: usize) {
	902	+ if file_offset == 0 {
	903	+ return;
	904	+ }
	905	+
	906	+ match first_section_offset {
	907	+ Some(existing) if *existing <= file_offset => {}
	908	+ _ => *first_section_offset = Some(file_offset),
	909	+ }
	910	+}
	911	+
	912	+fn segment_name(bytes: &[u8]) -> &str {
	913	+ let end = bytes
	914	+ .iter()
	915	+ .position(\|byte\| *byte == 0)
	916	+ .unwrap_or(bytes.len());
	917	+ std::str::from_utf8(&bytes[..end]).unwrap_or("")
	918	+}
	919	+
	920	+fn ensure_len(path: &Path, data: &[u8], required: usize, what: &str) -> Result<()> {
	921	+ if data.len() < required {
	922	+ return Err(CodeSignError::macho(
	923	+ path,
	924	+ format!(
	925	+ "{what} requires {required} bytes, file only has {}",
	926	+ data.len()
	927	+ ),
	928	+ ));
	929	+ }
	930	+ Ok(())
	931	+}
	932	+
	933	+fn checked_add(path: &Path, a: usize, b: usize, what: &str) -> Result<usize> {
	934	+ a.checked_add(b)
	935	+ .ok_or_else(\|\| CodeSignError::macho(path, format!("{what} offset overflow")))
	936	+}
	937	+
	938	+fn checked_mul(path: &Path, a: usize, b: usize, what: &str) -> Result<usize> {
	939	+ a.checked_mul(b)
	940	+ .ok_or_else(\|\| CodeSignError::macho(path, format!("{what} size overflow")))
	941	+}
	942	+
	943	+fn page_ceil(value: usize) -> usize {
	944	+ align_to(value, PAGE_SIZE)
	945	+}
	946	+
	947	+fn page_ceil_u64(value: u64) -> u64 {
	948	+ let alignment = PAGE_SIZE as u64;
	949	+ value.saturating_add(alignment - 1) & !(alignment - 1)
	950	+}
	951	+
	952	+fn align_to(value: usize, alignment: usize) -> usize {
	953	+ debug_assert!(alignment.is_power_of_two());
	954	+ (value + alignment - 1) & !(alignment - 1)
	955	+}
	956	+
	957	+fn arch_alignment(path: &Path, align: u32) -> Result<usize> {
	958	+ 1usize
	959	+ .checked_shl(align)
	960	+ .filter(\|alignment\| *alignment > 0)
	961	+ .ok_or_else(\|\| CodeSignError::macho(path, format!("invalid fat arch alignment {align}")))
	962	+}
	963	+
	964	+#[cfg(test)]
	965	+mod tests {
	966	+ use super::*;
	967	+ use crate::signature::{CSMAGIC_EMBEDDED_SIGNATURE, CmsSigningRequest};
	968	+
	969	+ const CPU_TYPE_ARM64_TEST: i32 = 0x0100_000c;
	970	+
	971	+ struct TestCmsSigner;
	972	+
	973	+ impl CmsSigner for TestCmsSigner {
	974	+ fn sign(&self, _: CmsSigningRequest<'_>) -> Result<Vec<u8>> {
	975	+ Ok(vec![0x30, 0x00])
	976	+ }
	977	+ }
	978	+
	979	+ #[test]
	980	+ fn signs_thin_macho_by_growing_existing_code_signature() {
	981	+ let macho = minimal_macho_with_empty_signature();
	982	+ let entitlements = Dictionary::new();
	983	+ let config = MachOSigningConfig::new("com.example.test", "TEAMID", &entitlements, None);
	984	+
	985	+ let signed = sign_macho_data(Path::new("TestBinary"), &macho, &config).unwrap();
	986	+
	987	+ let code_sig_cmd = 32 + 72 + 72;
	988	+ let dataoff = LittleEndian::read_u32(&signed[code_sig_cmd + 8..code_sig_cmd + 12]) as usize;
	989	+ let datasize =
	990	+ LittleEndian::read_u32(&signed[code_sig_cmd + 12..code_sig_cmd + 16]) as usize;
	991	+
	992	+ assert!(datasize > 0);
	993	+ assert_eq!(signed.len(), dataoff + datasize);
	994	+ assert_eq!(
	995	+ BigEndian::read_u32(&signed[dataoff..dataoff + 4]),
	996	+ CSMAGIC_EMBEDDED_SIGNATURE
	997	+ );
	998	+ }
	999	+
	1000	+ #[test]
	1001	+ fn cms_reservation_is_zero_padding_after_superblob() {
	1002	+ let macho = minimal_macho_with_empty_signature();
	1003	+ let entitlements = Dictionary::new();
	1004	+ let signer = TestCmsSigner;
	1005	+ let mut config =
	1006	+ MachOSigningConfig::new("com.example.test", "TEAMID", &entitlements, Some(&signer));
	1007	+ config.cms_blob_reservation = 1024;
	1008	+
	1009	+ let signed = sign_macho_data(Path::new("TestBinary"), &macho, &config).unwrap();
	1010	+ let code_sig_cmd = 32 + 72 + 72;
	1011	+ let dataoff = LittleEndian::read_u32(&signed[code_sig_cmd + 8..code_sig_cmd + 12]) as usize;
	1012	+ let datasize =
	1013	+ LittleEndian::read_u32(&signed[code_sig_cmd + 12..code_sig_cmd + 16]) as usize;
	1014	+ let superblob_len = BigEndian::read_u32(&signed[dataoff + 4..dataoff + 8]) as usize;
	1015	+
	1016	+ assert!(superblob_len < datasize);
	1017	+ assert!(
	1018	+ signed[dataoff + superblob_len..dataoff + datasize]
	1019	+ .iter()
	1020	+ .all(\|byte\| *byte == 0)
	1021	+ );
	1022	+ }
	1023	+
	1024	+ #[test]
	1025	+ fn allocates_code_signature_command_when_headerpad_exists() {
	1026	+ let macho = minimal_macho_without_signature(128);
	1027	+ let entitlements = Dictionary::new();
	1028	+ let config = MachOSigningConfig::new("com.example.test", "TEAMID", &entitlements, None);
	1029	+
	1030	+ let signed = sign_macho_data(Path::new("HeaderPaddedBinary"), &macho, &config).unwrap();
	1031	+
	1032	+ let code_sig_cmd = 32 + 152 + 72;
	1033	+ assert_eq!(
	1034	+ LittleEndian::read_u32(&signed[code_sig_cmd..code_sig_cmd + 4]),
	1035	+ LC_CODE_SIGNATURE
	1036	+ );
	1037	+
	1038	+ let dataoff = LittleEndian::read_u32(&signed[code_sig_cmd + 8..code_sig_cmd + 12]) as usize;
	1039	+ let datasize =
	1040	+ LittleEndian::read_u32(&signed[code_sig_cmd + 12..code_sig_cmd + 16]) as usize;
	1041	+ let linkedit_cmd = 32 + 152;
	1042	+ let linkedit_filesize =
	1043	+ LittleEndian::read_u64(&signed[linkedit_cmd + 48..linkedit_cmd + 56]);
	1044	+
	1045	+ assert_eq!(dataoff % CODE_SIGNATURE_ALIGNMENT, 0);
	1046	+ assert!(datasize > 0);
	1047	+ assert_eq!(signed.len(), dataoff + datasize);
	1048	+ assert_eq!(linkedit_filesize as usize, signed.len() - 512);
	1049	+ assert_eq!(
	1050	+ BigEndian::read_u32(&signed[dataoff..dataoff + 4]),
	1051	+ CSMAGIC_EMBEDDED_SIGNATURE
	1052	+ );
	1053	+ }
	1054	+
	1055	+ #[test]
	1056	+ fn refuses_to_add_code_signature_command_without_headerpad() {
	1057	+ let macho = minimal_macho_without_signature(0);
	1058	+ let entitlements = Dictionary::new();
	1059	+ let config = MachOSigningConfig::new("com.example.test", "TEAMID", &entitlements, None);
	1060	+
	1061	+ let err = sign_macho_data(Path::new("TightBinary"), &macho, &config).unwrap_err();
	1062	+
	1063	+ assert!(matches!(
	1064	+ err,
	1065	+ CodeSignError::NeedsCodeSignatureAllocation { .. }
	1066	+ ));
	1067	+ }
	1068	+
	1069	+ fn minimal_macho_with_empty_signature() -> Vec<u8> {
	1070	+ let sizeofcmds = 72 + 72 + 16;
	1071	+ let dataoff = 512usize;
	1072	+ let mut data = vec![0; dataoff];
	1073	+
	1074	+ LittleEndian::write_u32(&mut data[0..4], MH_MAGIC_64);
	1075	+ LittleEndian::write_i32(&mut data[4..8], CPU_TYPE_ARM64_TEST);
	1076	+ LittleEndian::write_i32(&mut data[8..12], 0);
	1077	+ LittleEndian::write_u32(&mut data[12..16], MH_EXECUTE);
	1078	+ LittleEndian::write_u32(&mut data[16..20], 3);
	1079	+ LittleEndian::write_u32(&mut data[20..24], sizeofcmds as u32);
	1080	+
	1081	+ write_segment_64(&mut data, 32, "__TEXT", 0, dataoff as u64);
	1082	+ write_segment_64(&mut data, 32 + 72, "__LINKEDIT", dataoff as u64, 0);
	1083	+
	1084	+ let code_sig_cmd = 32 + 72 + 72;
	1085	+ LittleEndian::write_u32(&mut data[code_sig_cmd..code_sig_cmd + 4], LC_CODE_SIGNATURE);
	1086	+ LittleEndian::write_u32(
	1087	+ &mut data[code_sig_cmd + 4..code_sig_cmd + 8],
	1088	+ LINKEDIT_DATA_COMMAND_SIZE as u32,
	1089	+ );
	1090	+ LittleEndian::write_u32(
	1091	+ &mut data[code_sig_cmd + 8..code_sig_cmd + 12],
	1092	+ dataoff as u32,
	1093	+ );
	1094	+ LittleEndian::write_u32(&mut data[code_sig_cmd + 12..code_sig_cmd + 16], 0);
	1095	+
	1096	+ data
	1097	+ }
	1098	+
	1099	+ fn minimal_macho_without_signature(headerpad: usize) -> Vec<u8> {
	1100	+ let sizeofcmds = 152 + 72;
	1101	+ let content_offset = 32 + sizeofcmds + headerpad;
	1102	+ let linkedit_offset = 512usize;
	1103	+ let mut data = vec![0; linkedit_offset + 33];
	1104	+
	1105	+ LittleEndian::write_u32(&mut data[0..4], MH_MAGIC_64);
	1106	+ LittleEndian::write_i32(&mut data[4..8], CPU_TYPE_ARM64_TEST);
	1107	+ LittleEndian::write_i32(&mut data[8..12], 0);
	1108	+ LittleEndian::write_u32(&mut data[12..16], MH_EXECUTE);
	1109	+ LittleEndian::write_u32(&mut data[16..20], 2);
	1110	+ LittleEndian::write_u32(&mut data[20..24], sizeofcmds as u32);
	1111	+
	1112	+ write_segment_64_with_section(
	1113	+ &mut data,
	1114	+ 32,
	1115	+ "__TEXT",
	1116	+ 0,
	1117	+ linkedit_offset as u64,
	1118	+ content_offset as u32,
	1119	+ 1,
	1120	+ );
	1121	+ write_segment_64(
	1122	+ &mut data,
	1123	+ 32 + 152,
	1124	+ "__LINKEDIT",
	1125	+ linkedit_offset as u64,
	1126	+ 33,
	1127	+ );
	1128	+
	1129	+ data[content_offset] = 0xaa;
	1130	+ data[linkedit_offset] = 0xbb;
	1131	+ data
	1132	+ }
	1133	+
	1134	+ fn write_segment_64(data: &mut [u8], offset: usize, name: &str, fileoff: u64, filesize: u64) {
	1135	+ LittleEndian::write_u32(&mut data[offset..offset + 4], LC_SEGMENT_64);
	1136	+ LittleEndian::write_u32(&mut data[offset + 4..offset + 8], 72);
	1137	+ data[offset + 8..offset + 8 + name.len()].copy_from_slice(name.as_bytes());
	1138	+ LittleEndian::write_u64(&mut data[offset + 24..offset + 32], 0);
	1139	+ LittleEndian::write_u64(
	1140	+ &mut data[offset + 32..offset + 40],
	1141	+ page_ceil(filesize as usize) as u64,
	1142	+ );
	1143	+ LittleEndian::write_u64(&mut data[offset + 40..offset + 48], fileoff);
	1144	+ LittleEndian::write_u64(&mut data[offset + 48..offset + 56], filesize);
	1145	+ LittleEndian::write_u32(&mut data[offset + 64..offset + 68], 0);
	1146	+ }
	1147	+
	1148	+ fn write_segment_64_with_section(
	1149	+ data: &mut [u8],
	1150	+ offset: usize,
	1151	+ name: &str,
	1152	+ fileoff: u64,
	1153	+ filesize: u64,
	1154	+ section_offset: u32,
	1155	+ section_size: u64,
	1156	+ ) {
	1157	+ LittleEndian::write_u32(&mut data[offset..offset + 4], LC_SEGMENT_64);
	1158	+ LittleEndian::write_u32(&mut data[offset + 4..offset + 8], 152);
	1159	+ data[offset + 8..offset + 8 + name.len()].copy_from_slice(name.as_bytes());
	1160	+ LittleEndian::write_u64(&mut data[offset + 24..offset + 32], 0);
	1161	+ LittleEndian::write_u64(
	1162	+ &mut data[offset + 32..offset + 40],
	1163	+ page_ceil(filesize as usize) as u64,
	1164	+ );
	1165	+ LittleEndian::write_u64(&mut data[offset + 40..offset + 48], fileoff);
	1166	+ LittleEndian::write_u64(&mut data[offset + 48..offset + 56], filesize);
	1167	+ LittleEndian::write_u32(&mut data[offset + 64..offset + 68], 1);
	1168	+
	1169	+ let section = offset + 72;
	1170	+ LittleEndian::write_u64(&mut data[section + 32..section + 40], 0);
	1171	+ LittleEndian::write_u64(&mut data[section + 40..section + 48], section_size);
	1172	+ LittleEndian::write_u32(&mut data[section + 48..section + 52], section_offset);
	1173	+ LittleEndian::write_u32(&mut data[section + 68..section + 72], 0);
	1174	+ }
	1175	+}

apple-codesign-quick/src/main.rs

View file @ 65cd6c1

@@ -1,126 +1,216 @@
-use futures::future::join_all;
-use futures::{FutureExt, future::BoxFuture};
-use log::warn;
-use plist::{Dictionary, Value};
-use sha1::Digest as _;
-use sha2::Digest as _;
+use apple_codesign::{
+    BundleSigningSettings, CodeSignError, ProvisioningProfile, Result, RustCryptoCmsSigner,
+    sign_bundle,
+};
+use std::collections::BTreeMap;
+use std::ffi::OsString;
 use std::fs;
 use std::path::{Path, PathBuf};
-use tokio::task::{block_in_place, spawn_blocking};
-
-struct Bundle {
-    path: PathBuf,
-}
-
-impl Bundle {
-    async fn code_resources(&self) -> Dictionary {
-        struct CodeResourceFile {
-            path: PathBuf,
-            sha1: Vec<u8>,
-            sha256: Vec<u8>,
-        }
-
-        async fn hash_file(relative_path: PathBuf, path: PathBuf) -> CodeResourceFile {
-            let file_data = fs::read(&path).unwrap(); // FIXME unwrap
-            let file_data2 = file_data.clone();
-            let sha1 = spawn_blocking(move || sha1::Sha1::digest(&file_data)[..].into());
-            let sha256 = spawn_blocking(move || sha2::Sha256::digest(&file_data2)[..].into());
-            CodeResourceFile {
-                path: relative_path,
-                sha1: sha1.await.unwrap(),
-                sha256: sha256.await.unwrap(),
-            }
-        }
-
-        fn resources_for_directory(
-            root: &Path,
-            directory: PathBuf,
-        ) -> Vec<BoxFuture<'static, CodeResourceFile>> {
-            let mut output = Vec::new();
-            let mut subfolders = Vec::new();
-            if let Ok(read_dir) = fs::read_dir(directory) {
-                for entry in read_dir {
-                    if let Ok(entry) = entry {
-                        let metadata = entry.metadata().expect("metadata call failed");
-                        let path = entry.path();
-                        if metadata.is_file() {
-                            if let Ok(relative_path) = entry.path().strip_prefix(root) {
-                                // TODO check rules
-                                output.push(hash_file(relative_path.to_path_buf(), path).boxed());
-                            } else {
-                                warn!("Skipping {:?} as its prefix is not correct", entry.path());
-                            }
-                        } else if metadata.is_dir() {
-                            subfolders.push(resources_for_directory(root, path));
-                        }
+
+fn main() -> Result<()> {
+    let Some(args) = CliArgs::parse()? else {
+        print_usage();
+        return Ok(());
+    };
+
+    let mobileprovision = read_file(&args.mobileprovision)?;
+    let profile = ProvisioningProfile::parse(&mobileprovision)?;
+    let private_key = read_der_or_pem(&args.private_key, &["PRIVATE KEY", "RSA PRIVATE KEY"])?;
+    let certificate = read_der_or_pem(&args.certificate, &["CERTIFICATE"])?;
+    let mut certificate_chain =
+        Vec::with_capacity(args.certificate_chain.len() + profile.certificate_chain_der().len());
+
+    for certificate in &args.certificate_chain {
+        certificate_chain.push(read_der_or_pem(certificate, &["CERTIFICATE"])?);
+    }
+    certificate_chain.extend(profile.certificate_chain_der().iter().cloned());
+
+    let signer = RustCryptoCmsSigner::from_der(
+        &private_key,
+        &certificate,
+        certificate_chain.iter().map(Vec::as_slice),
+    )?;
+
+    let team_id = args
+        .team_id
+        .as_deref()
+        .unwrap_or_else(|| profile.team_id())
+        .to_string();
+    let mut settings =
+        BundleSigningSettings::new(team_id, profile.entitlements().clone(), Some(&signer));
+    settings.embedded_mobileprovision = Some(&mobileprovision);
+    let nested_profiles = args
+        .profiles_by_bundle_id
+        .iter()
+        .map(|(bundle_id, path)| {
+            let data = read_file(path)?;
+            let profile = ProvisioningProfile::parse(&data)?;
+            let entitlements = profile.entitlements().clone();
+            Ok((bundle_id.clone(), data, entitlements))
+        })
+        .collect::<Result<Vec<_>>>()?;
+    settings.embedded_mobileprovisions_by_bundle_id = nested_profiles
+        .iter()
+        .map(|(bundle_id, data, _)| (bundle_id.clone(), data.as_slice()))
+        .collect::<BTreeMap<_, _>>();
+    settings.entitlements_by_bundle_id = nested_profiles
+        .iter()
+        .map(|(bundle_id, _, entitlements)| (bundle_id.clone(), entitlements.clone()))
+        .collect();
+    if let Some(reservation) = args.cms_blob_reservation {
+        settings.cms_blob_reservation = reservation;
+    }
+
+    sign_bundle(args.bundle, &settings)
+}
+
+#[derive(Debug)]
+struct CliArgs {
+    bundle: PathBuf,
+    certificate: PathBuf,
+    private_key: PathBuf,
+    mobileprovision: PathBuf,
+    certificate_chain: Vec<PathBuf>,
+    profiles_by_bundle_id: Vec<(String, PathBuf)>,
+    team_id: Option<String>,
+    cms_blob_reservation: Option<usize>,
+}
+
+impl CliArgs {
+    fn parse() -> Result<Option<Self>> {
+        let raw_args: Vec<OsString> = std::env::args_os().skip(1).collect();
+        if raw_args.is_empty() || raw_args.iter().any(|arg| arg == "-h" || arg == "--help") {
+            return Ok(None);
+        }
+
+        let mut bundle = None;
+        let mut certificate = None;
+        let mut private_key = None;
+        let mut mobileprovision = None;
+        let mut certificate_chain = Vec::new();
+        let mut profiles_by_bundle_id = Vec::new();
+        let mut team_id = None;
+        let mut cms_blob_reservation = None;
+
+        let mut args = raw_args.into_iter();
+        while let Some(arg) = args.next() {
+            match arg.to_string_lossy().as_ref() {
+                "--bundle" | "-b" => set_path_arg(&mut bundle, "--bundle", args.next())?,
+                "--certificate" | "--cert" | "-c" => {
+                    set_path_arg(&mut certificate, "--certificate", args.next())?
+                }
+                "--private-key" | "--key" | "-k" => {
+                    set_path_arg(&mut private_key, "--private-key", args.next())?
+                }
+                "--mobileprovision" | "--profile" | "-m" => {
+                    set_path_arg(&mut mobileprovision, "--mobileprovision", args.next())?
+                }
+                "--chain" => certificate_chain.push(next_path_arg("--chain", args.next())?),
+                "--profile-for" => profiles_by_bundle_id.push(next_profile_arg(args.next())?),
+                "--team-id" => {
+                    team_id = Some(next_string_arg("--team-id", args.next())?);
+                }
+                "--cms-reservation" => {
+                    let value = next_string_arg("--cms-reservation", args.next())?;
+                    cms_blob_reservation = Some(value.parse().map_err(|_| {
+                        CodeSignError::Argument(format!(
+                            "--cms-reservation must be a byte count, got {value}"
+                        ))
+                    })?);
+                }
+                value if value.starts_with('-') => {
+                    return Err(CodeSignError::Argument(format!("unknown argument {value}")));
+                }
+                _ if bundle.is_none() => {
+                    bundle = Some(PathBuf::from(arg));
+                }
+                value => {
+                    return Err(CodeSignError::Argument(format!(
+                        "unexpected positional argument {value}"
+                    )));
+                }
+            }
+        }
+
+        Ok(Some(Self {
+            bundle: required_path(bundle, "--bundle")?,
+            certificate: required_path(certificate, "--certificate")?,
+            private_key: required_path(private_key, "--private-key")?,
+            mobileprovision: required_path(mobileprovision, "--mobileprovision")?,
+            certificate_chain,
+            profiles_by_bundle_id,
+            team_id,
+            cms_blob_reservation,
+        }))
+    }
 }
+
+fn next_profile_arg(value: Option<OsString>) -> Result<(String, PathBuf)> {
+    let value = next_string_arg("--profile-for", value)?;
+    let (bundle_id, path) = value.split_once('=').ok_or_else(|| {
+        CodeSignError::Argument("--profile-for requires BUNDLE_IDENTIFIER=PROFILE_PATH".to_string())
+    })?;
+    if bundle_id.trim().is_empty() || path.trim().is_empty() {
+        return Err(CodeSignError::Argument(
+            "--profile-for requires non-empty bundle identifier and path".to_string(),
+        ));
     }
+    Ok((bundle_id.to_string(), PathBuf::from(path)))
 }
 
-            for subfolder in subfolders {
-                let data = subfolder;
-                output.extend(data);
+fn set_path_arg(slot: &mut Option<PathBuf>, name: &str, value: Option<OsString>) -> Result<()> {
+    if slot.is_some() {
+        return Err(CodeSignError::Argument(format!(
+            "{name} was provided twice"
+        )));
     }
-            output
+    *slot = Some(next_path_arg(name, value)?);
+    Ok(())
 }
 
-        let path_buf = self.path.to_path_buf();
-        let resources = resources_for_directory(&self.path, path_buf);
-
-        let rules = Dictionary::new();
-        let rules2 = Dictionary::new();
-
-        let (files, files2) = {
-            let mut files = Dictionary::new();
-            let mut files2 = Dictionary::new();
-
-            for res in resources {
-                let CodeResourceFile { path, sha1, sha256 } = res.await;
-
-                let path = path.to_string_lossy().into_owned();
-
-                let sha1: Vec<u8> = sha1.into();
-                let sha256: Vec<u8> = sha256.into();
-
-                files.insert(path.clone(), Value::Data(sha1.clone()));
-
-                let mut file2 = Dictionary::new();
-                file2.insert("hash".to_string(), Value::Data(sha1));
-                file2.insert("hash2".to_string(), Value::Data(sha256));
-
-                files2.insert(path, Value::Dictionary(file2));
+fn next_path_arg(name: &str, value: Option<OsString>) -> Result<PathBuf> {
+    value
+        .map(PathBuf::from)
+        .ok_or_else(|| CodeSignError::Argument(format!("{name} requires a value")))
 }
 
-            (files, files2)
-        };
-
-        let code_resources = {
-            let mut code_resources = Dictionary::new();
-            code_resources.insert("files".to_string(), Value::Dictionary(files));
-            code_resources.insert("files2".to_string(), Value::Dictionary(files2));
-            code_resources.insert("rules".to_string(), Value::Dictionary(rules));
-            code_resources.insert("rules2".to_string(), Value::Dictionary(rules2));
+fn next_string_arg(name: &str, value: Option<OsString>) -> Result<String> {
+    let value = value.ok_or_else(|| CodeSignError::Argument(format!("{name} requires a value")))?;
+    value
+        .into_string()
+        .map_err(|_| CodeSignError::Argument(format!("{name} must be valid UTF-8")))
+}
 
-            code_resources
-        };
+fn required_path(value: Option<PathBuf>, name: &str) -> Result<PathBuf> {
+    value.ok_or_else(|| CodeSignError::Argument(format!("missing required {name}")))
+}
 
-        code_resources
+fn read_file(path: &Path) -> Result<Vec<u8>> {
+    fs::read(path).map_err(|source| CodeSignError::Io {
+        path: path.to_path_buf(),
+        source,
+    })
 }
 
-    async fn sign(&self) {
-        let code_resources = self.code_resources().await;
+fn read_der_or_pem(path: &Path, allowed_labels: &[&str]) -> Result<Vec<u8>> {
+    let data = read_file(path)?;
+    if !data.starts_with(b"-----BEGIN ") {
+        return Ok(data);
+    }
 
-        let mut data = Vec::<u8>::new();
-        plist::to_writer_xml(&mut data, &code_resources).expect("TODO: panic message");
-        println!("{}", String::from_utf8(data).unwrap());
+    let (label, der) = pem_rfc7468::decode_vec(&data)
+        .map_err(|err| CodeSignError::Argument(format!("failed to decode PEM {path:?}: {err}")))?;
+    if allowed_labels.contains(&label) {
+        Ok(der)
+    } else {
+        Err(CodeSignError::Argument(format!(
+            "unsupported PEM label {label:?} in {path:?}; expected one of {allowed_labels:?}"
+        )))
     }
 }
 
-#[tokio::main]
-async fn main() {
-    Bundle {
-        path: "/home/dadoum/Téléchargements/YouTube.app/".into(),
-    }
-    .sign()
-    .await;
+fn print_usage() {
+    eprintln!(
+        "usage: apple-codesign --bundle Bundle.app --certificate signer.cer --private-key signer.key --mobileprovision profile.mobileprovision [--profile-for BUNDLE_IDENTIFIER=PROFILE_PATH ...] [--chain wwdr.cer ...] [--team-id TEAMID] [--cms-reservation BYTES]"
+    );
 }

apple-codesign-quick/src/provisioning.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,128 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use cms::cert::CertificateChoices;
	3	+use cms::content_info::ContentInfo;
	4	+use cms::signed_data::SignedData;
	5	+use der::{Decode, Encode};
	6	+use plist::{Dictionary, Value};
	7	+
	8	+#[derive(Clone, Debug)]
	9	+pub struct ProvisioningProfile {
	10	+ plist: Dictionary,
	11	+ team_id: String,
	12	+ entitlements: Dictionary,
	13	+ certificate_chain: Vec<Vec<u8>>,
	14	+}
	15	+
	16	+impl ProvisioningProfile {
	17	+ pub fn parse(data: &[u8]) -> Result<Self> {
	18	+ let signed_data = decode_signed_data(data)?;
	19	+ let profile_data = signed_data
	20	+ .encap_content_info
	21	+ .econtent
	22	+ .as_ref()
	23	+ .ok_or_else(\|\| {
	24	+ CodeSignError::provisioning_profile("CMS SignedData has no embedded plist")
	25	+ })?;
	26	+ let plist = match Value::from_reader_xml(profile_data.value())? {
	27	+ Value::Dictionary(plist) => plist,
	28	+ _ => {
	29	+ return Err(CodeSignError::provisioning_profile(
	30	+ "embedded plist is not a dictionary",
	31	+ ));
	32	+ }
	33	+ };
	34	+
	35	+ let team_id = team_identifier(&plist)?;
	36	+ let entitlements = match plist.get("Entitlements") {
	37	+ Some(Value::Dictionary(entitlements)) => entitlements.clone(),
	38	+ _ => {
	39	+ return Err(CodeSignError::provisioning_profile(
	40	+ "profile is missing Entitlements dictionary",
	41	+ ));
	42	+ }
	43	+ };
	44	+ let certificate_chain = certificate_chain_der(&signed_data)?;
	45	+
	46	+ Ok(Self {
	47	+ plist,
	48	+ team_id,
	49	+ entitlements,
	50	+ certificate_chain,
	51	+ })
	52	+ }
	53	+
	54	+ pub fn plist(&self) -> &Dictionary {
	55	+ &self.plist
	56	+ }
	57	+
	58	+ pub fn team_id(&self) -> &str {
	59	+ &self.team_id
	60	+ }
	61	+
	62	+ pub fn entitlements(&self) -> &Dictionary {
	63	+ &self.entitlements
	64	+ }
	65	+
	66	+ pub fn certificate_chain_der(&self) -> &[Vec<u8>] {
	67	+ &self.certificate_chain
	68	+ }
	69	+}
	70	+
	71	+fn decode_signed_data(data: &[u8]) -> Result<SignedData> {
	72	+ let content_info = ContentInfo::from_der(data).map_err(\|err\| {
	73	+ CodeSignError::provisioning_profile(format!("failed to decode CMS ContentInfo: {err}"))
	74	+ })?;
	75	+ if content_info.content_type != const_oid::db::rfc5911::ID_SIGNED_DATA {
	76	+ return Err(CodeSignError::provisioning_profile(
	77	+ "CMS ContentInfo is not SignedData",
	78	+ ));
	79	+ }
	80	+
	81	+ let signed_data = content_info.content.to_der().map_err(\|err\| {
	82	+ CodeSignError::provisioning_profile(format!("failed to re-encode SignedData: {err}"))
	83	+ })?;
	84	+ SignedData::from_der(&signed_data).map_err(\|err\| {
	85	+ CodeSignError::provisioning_profile(format!("failed to decode CMS SignedData: {err}"))
	86	+ })
	87	+}
	88	+
	89	+fn team_identifier(plist: &Dictionary) -> Result<String> {
	90	+ plist
	91	+ .get("TeamIdentifier")
	92	+ .and_then(Value::as_array)
	93	+ .and_then(\|values\| values.first())
	94	+ .and_then(Value::as_string)
	95	+ .map(ToString::to_string)
	96	+ .or_else(\|\| {
	97	+ plist
	98	+ .get("ApplicationIdentifierPrefix")
	99	+ .and_then(Value::as_array)
	100	+ .and_then(\|values\| values.first())
	101	+ .and_then(Value::as_string)
	102	+ .map(ToString::to_string)
	103	+ })
	104	+ .ok_or_else(\|\| {
	105	+ CodeSignError::provisioning_profile(
	106	+ "profile is missing TeamIdentifier/ApplicationIdentifierPrefix",
	107	+ )
	108	+ })
	109	+}
	110	+
	111	+fn certificate_chain_der(signed_data: &SignedData) -> Result<Vec<Vec<u8>>> {
	112	+ let Some(certificates) = &signed_data.certificates else {
	113	+ return Ok(Vec::new());
	114	+ };
	115	+ let mut out = Vec::with_capacity(certificates.0.len());
	116	+
	117	+ for certificate in certificates.0.iter() {
	118	+ if let CertificateChoices::Certificate(certificate) = certificate {
	119	+ out.push(certificate.to_der().map_err(\|err\| {
	120	+ CodeSignError::provisioning_profile(format!(
	121	+ "failed to encode CMS certificate: {err}"
	122	+ ))
	123	+ })?);
	124	+ }
	125	+ }
	126	+
	127	+ Ok(out)
	128	+}

apple-codesign-quick/src/rustcrypto_cms.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,467 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use crate::signature::{CmsSigner, CmsSigningRequest, HashAlgorithm};
	3	+use cms::builder::{SignedDataBuilder, SignerInfoBuilder};
	4	+use cms::cert::{CertificateChoices, IssuerAndSerialNumber};
	5	+use cms::signed_data::{EncapsulatedContentInfo, SignerIdentifier};
	6	+use const_oid::ObjectIdentifier;
	7	+use der::asn1::{Any, ObjectIdentifier as DerObjectIdentifier, OctetStringRef, SetOfVec};
	8	+use der::{DateTime, Decode, Encode, Sequence};
	9	+use plist::{Dictionary, Value};
	10	+use rsa::RsaPrivateKey;
	11	+use rsa::pkcs1::DecodeRsaPrivateKey;
	12	+use rsa::pkcs1v15::SigningKey;
	13	+use rsa::pkcs8::DecodePrivateKey;
	14	+use spki::AlgorithmIdentifierOwned;
	15	+use std::fmt::Display;
	16	+use std::time::SystemTime;
	17	+use x509_cert::Certificate;
	18	+use x509_cert::attr::{Attribute, AttributeValue};
	19	+
	20	+const APPLE_CODE_DIRECTORY_HASHES_OID: ObjectIdentifier =
	21	+ ObjectIdentifier::new_unwrap("1.2.840.113635.100.9.1");
	22	+const APPLE_CODE_DIRECTORY_DIGEST_OID: ObjectIdentifier =
	23	+ ObjectIdentifier::new_unwrap("1.2.840.113635.100.9.2");
	24	+const APPLE_WWDR_G3_CERTIFICATE_DER: &[u8] = include_bytes!("../assets/AppleWWDRCAG3.cer");
	25	+const APPLE_ROOT_CERTIFICATE_DER: &[u8] = include_bytes!("../assets/AppleIncRootCertificate.cer");
	26	+
	27	+type RsaSha256SigningKey = SigningKey<sha2_010::Sha256>;
	28	+
	29	+/// CMS signer for Apple Code Signing using RustCrypto's CMS/DER/X.509 crates.
	30	+///
	31	+/// The generated CMS is detached SignedData over the primary CodeDirectory and
	32	+/// includes the Apple-specific CodeDirectory digest attributes that AMFI expects.
	33	+pub struct RustCryptoCmsSigner {
	34	+ signing_key: RsaSha256SigningKey,
	35	+ signer_certificate: Certificate,
	36	+ certificate_chain: Vec<Certificate>,
	37	+ signing_time: Option<SystemTime>,
	38	+}
	39	+
	40	+impl RustCryptoCmsSigner {
	41	+ pub fn new(
	42	+ private_key: RsaPrivateKey,
	43	+ signer_certificate: Certificate,
	44	+ certificate_chain: Vec<Certificate>,
	45	+ ) -> Self {
	46	+ Self {
	47	+ signing_key: RsaSha256SigningKey::new(private_key),
	48	+ signer_certificate,
	49	+ certificate_chain,
	50	+ signing_time: Some(SystemTime::now()),
	51	+ }
	52	+ }
	53	+
	54	+ pub fn from_der<I, C>(
	55	+ private_key_der: &[u8],
	56	+ signer_certificate_der: &[u8],
	57	+ certificate_chain_der: I,
	58	+ ) -> Result<Self>
	59	+ where
	60	+ I: IntoIterator<Item = C>,
	61	+ C: AsRef<[u8]>,
	62	+ {
	63	+ let private_key = decode_rsa_private_key(private_key_der)?;
	64	+ let signer_certificate = Certificate::from_der(signer_certificate_der)
	65	+ .map_err(\|err\| cms_error(format!("failed to decode signer certificate: {err}")))?;
	66	+ let mut certificate_candidates = Vec::new();
	67	+
	68	+ for certificate_der in certificate_chain_der {
	69	+ let certificate = Certificate::from_der(certificate_der.as_ref())
	70	+ .map_err(\|err\| cms_error(format!("failed to decode chain certificate: {err}")))?;
	71	+ push_unique_certificate(&mut certificate_candidates, certificate);
	72	+ }
	73	+
	74	+ for (name, certificate_der) in [
	75	+ ("Apple WWDR G3", APPLE_WWDR_G3_CERTIFICATE_DER),
	76	+ ("Apple Root CA", APPLE_ROOT_CERTIFICATE_DER),
	77	+ ] {
	78	+ let certificate = Certificate::from_der(certificate_der).map_err(\|err\| {
	79	+ cms_error(format!(
	80	+ "failed to decode bundled {name} certificate: {err}"
	81	+ ))
	82	+ })?;
	83	+ push_unique_certificate(&mut certificate_candidates, certificate);
	84	+ }
	85	+
	86	+ let certificate_chain =
	87	+ certificate_chain_for_signer(&signer_certificate, &certificate_candidates)?;
	88	+
	89	+ Ok(Self::new(
	90	+ private_key,
	91	+ signer_certificate,
	92	+ certificate_chain,
	93	+ ))
	94	+ }
	95	+
	96	+ pub fn with_signing_time(mut self, signing_time: SystemTime) -> Self {
	97	+ self.signing_time = Some(signing_time);
	98	+ self
	99	+ }
	100	+
	101	+ pub fn without_signing_time(mut self) -> Self {
	102	+ self.signing_time = None;
	103	+ self
	104	+ }
	105	+
	106	+ pub fn signer_certificate(&self) -> &Certificate {
	107	+ &self.signer_certificate
	108	+ }
	109	+
	110	+ pub fn certificate_chain(&self) -> &[Certificate] {
	111	+ &self.certificate_chain
	112	+ }
	113	+}
	114	+
	115	+impl CmsSigner for RustCryptoCmsSigner {
	116	+ fn sign(&self, request: CmsSigningRequest<'_>) -> Result<Vec<u8>> {
	117	+ let primary_code_directory = request
	118	+ .code_directories
	119	+ .first()
	120	+ .ok_or_else(\|\| cms_error("cannot build CMS without a primary CodeDirectory"))?;
	121	+ let message_digest = HashAlgorithm::Sha256.digest(primary_code_directory.bytes);
	122	+
	123	+ let encapsulated_content_info = EncapsulatedContentInfo {
	124	+ econtent_type: const_oid::db::rfc5911::ID_DATA,
	125	+ econtent: None,
	126	+ };
	127	+ let digest_algorithm = sha256_algorithm_identifier();
	128	+ let signer_identifier = signer_identifier(&self.signer_certificate);
	129	+ let mut signer_info = SignerInfoBuilder::new(
	130	+ &self.signing_key,
	131	+ signer_identifier,
	132	+ digest_algorithm.clone(),
	133	+ &encapsulated_content_info,
	134	+ Some(&message_digest),
	135	+ )
	136	+ .map_err(cms_builder_error)?;
	137	+
	138	+ if let Some(signing_time) = self.signing_time {
	139	+ signer_info
	140	+ .add_signed_attribute(signing_time_attribute(signing_time)?)
	141	+ .map_err(cms_builder_error)?;
	142	+ }
	143	+
	144	+ signer_info
	145	+ .add_signed_attribute(apple_code_directory_digest_attribute(&request)?)
	146	+ .map_err(cms_builder_error)?;
	147	+ signer_info
	148	+ .add_signed_attribute(apple_code_directory_hashes_attribute(&request)?)
	149	+ .map_err(cms_builder_error)?;
	150	+
	151	+ let mut builder = SignedDataBuilder::new(&encapsulated_content_info);
	152	+ builder
	153	+ .add_digest_algorithm(digest_algorithm)
	154	+ .map_err(cms_builder_error)?;
	155	+ add_certificates(
	156	+ &mut builder,
	157	+ &self.signer_certificate,
	158	+ &self.certificate_chain,
	159	+ )?;
	160	+ builder
	161	+ .add_signer_info::<RsaSha256SigningKey, rsa::pkcs1v15::Signature>(signer_info)
	162	+ .map_err(cms_builder_error)?;
	163	+
	164	+ let content_info = builder.build().map_err(cms_builder_error)?;
	165	+ content_info.to_der().map_err(cms_der_error)
	166	+ }
	167	+}
	168	+
	169	+#[derive(Sequence)]
	170	+struct AppleCodeDirectoryDigest<'a> {
	171	+ algorithm: DerObjectIdentifier,
	172	+ digest: OctetStringRef<'a>,
	173	+}
	174	+
	175	+fn decode_rsa_private_key(der: &[u8]) -> Result<RsaPrivateKey> {
	176	+ match RsaPrivateKey::from_pkcs8_der(der) {
	177	+ Ok(private_key) => Ok(private_key),
	178	+ Err(pkcs8_error) => RsaPrivateKey::from_pkcs1_der(der).map_err(\|pkcs1_error\| {
	179	+ cms_error(format!(
	180	+ "failed to decode RSA private key as PKCS#8 ({pkcs8_error}) or PKCS#1 ({pkcs1_error})"
	181	+ ))
	182	+ }),
	183	+ }
	184	+}
	185	+
	186	+fn push_unique_certificate(certificates: &mut Vec<Certificate>, certificate: Certificate) {
	187	+ if !certificates.contains(&certificate) {
	188	+ certificates.push(certificate);
	189	+ }
	190	+}
	191	+
	192	+fn certificate_chain_for_signer(
	193	+ signer_certificate: &Certificate,
	194	+ certificate_candidates: &[Certificate],
	195	+) -> Result<Vec<Certificate>> {
	196	+ if signer_certificate.tbs_certificate.subject == signer_certificate.tbs_certificate.issuer {
	197	+ return Ok(Vec::new());
	198	+ }
	199	+
	200	+ let mut issuer = signer_certificate.tbs_certificate.issuer.clone();
	201	+ let mut certificate_chain = Vec::new();
	202	+
	203	+ loop {
	204	+ let certificate = certificate_candidates
	205	+ .iter()
	206	+ .find(\|candidate\| candidate.tbs_certificate.subject == issuer)
	207	+ .ok_or_else(\|\| {
	208	+ cms_error(format!(
	209	+ "missing issuer certificate {issuer} for the code-signing certificate chain"
	210	+ ))
	211	+ })?
	212	+ .clone();
	213	+
	214	+ if certificate_chain.contains(&certificate) {
	215	+ return Err(cms_error("certificate chain contains a cycle"));
	216	+ }
	217	+
	218	+ let is_root = certificate.tbs_certificate.subject == certificate.tbs_certificate.issuer;
	219	+ issuer = certificate.tbs_certificate.issuer.clone();
	220	+ certificate_chain.push(certificate);
	221	+
	222	+ if is_root {
	223	+ return Ok(certificate_chain);
	224	+ }
	225	+ }
	226	+}
	227	+
	228	+fn add_certificates(
	229	+ builder: &mut SignedDataBuilder<'_>,
	230	+ signer_certificate: &Certificate,
	231	+ certificate_chain: &[Certificate],
	232	+) -> Result<()> {
	233	+ let mut added = Vec::with_capacity(certificate_chain.len() + 1);
	234	+
	235	+ for certificate in certificate_chain
	236	+ .iter()
	237	+ .chain(std::iter::once(signer_certificate))
	238	+ {
	239	+ if added.contains(&certificate) {
	240	+ continue;
	241	+ }
	242	+
	243	+ builder
	244	+ .add_certificate(CertificateChoices::Certificate(certificate.clone()))
	245	+ .map_err(cms_builder_error)?;
	246	+ added.push(certificate);
	247	+ }
	248	+
	249	+ Ok(())
	250	+}
	251	+
	252	+fn signing_time_attribute(signing_time: SystemTime) -> Result<Attribute> {
	253	+ let date_time = DateTime::from_system_time(signing_time).map_err(cms_der_error)?;
	254	+ let time_der = if date_time.year() < 1950 \|\| date_time.year() > 2049 {
	255	+ der::asn1::GeneralizedTime::from_date_time(date_time)
	256	+ .to_der()
	257	+ .map_err(cms_der_error)?
	258	+ } else {
	259	+ der::asn1::UtcTime::from_date_time(date_time)
	260	+ .map_err(cms_der_error)?
	261	+ .to_der()
	262	+ .map_err(cms_der_error)?
	263	+ };
	264	+ let value = AttributeValue::from_der(&time_der).map_err(cms_der_error)?;
	265	+
	266	+ single_value_attribute(const_oid::db::rfc5911::ID_SIGNING_TIME, value)
	267	+}
	268	+
	269	+fn signer_identifier(certificate: &Certificate) -> SignerIdentifier {
	270	+ SignerIdentifier::IssuerAndSerialNumber(IssuerAndSerialNumber {
	271	+ issuer: certificate.tbs_certificate.issuer.clone(),
	272	+ serial_number: certificate.tbs_certificate.serial_number.clone(),
	273	+ })
	274	+}
	275	+
	276	+fn apple_code_directory_digest_attribute(request: &CmsSigningRequest<'_>) -> Result<Attribute> {
	277	+ if !request
	278	+ .code_directories
	279	+ .iter()
	280	+ .any(\|code_directory\| code_directory.algorithm == HashAlgorithm::Sha256)
	281	+ {
	282	+ return Err(cms_error(
	283	+ "cannot build CMS without a SHA-256 CodeDirectory",
	284	+ ));
	285	+ }
	286	+
	287	+ let mut values = Vec::with_capacity(request.code_directories.len());
	288	+ for code_directory in request.code_directories {
	289	+ let digest = code_directory.algorithm.digest(code_directory.bytes);
	290	+ let digest = OctetStringRef::new(&digest).map_err(cms_der_error)?;
	291	+ values.push(
	292	+ Any::encode_from(&AppleCodeDirectoryDigest {
	293	+ algorithm: match code_directory.algorithm {
	294	+ HashAlgorithm::Sha1 => const_oid::db::rfc5912::ID_SHA_1,
	295	+ HashAlgorithm::Sha256 => const_oid::db::rfc5912::ID_SHA_256,
	296	+ },
	297	+ digest,
	298	+ })
	299	+ .map_err(cms_der_error)?,
	300	+ );
	301	+ }
	302	+
	303	+ Ok(Attribute {
	304	+ oid: APPLE_CODE_DIRECTORY_DIGEST_OID,
	305	+ values: SetOfVec::try_from(values).map_err(cms_der_error)?,
	306	+ })
	307	+}
	308	+
	309	+fn apple_code_directory_hashes_attribute(request: &CmsSigningRequest<'_>) -> Result<Attribute> {
	310	+ let mut cdhashes = Vec::with_capacity(request.code_directories.len());
	311	+
	312	+ for code_directory in request.code_directories {
	313	+ let digest = code_directory.algorithm.digest(code_directory.bytes);
	314	+ let cdhash = digest
	315	+ .get(..20)
	316	+ .ok_or_else(\|\| cms_error("CodeDirectory digest is shorter than a cdhash"))?;
	317	+ cdhashes.push(Value::Data(cdhash.to_vec()));
	318	+ }
	319	+
	320	+ let mut plist = Dictionary::new();
	321	+ plist.insert("cdhashes".to_string(), Value::Array(cdhashes));
	322	+
	323	+ let mut xml = Vec::new();
	324	+ plist::to_writer_xml(&mut xml, &Value::Dictionary(plist))?;
	325	+ if xml.last() != Some(&b'\n') {
	326	+ xml.push(b'\n');
	327	+ }
	328	+
	329	+ let value = Any::from(OctetStringRef::new(&xml).map_err(cms_der_error)?);
	330	+ single_value_attribute(APPLE_CODE_DIRECTORY_HASHES_OID, value)
	331	+}
	332	+
	333	+fn single_value_attribute(oid: DerObjectIdentifier, value: AttributeValue) -> Result<Attribute> {
	334	+ Ok(Attribute {
	335	+ oid,
	336	+ values: SetOfVec::try_from(vec![value]).map_err(cms_der_error)?,
	337	+ })
	338	+}
	339	+
	340	+fn sha256_algorithm_identifier() -> AlgorithmIdentifierOwned {
	341	+ AlgorithmIdentifierOwned {
	342	+ oid: const_oid::db::rfc5912::ID_SHA_256,
	343	+ parameters: Some(Any::null()),
	344	+ }
	345	+}
	346	+
	347	+fn cms_builder_error(error: cms::builder::Error) -> CodeSignError {
	348	+ cms_error(error)
	349	+}
	350	+
	351	+fn cms_der_error(error: der::Error) -> CodeSignError {
	352	+ cms_error(error)
	353	+}
	354	+
	355	+fn cms_error(message: impl Display) -> CodeSignError {
	356	+ CodeSignError::cms(message.to_string())
	357	+}
	358	+
	359	+#[cfg(test)]
	360	+mod tests {
	361	+ use super::*;
	362	+ use crate::signature::EncodedCodeDirectory;
	363	+ use der::Decode;
	364	+
	365	+ #[test]
	366	+ fn apple_code_directory_digest_requires_sha256_code_directory() {
	367	+ let code_directory = EncodedCodeDirectory {
	368	+ algorithm: HashAlgorithm::Sha1,
	369	+ bytes: b"primary",
	370	+ };
	371	+ let request = CmsSigningRequest {
	372	+ code_directories: &[code_directory],
	373	+ };
	374	+
	375	+ assert!(apple_code_directory_digest_attribute(&request).is_err());
	376	+ }
	377	+
	378	+ #[test]
	379	+ fn apple_code_directory_digest_contains_a_bare_hash_oid() {
	380	+ let code_directory = EncodedCodeDirectory {
	381	+ algorithm: HashAlgorithm::Sha256,
	382	+ bytes: b"alternate",
	383	+ };
	384	+ let request = CmsSigningRequest {
	385	+ code_directories: &[code_directory],
	386	+ };
	387	+
	388	+ let attribute = apple_code_directory_digest_attribute(&request).unwrap();
	389	+ let value_der = attribute.values.get(0).unwrap().to_der().unwrap();
	390	+
	391	+ assert_eq!(
	392	+ &value_der[..15],
	393	+ &[
	394	+ 0x30, 0x2d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x04,
	395	+ 0x20,
	396	+ ]
	397	+ );
	398	+ assert_eq!(value_der.len(), 47);
	399	+ }
	400	+
	401	+ #[test]
	402	+ fn apple_code_directory_hashes_are_xml_plist_octet_string() {
	403	+ let code_directories = [
	404	+ EncodedCodeDirectory {
	405	+ algorithm: HashAlgorithm::Sha1,
	406	+ bytes: b"primary",
	407	+ },
	408	+ EncodedCodeDirectory {
	409	+ algorithm: HashAlgorithm::Sha256,
	410	+ bytes: b"alternate",
	411	+ },
	412	+ ];
	413	+ let request = CmsSigningRequest {
	414	+ code_directories: &code_directories,
	415	+ };
	416	+
	417	+ let attribute = apple_code_directory_hashes_attribute(&request).unwrap();
	418	+ assert_eq!(attribute.oid, APPLE_CODE_DIRECTORY_HASHES_OID);
	419	+
	420	+ let value = attribute.values.get(0).unwrap();
	421	+ let plist_xml = OctetStringRef::from_der(value.to_der().unwrap().as_slice())
	422	+ .unwrap()
	423	+ .as_bytes()
	424	+ .to_vec();
	425	+ assert!(plist_xml.starts_with(br#"<?xml version="1.0""#));
	426	+ assert!(plist_xml.ends_with(b"\n"));
	427	+ }
	428	+
	429	+ #[test]
	430	+ fn apple_code_directory_digest_includes_every_code_directory() {
	431	+ let code_directories = [
	432	+ EncodedCodeDirectory {
	433	+ algorithm: HashAlgorithm::Sha1,
	434	+ bytes: b"primary",
	435	+ },
	436	+ EncodedCodeDirectory {
	437	+ algorithm: HashAlgorithm::Sha256,
	438	+ bytes: b"alternate",
	439	+ },
	440	+ ];
	441	+ let request = CmsSigningRequest {
	442	+ code_directories: &code_directories,
	443	+ };
	444	+
	445	+ let attribute = apple_code_directory_digest_attribute(&request).unwrap();
	446	+ let sha1_value_der = attribute.values.get(0).unwrap().to_der().unwrap();
	447	+
	448	+ assert_eq!(attribute.values.len(), 2);
	449	+ assert_eq!(
	450	+ &sha1_value_der[..11],
	451	+ &[
	452	+ 0x30, 0x1d, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x04, 0x14
	453	+ ]
	454	+ );
	455	+ }
	456	+
	457	+ #[test]
	458	+ fn bundled_apple_chain_links_wwdr_g3_to_root() {
	459	+ let wwdr = Certificate::from_der(APPLE_WWDR_G3_CERTIFICATE_DER).unwrap();
	460	+ let root = Certificate::from_der(APPLE_ROOT_CERTIFICATE_DER).unwrap();
	461	+ let candidates = [wwdr.clone(), root.clone()];
	462	+
	463	+ let chain = certificate_chain_for_signer(&wwdr, &candidates).unwrap();
	464	+
	465	+ assert_eq!(chain, vec![root]);
	466	+ }
	467	+}

apple-codesign-quick/src/signature.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,696 @@
	1	+use crate::error::{CodeSignError, Result};
	2	+use plist::{Dictionary, Value};
	3	+use rayon::prelude::*;
	4	+use sha1::Digest as _;
	5	+use std::borrow::Cow;
	6	+
	7	+pub const CSSLOT_CODEDIRECTORY: u32 = 0;
	8	+pub const CSSLOT_REQUIREMENTS: u32 = 2;
	9	+pub const CSSLOT_ENTITLEMENTS: u32 = 5;
	10	+pub const CSSLOT_DER_ENTITLEMENTS: u32 = 7;
	11	+pub const CSSLOT_ALTERNATE_CODEDIRECTORIES: u32 = 0x1000;
	12	+pub const CSSLOT_SIGNATURESLOT: u32 = 0x10000;
	13	+
	14	+pub const CSMAGIC_BLOBWRAPPER: u32 = 0xfade_0b01;
	15	+pub const CSMAGIC_REQUIREMENTS: u32 = 0xfade_0c01;
	16	+pub const CSMAGIC_CODEDIRECTORY: u32 = 0xfade_0c02;
	17	+pub const CSMAGIC_EMBEDDED_SIGNATURE: u32 = 0xfade_0cc0;
	18	+pub const CSMAGIC_EMBEDDED_ENTITLEMENTS: u32 = 0xfade_7171;
	19	+pub const CSMAGIC_EMBEDDED_DER_ENTITLEMENTS: u32 = 0xfade_7172;
	20	+
	21	+const CODEDIRECTORY_VERSION_EXECSEG: u32 = 0x20400;
	22	+const CODEDIRECTORY_HEADER_LEN: usize = 88;
	23	+const CODEDIRECTORY_PAGE_SIZE_LOG2: u8 = 12;
	24	+const CODEDIRECTORY_PAGE_SIZE: usize = 1 << CODEDIRECTORY_PAGE_SIZE_LOG2;
	25	+const CODEDIRECTORY_PARALLEL_HASH_PAGES: usize = 64;
	26	+
	27	+pub const CS_EXECSEG_MAIN_BINARY: u64 = 0x1;
	28	+pub const CS_EXECSEG_ALLOW_UNSIGNED: u64 = 0x10;
	29	+pub const CS_EXECSEG_DEBUGGER: u64 = 0x20;
	30	+pub const CS_EXECSEG_JIT: u64 = 0x40;
	31	+pub const CS_EXECSEG_SKIP_LV: u64 = 0x80;
	32	+pub const CS_EXECSEG_CAN_LOAD_CDHASH: u64 = 0x100;
	33	+pub const CS_EXECSEG_CAN_EXEC_CDHASH: u64 = 0x200;
	34	+
	35	+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
	36	+pub enum HashAlgorithm {
	37	+ Sha1,
	38	+ Sha256,
	39	+}
	40	+
	41	+impl HashAlgorithm {
	42	+ pub fn digest(self, bytes: &[u8]) -> Vec<u8> {
	43	+ match self {
	44	+ Self::Sha1 => sha1::Sha1::digest(bytes).to_vec(),
	45	+ Self::Sha256 => sha2::Sha256::digest(bytes).to_vec(),
	46	+ }
	47	+ }
	48	+
	49	+ fn push_digest(self, out: &mut Vec<u8>, bytes: &[u8]) {
	50	+ match self {
	51	+ Self::Sha1 => {
	52	+ let digest = sha1::Sha1::digest(bytes);
	53	+ out.extend_from_slice(&digest);
	54	+ }
	55	+ Self::Sha256 => {
	56	+ let digest = sha2::Sha256::digest(bytes);
	57	+ out.extend_from_slice(&digest);
	58	+ }
	59	+ }
	60	+ }
	61	+
	62	+ pub fn digest_len(self) -> usize {
	63	+ match self {
	64	+ Self::Sha1 => 20,
	65	+ Self::Sha256 => 32,
	66	+ }
	67	+ }
	68	+
	69	+ pub fn code_directory_hash_type(self) -> u8 {
	70	+ match self {
	71	+ Self::Sha1 => 1,
	72	+ Self::Sha256 => 2,
	73	+ }
	74	+ }
	75	+}
	76	+
	77	+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
	78	+pub struct ExecutableSegment {
	79	+ pub base: u64,
	80	+ pub limit: u64,
	81	+ pub flags: u64,
	82	+}
	83	+
	84	+#[derive(Debug)]
	85	+pub struct EncodedCodeDirectory<'a> {
	86	+ pub algorithm: HashAlgorithm,
	87	+ pub bytes: &'a [u8],
	88	+}
	89	+
	90	+#[derive(Debug)]
	91	+pub struct CmsSigningRequest<'a> {
	92	+ pub code_directories: &'a [EncodedCodeDirectory<'a>],
	93	+}
	94	+
	95	+pub trait CmsSigner: Sync {
	96	+ fn sign(&self, request: CmsSigningRequest<'_>) -> Result<Vec<u8>>;
	97	+}
	98	+
	99	+#[derive(Debug)]
	100	+pub struct CodeDirectoryParams<'a> {
	101	+ pub identifier: &'a str,
	102	+ pub team_id: &'a str,
	103	+ pub macho_data: &'a [u8],
	104	+ pub code_limit: usize,
	105	+ pub executable_segment: ExecutableSegment,
	106	+ pub is_executable: bool,
	107	+ pub requirements_blob: &'a [u8],
	108	+ pub entitlements_blob: &'a [u8],
	109	+ pub der_entitlements_blob: Option<&'a [u8]>,
	110	+ pub info_plist: Option<&'a [u8]>,
	111	+ pub code_resources: Option<&'a [u8]>,
	112	+}
	113	+
	114	+#[derive(Clone, Copy, Debug, Default)]
	115	+struct CodePageHashes {
	116	+ sha1: [u8; 20],
	117	+ sha256: [u8; 32],
	118	+}
	119	+
	120	+impl CodePageHashes {
	121	+ fn get(&self, algorithm: HashAlgorithm) -> &[u8] {
	122	+ match algorithm {
	123	+ HashAlgorithm::Sha1 => &self.sha1,
	124	+ HashAlgorithm::Sha256 => &self.sha256,
	125	+ }
	126	+ }
	127	+}
	128	+
	129	+pub fn entitlements_xml(entitlements: &Dictionary) -> Result<Vec<u8>> {
	130	+ let mut data = Vec::new();
	131	+ plist::to_writer_xml(&mut data, &Value::Dictionary(entitlements.clone()))?;
	132	+ Ok(data)
	133	+}
	134	+
	135	+pub fn empty_requirements_blob() -> Vec<u8> {
	136	+ let mut out = Vec::with_capacity(12);
	137	+ push_be_u32(&mut out, CSMAGIC_REQUIREMENTS);
	138	+ push_be_u32(&mut out, 12);
	139	+ push_be_u32(&mut out, 0);
	140	+ out
	141	+}
	142	+
	143	+pub fn entitlements_blob(xml: &[u8]) -> Vec<u8> {
	144	+ let mut out = Vec::with_capacity(8 + xml.len());
	145	+ push_be_u32(&mut out, CSMAGIC_EMBEDDED_ENTITLEMENTS);
	146	+ push_be_u32(&mut out, (8 + xml.len()) as u32);
	147	+ out.extend_from_slice(xml);
	148	+ out
	149	+}
	150	+
	151	+pub fn der_entitlements_blob(entitlements: &Dictionary) -> Result<Vec<u8>> {
	152	+ let der = der_entitlements(entitlements)?;
	153	+ let mut out = Vec::with_capacity(8 + der.len());
	154	+ push_be_u32(&mut out, CSMAGIC_EMBEDDED_DER_ENTITLEMENTS);
	155	+ push_be_u32(&mut out, (8 + der.len()) as u32);
	156	+ out.extend_from_slice(&der);
	157	+ Ok(out)
	158	+}
	159	+
	160	+pub fn entitlement_exec_flags(entitlements: &Dictionary, is_main_binary: bool) -> u64 {
	161	+ let mut flags = if is_main_binary {
	162	+ CS_EXECSEG_MAIN_BINARY
	163	+ } else {
	164	+ 0
	165	+ };
	166	+
	167	+ for (key, flag) in [
	168	+ ("get-task-allow", CS_EXECSEG_ALLOW_UNSIGNED),
	169	+ ("run-unsigned-code", CS_EXECSEG_ALLOW_UNSIGNED),
	170	+ ("com.apple.private.cs.debugger", CS_EXECSEG_DEBUGGER),
	171	+ ("dynamic-codesigning", CS_EXECSEG_JIT),
	172	+ (
	173	+ "com.apple.private.skip-library-validation",
	174	+ CS_EXECSEG_SKIP_LV,
	175	+ ),
	176	+ (
	177	+ "com.apple.private.amfi.can-load-cdhash",
	178	+ CS_EXECSEG_CAN_LOAD_CDHASH,
	179	+ ),
	180	+ (
	181	+ "com.apple.private.amfi.can-execute-cdhash",
	182	+ CS_EXECSEG_CAN_EXEC_CDHASH,
	183	+ ),
	184	+ ] {
	185	+ if matches!(entitlements.get(key), Some(Value::Boolean(true))) {
	186	+ flags \|= flag;
	187	+ }
	188	+ }
	189	+
	190	+ flags
	191	+}
	192	+
	193	+pub(crate) struct SuperblobSizePlan<'a> {
	194	+ pub identifier: &'a str,
	195	+ pub team_id: &'a str,
	196	+ pub code_limit: usize,
	197	+ pub is_executable: bool,
	198	+ pub requirements_blob_len: usize,
	199	+ pub entitlements_blob_len: usize,
	200	+ pub der_entitlements_blob_len: Option<usize>,
	201	+ pub has_cms_signature: bool,
	202	+ pub cms_blob_reservation: usize,
	203	+}
	204	+
	205	+pub(crate) fn planned_superblob_len_from_parts(plan: SuperblobSizePlan<'_>) -> usize {
	206	+ let count = 4
	207	+ + usize::from(plan.der_entitlements_blob_len.is_some())
	208	+ + usize::from(plan.has_cms_signature);
	209	+ let mut len = 12 + count * 8;
	210	+
	211	+ len += code_directory_len(
	212	+ HashAlgorithm::Sha1,
	213	+ plan.identifier,
	214	+ plan.team_id,
	215	+ plan.code_limit,
	216	+ plan.is_executable,
	217	+ );
	218	+ len += code_directory_len(
	219	+ HashAlgorithm::Sha256,
	220	+ plan.identifier,
	221	+ plan.team_id,
	222	+ plan.code_limit,
	223	+ plan.is_executable,
	224	+ );
	225	+ len += plan.requirements_blob_len;
	226	+ len += plan.entitlements_blob_len;
	227	+
	228	+ if let Some(der_entitlements_blob_len) = plan.der_entitlements_blob_len {
	229	+ len += der_entitlements_blob_len;
	230	+ }
	231	+
	232	+ if plan.has_cms_signature {
	233	+ len += plan.cms_blob_reservation;
	234	+ }
	235	+
	236	+ len
	237	+}
	238	+
	239	+pub fn encode_embedded_signature(
	240	+ params: &CodeDirectoryParams<'_>,
	241	+ cms_signer: Option<&dyn CmsSigner>,
	242	+ cms_blob_reservation: usize,
	243	+) -> Result<Vec<u8>> {
	244	+ if params.code_limit > params.macho_data.len() {
	245	+ return Err(CodeSignError::macho(
	246	+ "<memory>",
	247	+ format!(
	248	+ "code limit {} exceeds Mach-O length {}",
	249	+ params.code_limit,
	250	+ params.macho_data.len()
	251	+ ),
	252	+ ));
	253	+ }
	254	+
	255	+ let code_hashes = hash_code_pages(&params.macho_data[..params.code_limit]);
	256	+ let (primary_code_directory, alternate_code_directory) =
	257	+ if should_parallelize_code_directory_encoding(params, code_hashes.len()) {
	258	+ let (primary, alternate) = rayon::join(
	259	+ \|\| encode_code_directory(params, HashAlgorithm::Sha1, &code_hashes),
	260	+ \|\| encode_code_directory(params, HashAlgorithm::Sha256, &code_hashes),
	261	+ );
	262	+ (primary?, alternate?)
	263	+ } else {
	264	+ (
	265	+ encode_code_directory(params, HashAlgorithm::Sha1, &code_hashes)?,
	266	+ encode_code_directory(params, HashAlgorithm::Sha256, &code_hashes)?,
	267	+ )
	268	+ };
	269	+
	270	+ let signature_blob = if let Some(cms_signer) = cms_signer {
	271	+ let directories = [
	272	+ EncodedCodeDirectory {
	273	+ algorithm: HashAlgorithm::Sha1,
	274	+ bytes: &primary_code_directory,
	275	+ },
	276	+ EncodedCodeDirectory {
	277	+ algorithm: HashAlgorithm::Sha256,
	278	+ bytes: &alternate_code_directory,
	279	+ },
	280	+ ];
	281	+ let cms = cms_signer.sign(CmsSigningRequest {
	282	+ code_directories: &directories,
	283	+ })?;
	284	+ Some(signature_blob_wrapper(&cms, cms_blob_reservation)?)
	285	+ } else {
	286	+ None
	287	+ };
	288	+
	289	+ let mut blobs: Vec<(u32, Cow<'_, [u8]>)> = vec![
	290	+ (CSSLOT_CODEDIRECTORY, Cow::Owned(primary_code_directory)),
	291	+ (CSSLOT_REQUIREMENTS, Cow::Borrowed(params.requirements_blob)),
	292	+ (CSSLOT_ENTITLEMENTS, Cow::Borrowed(params.entitlements_blob)),
	293	+ ];
	294	+
	295	+ if let Some(der_entitlements_blob) = params.der_entitlements_blob {
	296	+ blobs.push((
	297	+ CSSLOT_DER_ENTITLEMENTS,
	298	+ Cow::Borrowed(der_entitlements_blob),
	299	+ ));
	300	+ }
	301	+
	302	+ blobs.push((
	303	+ CSSLOT_ALTERNATE_CODEDIRECTORIES,
	304	+ Cow::Owned(alternate_code_directory),
	305	+ ));
	306	+
	307	+ if let Some(signature_blob) = signature_blob {
	308	+ blobs.push((CSSLOT_SIGNATURESLOT, Cow::Owned(signature_blob)));
	309	+ }
	310	+
	311	+ Ok(encode_superblob(blobs))
	312	+}
	313	+
	314	+fn code_directory_len(
	315	+ algorithm: HashAlgorithm,
	316	+ identifier: &str,
	317	+ team_id: &str,
	318	+ code_limit: usize,
	319	+ is_executable: bool,
	320	+) -> usize {
	321	+ let hash_len = algorithm.digest_len();
	322	+ let special_slots = if is_executable { 7 } else { 5 };
	323	+ let code_slots = code_limit.div_ceil(CODEDIRECTORY_PAGE_SIZE);
	324	+
	325	+ CODEDIRECTORY_HEADER_LEN
	326	+ + identifier.len()
	327	+ + 1
	328	+ + team_id.len()
	329	+ + 1
	330	+ + (special_slots + code_slots) * hash_len
	331	+}
	332	+
	333	+fn encode_code_directory(
	334	+ params: &CodeDirectoryParams<'_>,
	335	+ algorithm: HashAlgorithm,
	336	+ code_hashes: &[CodePageHashes],
	337	+) -> Result<Vec<u8>> {
	338	+ let hash_len = algorithm.digest_len();
	339	+ let special_slot_count = if params.is_executable { 7 } else { 5 };
	340	+ let code_slot_count = code_hashes.len();
	341	+ let dynamic_len = params.identifier.len()
	342	+ + 1
	343	+ + params.team_id.len()
	344	+ + 1
	345	+ + special_slot_count * hash_len
	346	+ + code_slot_count * hash_len;
	347	+ let ident_offset = CODEDIRECTORY_HEADER_LEN;
	348	+ let team_offset = ident_offset + params.identifier.len() + 1;
	349	+ let hash_offset = team_offset + params.team_id.len() + 1 + special_slot_count * hash_len;
	350	+ let length = CODEDIRECTORY_HEADER_LEN + dynamic_len;
	351	+
	352	+ let mut out = Vec::with_capacity(length);
	353	+ push_be_u32(&mut out, CSMAGIC_CODEDIRECTORY);
	354	+ push_be_u32(&mut out, length as u32);
	355	+ push_be_u32(&mut out, CODEDIRECTORY_VERSION_EXECSEG);
	356	+ push_be_u32(&mut out, 0);
	357	+ push_be_u32(&mut out, hash_offset as u32);
	358	+ push_be_u32(&mut out, ident_offset as u32);
	359	+ push_be_u32(&mut out, special_slot_count as u32);
	360	+ push_be_u32(&mut out, code_slot_count as u32);
	361	+ push_be_u32(&mut out, u32::try_from(params.code_limit).unwrap_or(0));
	362	+ out.push(hash_len as u8);
	363	+ out.push(algorithm.code_directory_hash_type());
	364	+ out.push(0);
	365	+ out.push(CODEDIRECTORY_PAGE_SIZE_LOG2);
	366	+ push_be_u32(&mut out, 0);
	367	+ push_be_u32(&mut out, 0);
	368	+ push_be_u32(&mut out, team_offset as u32);
	369	+ push_be_u32(&mut out, 0);
	370	+ push_be_u64(
	371	+ &mut out,
	372	+ if params.code_limit > u32::MAX as usize {
	373	+ params.code_limit as u64
	374	+ } else {
	375	+ 0
	376	+ },
	377	+ );
	378	+ push_be_u64(&mut out, params.executable_segment.base);
	379	+ push_be_u64(&mut out, params.executable_segment.limit);
	380	+ push_be_u64(&mut out, params.executable_segment.flags);
	381	+
	382	+ out.extend_from_slice(params.identifier.as_bytes());
	383	+ out.push(0);
	384	+ out.extend_from_slice(params.team_id.as_bytes());
	385	+ out.push(0);
	386	+
	387	+ if params.is_executable {
	388	+ let der = params.der_entitlements_blob.ok_or_else(\|\| {
	389	+ CodeSignError::macho("<memory>", "executable signatures require DER entitlements")
	390	+ })?;
	391	+ algorithm.push_digest(&mut out, der);
	392	+ push_zero_hash(&mut out, hash_len);
	393	+ }
	394	+
	395	+ algorithm.push_digest(&mut out, params.entitlements_blob);
	396	+ push_zero_hash(&mut out, hash_len);
	397	+
	398	+ if let Some(code_resources) = params.code_resources {
	399	+ algorithm.push_digest(&mut out, code_resources);
	400	+ } else {
	401	+ push_zero_hash(&mut out, hash_len);
	402	+ }
	403	+
	404	+ algorithm.push_digest(&mut out, params.requirements_blob);
	405	+
	406	+ if let Some(info_plist) = params.info_plist {
	407	+ algorithm.push_digest(&mut out, info_plist);
	408	+ } else {
	409	+ push_zero_hash(&mut out, hash_len);
	410	+ }
	411	+
	412	+ for slot in code_hashes {
	413	+ out.extend_from_slice(slot.get(algorithm));
	414	+ }
	415	+
	416	+ debug_assert_eq!(out.len(), length);
	417	+
	418	+ Ok(out)
	419	+}
	420	+
	421	+fn hash_code_pages(code: &[u8]) -> Vec<CodePageHashes> {
	422	+ let pages = code.len().div_ceil(CODEDIRECTORY_PAGE_SIZE);
	423	+ let mut hashes = vec![CodePageHashes::default(); pages];
	424	+
	425	+ if pages < 8 {
	426	+ for (hash, page) in hashes.iter_mut().zip(code.chunks(CODEDIRECTORY_PAGE_SIZE)) {
	427	+ *hash = hash_code_page(page);
	428	+ }
	429	+ return hashes;
	430	+ }
	431	+
	432	+ hashes
	433	+ .par_chunks_mut(CODEDIRECTORY_PARALLEL_HASH_PAGES)
	434	+ .enumerate()
	435	+ .for_each(\|(chunk_index, out)\| {
	436	+ let start_page = chunk_index * CODEDIRECTORY_PARALLEL_HASH_PAGES;
	437	+ let start = start_page * CODEDIRECTORY_PAGE_SIZE;
	438	+ let end = (start + out.len() * CODEDIRECTORY_PAGE_SIZE).min(code.len());
	439	+
	440	+ for (hash, page) in out
	441	+ .iter_mut()
	442	+ .zip(code[start..end].chunks(CODEDIRECTORY_PAGE_SIZE))
	443	+ {
	444	+ *hash = hash_code_page(page);
	445	+ }
	446	+ });
	447	+
	448	+ hashes
	449	+}
	450	+
	451	+fn hash_code_page(page: &[u8]) -> CodePageHashes {
	452	+ CodePageHashes {
	453	+ sha1: sha1::Sha1::digest(page).into(),
	454	+ sha256: sha2::Sha256::digest(page).into(),
	455	+ }
	456	+}
	457	+
	458	+fn should_parallelize_code_directory_encoding(
	459	+ params: &CodeDirectoryParams<'_>,
	460	+ code_page_count: usize,
	461	+) -> bool {
	462	+ code_page_count >= 8
	463	+ \|\| params
	464	+ .code_resources
	465	+ .is_some_and(\|data\| data.len() >= 64 * 1024)
	466	+}
	467	+
	468	+fn push_zero_hash(out: &mut Vec<u8>, hash_len: usize) {
	469	+ out.resize(out.len() + hash_len, 0);
	470	+}
	471	+
	472	+fn signature_blob_wrapper(cms: &[u8], reserved_len: usize) -> Result<Vec<u8>> {
	473	+ let actual_len = 8 + cms.len();
	474	+ if actual_len > reserved_len {
	475	+ return Err(CodeSignError::SignatureTooLarge {
	476	+ actual: actual_len,
	477	+ reserved: reserved_len,
	478	+ });
	479	+ }
	480	+
	481	+ let mut out = Vec::with_capacity(actual_len);
	482	+ push_be_u32(&mut out, CSMAGIC_BLOBWRAPPER);
	483	+ push_be_u32(&mut out, actual_len as u32);
	484	+ out.extend_from_slice(cms);
	485	+ Ok(out)
	486	+}
	487	+
	488	+fn encode_superblob(mut blobs: Vec<(u32, Cow<'_, [u8]>)>) -> Vec<u8> {
	489	+ if let Some(primary_index) = blobs
	490	+ .iter()
	491	+ .position(\|(slot, _)\| *slot == CSSLOT_CODEDIRECTORY)
	492	+ {
	493	+ blobs.swap(0, primary_index);
	494	+ }
	495	+
	496	+ let index_len = blobs.len() * 8;
	497	+ let data_len: usize = blobs.iter().map(\|(_, data)\| data.as_ref().len()).sum();
	498	+ let total_len = 12 + index_len + data_len;
	499	+
	500	+ let mut out = Vec::with_capacity(total_len);
	501	+ push_be_u32(&mut out, CSMAGIC_EMBEDDED_SIGNATURE);
	502	+ push_be_u32(&mut out, total_len as u32);
	503	+ push_be_u32(&mut out, blobs.len() as u32);
	504	+
	505	+ let mut offset = 12 + index_len;
	506	+ for (slot, data) in &blobs {
	507	+ push_be_u32(&mut out, *slot);
	508	+ push_be_u32(&mut out, offset as u32);
	509	+ offset += data.as_ref().len();
	510	+ }
	511	+
	512	+ for (_, data) in blobs {
	513	+ out.extend_from_slice(data.as_ref());
	514	+ }
	515	+
	516	+ out
	517	+}
	518	+
	519	+pub fn der_entitlements(entitlements: &Dictionary) -> Result<Vec<u8>> {
	520	+ let dictionary = der_dictionary_body(entitlements, "$")?;
	521	+ let mut body = der_tlv(0x02, &[1]);
	522	+ body.extend_from_slice(&der_tlv(0xb0, &dictionary));
	523	+ Ok(der_tlv(0x70, &body))
	524	+}
	525	+
	526	+fn der_value(value: &Value, path: &str) -> Result<Vec<u8>> {
	527	+ match value {
	528	+ Value::Boolean(value) => Ok(der_tlv(0x01, &[if *value { 0xff } else { 0x00 }])),
	529	+ Value::Integer(value) => {
	530	+ if let Some(unsigned) = value.as_unsigned() {
	531	+ Ok(der_unsigned_integer(unsigned))
	532	+ } else if let Some(signed) = value.as_signed() {
	533	+ if signed >= 0 {
	534	+ Ok(der_unsigned_integer(signed as u64))
	535	+ } else {
	536	+ Err(CodeSignError::UnsupportedEntitlement(path.to_string()))
	537	+ }
	538	+ } else {
	539	+ Err(CodeSignError::UnsupportedEntitlement(path.to_string()))
	540	+ }
	541	+ }
	542	+ Value::String(value) => Ok(der_tlv(0x0c, value.as_bytes())),
	543	+ Value::Array(values) => {
	544	+ let mut body = Vec::new();
	545	+ for (index, value) in values.iter().enumerate() {
	546	+ body.extend_from_slice(&der_value(value, &format!("{path}[{index}]"))?);
	547	+ }
	548	+ Ok(der_tlv(0x30, &body))
	549	+ }
	550	+ Value::Dictionary(value) => der_dictionary(value, path),
	551	+ _ => Err(CodeSignError::UnsupportedEntitlement(path.to_string())),
	552	+ }
	553	+}
	554	+
	555	+fn der_dictionary(dict: &Dictionary, path: &str) -> Result<Vec<u8>> {
	556	+ Ok(der_tlv(0x31, &der_dictionary_body(dict, path)?))
	557	+}
	558	+
	559	+fn der_dictionary_body(dict: &Dictionary, path: &str) -> Result<Vec<u8>> {
	560	+ let mut entries = Vec::with_capacity(dict.len());
	561	+
	562	+ for (key, value) in dict {
	563	+ let mut entry_body = der_tlv(0x0c, key.as_bytes());
	564	+ entry_body.extend_from_slice(&der_value(value, &format!("{path}.{key}"))?);
	565	+ entries.push((key.as_str(), der_tlv(0x30, &entry_body)));
	566	+ }
	567	+
	568	+ entries.sort_by(\|(left, _), (right, _)\| left.as_bytes().cmp(right.as_bytes()));
	569	+
	570	+ let body_len = entries.iter().map(\|(_, entry)\| entry.len()).sum();
	571	+ let mut body = Vec::with_capacity(body_len);
	572	+ for (_, entry) in entries {
	573	+ body.extend_from_slice(&entry);
	574	+ }
	575	+
	576	+ Ok(body)
	577	+}
	578	+
	579	+fn der_unsigned_integer(value: u64) -> Vec<u8> {
	580	+ let bytes = value.to_be_bytes();
	581	+ let first_non_zero = bytes
	582	+ .iter()
	583	+ .position(\|byte\| *byte != 0)
	584	+ .unwrap_or(bytes.len() - 1);
	585	+ let significant = &bytes[first_non_zero..];
	586	+
	587	+ let mut body = Vec::with_capacity(significant.len() + 1);
	588	+ if significant[0] & 0x80 != 0 {
	589	+ body.push(0);
	590	+ }
	591	+ body.extend_from_slice(significant);
	592	+ der_tlv(0x02, &body)
	593	+}
	594	+
	595	+fn der_tlv(tag: u8, body: &[u8]) -> Vec<u8> {
	596	+ let mut out = Vec::with_capacity(1 + 5 + body.len());
	597	+ out.push(tag);
	598	+ write_der_len(&mut out, body.len());
	599	+ out.extend_from_slice(body);
	600	+ out
	601	+}
	602	+
	603	+fn write_der_len(out: &mut Vec<u8>, len: usize) {
	604	+ if len < 128 {
	605	+ out.push(len as u8);
	606	+ return;
	607	+ }
	608	+
	609	+ let bytes = len.to_be_bytes();
	610	+ let first = bytes
	611	+ .iter()
	612	+ .position(\|byte\| *byte != 0)
	613	+ .unwrap_or(bytes.len() - 1);
	614	+ let significant = &bytes[first..];
	615	+ out.push(0x80 \| significant.len() as u8);
	616	+ out.extend_from_slice(significant);
	617	+}
	618	+
	619	+fn push_be_u32(out: &mut Vec<u8>, value: u32) {
	620	+ out.extend_from_slice(&value.to_be_bytes());
	621	+}
	622	+
	623	+fn push_be_u64(out: &mut Vec<u8>, value: u64) {
	624	+ out.extend_from_slice(&value.to_be_bytes());
	625	+}
	626	+
	627	+#[cfg(test)]
	628	+mod tests {
	629	+ use super::*;
	630	+
	631	+ #[test]
	632	+ fn der_entitlements_use_apple_versioned_application_envelope() {
	633	+ assert_eq!(
	634	+ der_entitlements(&Dictionary::new()).unwrap(),
	635	+ [0x70, 0x05, 0x02, 0x01, 0x01, 0xb0, 0x00]
	636	+ );
	637	+ }
	638	+
	639	+ #[test]
	640	+ fn der_entitlements_blob_reports_the_wrapped_length() {
	641	+ let blob = der_entitlements_blob(&Dictionary::new()).unwrap();
	642	+
	643	+ assert_eq!(&blob[..4], &CSMAGIC_EMBEDDED_DER_ENTITLEMENTS.to_be_bytes());
	644	+ assert_eq!(
	645	+ u32::from_be_bytes(blob[4..8].try_into().unwrap()) as usize,
	646	+ blob.len()
	647	+ );
	648	+ assert_eq!(&blob[8..], &[0x70, 0x05, 0x02, 0x01, 0x01, 0xb0, 0x00]);
	649	+ }
	650	+
	651	+ #[test]
	652	+ fn entitlement_dictionary_entries_are_sorted_by_key() {
	653	+ let mut entitlements = Dictionary::new();
	654	+ entitlements.insert("z".to_string(), Value::Boolean(true));
	655	+ entitlements.insert(
	656	+ "application-identifier".to_string(),
	657	+ Value::String("TEAM.com.example.App".to_string()),
	658	+ );
	659	+ let body = der_dictionary_body(&entitlements, "$").unwrap();
	660	+ let expected_first = der_tlv(
	661	+ 0x30,
	662	+ &[
	663	+ der_tlv(0x0c, b"application-identifier"),
	664	+ der_tlv(0x0c, b"TEAM.com.example.App"),
	665	+ ]
	666	+ .concat(),
	667	+ );
	668	+
	669	+ assert!(body.starts_with(&expected_first));
	670	+ }
	671	+
	672	+ #[test]
	673	+ fn cms_reservation_is_not_encoded_inside_blob_wrapper() {
	674	+ let cms = [0x30, 0x00];
	675	+ let blob = signature_blob_wrapper(&cms, 32).unwrap();
	676	+
	677	+ assert_eq!(blob.len(), 10);
	678	+ assert_eq!(u32::from_be_bytes(blob[4..8].try_into().unwrap()), 10);
	679	+ assert_eq!(&blob[8..10], &cms);
	680	+ }
	681	+
	682	+ #[test]
	683	+ fn cms_reservation_is_not_counted_in_outer_superblob_length() {
	684	+ let cms = signature_blob_wrapper(&[0x30, 0x00], 32).unwrap();
	685	+ let superblob = encode_superblob(vec![
	686	+ (CSSLOT_CODEDIRECTORY, Cow::Owned(vec![0; 8])),
	687	+ (CSSLOT_SIGNATURESLOT, Cow::Owned(cms)),
	688	+ ]);
	689	+
	690	+ assert_eq!(
	691	+ u32::from_be_bytes(superblob[4..8].try_into().unwrap()) as usize,
	692	+ superblob.len()
	693	+ );
	694	+ assert_eq!(superblob.len(), 46);
	695	+ }
	696	+}

super-sideloader/Cargo.toml

View file @ 65cd6c1

@@ -6,28 +6,35 @@ edition = "2021"
 [dependencies]
 adi.workspace = true
 android-coreadi.workspace = true
-async_zip = { version = "0.0.18", features = ["deflate", "tokio-fs"] }
+apple-codesign = { path = "../apple-codesign-quick" }
+async_zip = { version = "0.0.18", features = ["deflate", "tokio", "tokio-fs"] }
 chrono = { version = "0.4.42", default-features = false, features = ["clock"] }
+crc32fast = "1.5"
 directories = "6.0.0"
 env_logger = "0.11.8"
+flate2 = "1.1"
 futures-lite = "2.6.1"
 grandslam.workspace = true
 gpui = { package = "gpui", git = "https://github.com/gpui-ce/gpui-ce" }
 gpui-component = { git = "https://github.com/longbridge/gpui-component", rev = "277f220a6196572116a8fd84fba6c36187094cab" }
 gpui_platform = { git = "https://github.com/gpui-ce/gpui-ce", features = ["font-kit", "x11", "wayland", "runtime_shaders"] }
-idevice = { version = "0.1.64", features = ["usbmuxd"] }
+idevice = { version = "0.1.64", features = ["afc", "installation_proxy", "usbmuxd"] }
+image = { version = "0.25", default-features = false, features = ["png"] }
 futures = "0.3"
 keyring = { version = "3", features = ["apple-native", "windows-native", "sync-secret-service"] }
 log = "0.4.33"
 plist.workspace = true
+pem-rfc7468 = { version = "0.7", features = ["alloc"] }
 rand = "0.10.2"
 reqwest = { workspace = true, features = ["blocking"] }
 serde = { version = "1.0.228", features = ["derive"] }
 sha1.workspace = true
 thiserror.workspace = true
+tempfile = "3.27"
 toml = "0.8.23"
-tokio = { workspace = true, features = ["io-util", "net", "time"] }
+tokio = { workspace = true, features = ["fs", "io-util", "net", "time"] }
 uuid = { version = "1.19", features = ["v4"] }
+walkdir = "2.5"
 xcode.workspace = true
 
 [target.'cfg(target_os = "macos")'.dependencies]

super-sideloader/src/app/effects.rs

View file @ 65cd6c1

@@ -1,14 +1,20 @@
+use crate::app::entitlements::{
+    effective_bundle_identifier, effective_bundle_identifier_for_app,
+    effective_nested_bundle_identifier,
+};
 use crate::app::models::{
-    AccountOption, AdiBackendKind, AdiBackendOption, AppOption, DeviceOption, MachineIdentity,
-    PatchOption,
+    AccountOption, AdiBackendKind, AdiBackendOption, AppIdOption, AppOption, DeveloperDeviceOption,
+    DeviceOption, MachineIdentity, PatchOption, TeamOption,
 };
 use crate::app::selection;
 use crate::app::view_models::{
-    account_option, account_options, adi_backends, app_option, device_options, domain_adi_kind,
-    domain_machine_identity, domain_patch, machine_identity,
+    account_option, account_options, adi_backends, app_option, developer_device_options,
+    device_options, domain_adi_kind, domain_app_metadata, domain_machine_identity, domain_patch,
+    machine_identity,
 };
 use crate::app::{AppError, AppResult};
 use crate::backend::{adi_services, developer_services, device_discovery, system_identity};
+use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 
 pub(crate) use crate::domain::DeviceWatchEvent;
@@ -17,6 +23,220 @@ pub(crate) use developer_services::{
     DeveloperAppIdCapabilityUpdate, DownloadedProvisioningProfile,
 };
 
+#[derive(Clone)]
+pub(crate) struct SignIpaRequest {
+    pub(crate) developer_context: DeveloperSessionContext,
+    pub(crate) team_id: String,
+    pub(crate) team_app_ids: Vec<AppIdOption>,
+    pub(crate) certificate_fingerprint: String,
+    pub(crate) public_key_fingerprint: String,
+    pub(crate) auto_app_id: bool,
+    pub(crate) selected_app_id: Option<AppIdOption>,
+    pub(crate) app: AppOption,
+    pub(crate) output: SignIpaOutput,
+}
+
+pub(crate) struct SignIpaOutcome {
+    pub(crate) artifact: SignIpaArtifact,
+    pub(crate) updated_account: Option<AccountOption>,
+}
+
+#[derive(Clone)]
+pub(crate) enum SignIpaOutput {
+    Ipa(PathBuf),
+    AppBundle,
+}
+
+pub(crate) enum SignIpaArtifact {
+    Ipa(PathBuf),
+    AppBundle(crate::backend::ipa::SignedAppBundle),
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct AppIdProvisioningItem {
+    pub(crate) name: String,
+    pub(crate) identifier: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct AppIdProvisioningPlan {
+    pub(crate) app_ids: Vec<AppIdProvisioningItem>,
+    pub(crate) available_quantity: Option<u64>,
+}
+
+impl AppIdProvisioningPlan {
+    pub(crate) fn remaining_after_signing(&self) -> Option<u64> {
+        self.available_quantity
+            .map(|available| available.saturating_sub(self.app_ids.len() as u64))
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum SignIpaProgress {
+    Preparing,
+    ResolvingAppId,
+    DownloadingProfile,
+    Extracting { completed: usize, total: usize },
+    Patching,
+    Signing,
+    Packaging { completed: usize, total: usize },
+    Saving,
+    Ready,
+}
+
+impl SignIpaProgress {
+    pub(crate) fn progress(self) -> f32 {
+        match self {
+            Self::Preparing => 0.04,
+            Self::ResolvingAppId => 0.1,
+            Self::DownloadingProfile => 0.22,
+            Self::Extracting { completed, total } => 0.3 + progress_ratio(completed, total) * 0.25,
+            Self::Patching => 0.58,
+            Self::Signing => 0.64,
+            Self::Packaging { completed, total } => 0.72 + progress_ratio(completed, total) * 0.24,
+            Self::Saving => 0.98,
+            Self::Ready => 0.98,
+        }
+    }
+
+    pub(crate) fn label(self) -> String {
+        match self {
+            Self::Preparing => "Preparing signing resources".to_string(),
+            Self::ResolvingAppId => "Resolving App ID".to_string(),
+            Self::DownloadingProfile => "Downloading provisioning profile".to_string(),
+            Self::Extracting { completed, total } => {
+                format!("Extracting IPA ({completed}/{total})")
+            }
+            Self::Patching => "Applying app changes".to_string(),
+            Self::Signing => "Signing app bundle".to_string(),
+            Self::Packaging { completed, total } => {
+                format!("Packaging signed IPA ({completed}/{total})")
+            }
+            Self::Saving => "Saving signed IPA".to_string(),
+            Self::Ready => "Signed app ready for transfer".to_string(),
+        }
+    }
+}
+
+impl From<crate::backend::ipa::IpaSigningProgress> for SignIpaProgress {
+    fn from(progress: crate::backend::ipa::IpaSigningProgress) -> Self {
+        match progress {
+            crate::backend::ipa::IpaSigningProgress::Extracting { completed, total } => {
+                Self::Extracting { completed, total }
+            }
+            crate::backend::ipa::IpaSigningProgress::Patching => Self::Patching,
+            crate::backend::ipa::IpaSigningProgress::Signing => Self::Signing,
+            crate::backend::ipa::IpaSigningProgress::Packaging { completed, total } => {
+                Self::Packaging { completed, total }
+            }
+            crate::backend::ipa::IpaSigningProgress::Saving => Self::Saving,
+            crate::backend::ipa::IpaSigningProgress::Ready => Self::Ready,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum InstallAppProgress {
+    Connecting,
+    Uploading {
+        transferred_bytes: u64,
+        total_bytes: u64,
+        completed_files: usize,
+        total_files: usize,
+    },
+    Installing {
+        percent: u64,
+    },
+    Finalizing,
+}
+
+impl InstallAppProgress {
+    pub(crate) fn progress(self) -> f32 {
+        match self {
+            Self::Connecting => 0.02,
+            Self::Uploading {
+                transferred_bytes,
+                total_bytes,
+                ..
+            } => 0.05 + byte_progress_ratio(transferred_bytes, total_bytes) * 0.43,
+            Self::Installing { percent } => 0.5 + (percent.min(100) as f32 / 100.) * 0.47,
+            Self::Finalizing => 0.99,
+        }
+    }
+
+    pub(crate) fn label(self) -> String {
+        match self {
+            Self::Connecting => "Connecting to device".to_string(),
+            Self::Uploading {
+                transferred_bytes,
+                total_bytes,
+                completed_files,
+                total_files,
+            } => format!(
+                "Uploading app files ({completed_files}/{total_files}, {} / {})",
+                formatted_byte_count(transferred_bytes),
+                formatted_byte_count(total_bytes)
+            ),
+            Self::Installing { percent } => {
+                format!("Verifying and installing on device ({percent}%)")
+            }
+            Self::Finalizing => "Cleaning up device staging".to_string(),
+        }
+    }
+}
+
+impl From<crate::domain::DeviceInstallProgress> for InstallAppProgress {
+    fn from(progress: crate::domain::DeviceInstallProgress) -> Self {
+        match progress {
+            crate::domain::DeviceInstallProgress::Connecting => Self::Connecting,
+            crate::domain::DeviceInstallProgress::Uploading {
+                transferred_bytes,
+                total_bytes,
+                completed_files,
+                total_files,
+            } => Self::Uploading {
+                transferred_bytes,
+                total_bytes,
+                completed_files,
+                total_files,
+            },
+            crate::domain::DeviceInstallProgress::Installing { percent } => {
+                Self::Installing { percent }
+            }
+            crate::domain::DeviceInstallProgress::Finalizing => Self::Finalizing,
+        }
+    }
+}
+
+fn progress_ratio(completed: usize, total: usize) -> f32 {
+    if total == 0 {
+        1.
+    } else {
+        (completed as f32 / total as f32).clamp(0., 1.)
+    }
+}
+
+fn byte_progress_ratio(completed: u64, total: u64) -> f32 {
+    if total == 0 {
+        1.
+    } else {
+        (completed as f32 / total as f32).clamp(0., 1.)
+    }
+}
+
+fn formatted_byte_count(bytes: u64) -> String {
+    const MEBIBYTE: f64 = 1024. * 1024.;
+    const KIBIBYTE: f64 = 1024.;
+
+    if bytes as f64 >= MEBIBYTE {
+        format!("{:.1} MB", bytes as f64 / MEBIBYTE)
+    } else if bytes as f64 >= KIBIBYTE {
+        format!("{:.1} KB", bytes as f64 / KIBIBYTE)
+    } else {
+        format!("{bytes} B")
+    }
+}
+
 #[derive(Clone, Debug)]
 pub(crate) struct DeveloperSessionContext {
     inner: developer_services::DeveloperSessionContext,
@@ -157,6 +377,315 @@ pub(crate) async fn load_ipa(path: PathBuf, patches: Vec<PatchOption>) -> AppRes
         .map_err(AppError::from)
 }
 
+pub(crate) async fn install_app(
+    udid: String,
+    signed_app: crate::backend::ipa::SignedAppBundle,
+    mut progress: impl FnMut(InstallAppProgress) + Send + 'static,
+) -> AppResult<()> {
+    crate::backend::device::install_app(udid, signed_app, move |event| {
+        progress(event.into());
+    })
+    .await
+    .map_err(AppError::from)
+}
+
+pub(crate) async fn sign_ipa(
+    request: SignIpaRequest,
+    mut progress: impl FnMut(SignIpaProgress) + Send + 'static,
+) -> AppResult<SignIpaOutcome> {
+    if request.app.bundle_id().trim().is_empty() {
+        return Err(AppError::from(
+            "The app bundle identifier cannot be empty when signing.",
+        ));
+    }
+    if request.app.name().trim().is_empty() {
+        return Err(AppError::from("The app name cannot be empty when signing."));
+    }
+    progress(SignIpaProgress::Preparing);
+    let signing_material = developer_services::load_signing_material(
+        &request.certificate_fingerprint,
+        &request.public_key_fingerprint,
+    )
+    .map_err(AppError::from)?;
+
+    progress(SignIpaProgress::ResolvingAppId);
+    let root_identifier = developer_app_identifier(&request.team_id, request.app.bundle_id());
+    let (app_id, mut updated_account) = resolve_signing_app_id(
+        request.developer_context.clone(),
+        &request.team_id,
+        &request.team_app_ids,
+        request.auto_app_id,
+        request.selected_app_id,
+        &root_identifier,
+        request.app.name(),
+    )
+    .await?;
+    if app_id.developer_id.trim().is_empty() {
+        return Err(AppError::from(
+            "The selected App ID is missing its Xcode identifier. Refresh Developer Settings, then try again.",
+        ));
+    }
+    let expected_identifier = developer_app_identifier(&request.team_id, request.app.bundle_id());
+    if !app_id_matches_identifier(&app_id.identifier, &expected_identifier) {
+        return Err(AppError::from(format!(
+            "App ID {} does not match bundle identifier {}. Select a matching App ID in Developer Settings.",
+            app_id.identifier,
+            request.app.bundle_id()
+        )));
+    }
+
+    let mut team_app_ids = updated_account
+        .as_ref()
+        .and_then(|account| team_app_ids_for_account(account, &request.team_id))
+        .unwrap_or_else(|| request.team_app_ids.clone());
+    let effective_bundle_id = effective_bundle_identifier_for_app(&request.app, &request.team_id);
+    let mut bundle_id_replacements = BTreeMap::from([(
+        request.app.bundle_id().to_string(),
+        effective_bundle_id.clone(),
+    )]);
+    let mut profile_requests = vec![(effective_bundle_id.clone(), app_id.developer_id)];
+
+    for nested_bundle in &request.app.nested_bundles {
+        let effective_nested_bundle_id = effective_nested_bundle_identifier(
+            request.app.original_bundle_id(),
+            request.app.bundle_id(),
+            &nested_bundle.bundle_id,
+            &request.team_id,
+        );
+        let (nested_app_id, account_update) = resolve_signing_app_id(
+            request.developer_context.clone(),
+            &request.team_id,
+            &team_app_ids,
+            true,
+            None,
+            &effective_nested_bundle_id,
+            &nested_bundle.name,
+        )
+        .await?;
+        let expected_identifier = effective_nested_bundle_id.clone();
+        if !app_id_matches_identifier(&nested_app_id.identifier, &expected_identifier) {
+            return Err(AppError::from(format!(
+                "App ID {} does not match nested bundle identifier {}.",
+                nested_app_id.identifier, nested_bundle.bundle_id
+            )));
+        }
+        if nested_app_id.developer_id.trim().is_empty() {
+            return Err(AppError::from(format!(
+                "App ID {} is missing its Xcode identifier.",
+                nested_app_id.identifier
+            )));
+        }
+        if let Some(account) = account_update {
+            team_app_ids = team_app_ids_for_account(&account, &request.team_id)
+                .unwrap_or_else(|| team_app_ids.clone());
+            updated_account = Some(account);
+        }
+        bundle_id_replacements.insert(
+            nested_bundle.bundle_id.clone(),
+            effective_nested_bundle_id.clone(),
+        );
+        profile_requests.push((effective_nested_bundle_id, nested_app_id.developer_id));
+    }
+
+    progress(SignIpaProgress::DownloadingProfile);
+    let mut provisioning_profiles = BTreeMap::new();
+    for (bundle_id, app_id_id) in profile_requests {
+        let profile = download_provisioning_profile(
+            request.developer_context.clone(),
+            request.team_id.clone(),
+            app_id_id,
+        )
+        .await?;
+        provisioning_profiles.insert(bundle_id, profile.bytes);
+    }
+
+    let mut metadata = domain_app_metadata(&request.app);
+    metadata.bundle_id = effective_bundle_id.clone();
+    let destination = match request.output {
+        SignIpaOutput::Ipa(path) => crate::backend::ipa::SigningDestination::Ipa(path),
+        SignIpaOutput::AppBundle => crate::backend::ipa::SigningDestination::AppBundle,
+    };
+    let artifact = crate::backend::ipa::sign_ipa(
+        crate::backend::ipa::IpaSigningRequest {
+            source_path: PathBuf::from(&request.app.path),
+            destination,
+            metadata,
+            bundle_id_replacements,
+            icon_override_path: request.app.icon_override_path.as_deref().map(PathBuf::from),
+            team_id: request.team_id,
+            provisioning_profiles,
+            private_key_pem: signing_material.private_key_pem,
+            certificate_der: signing_material.certificate_der,
+        },
+        move |event| progress(event.into()),
+    )
+    .await
+    .map_err(AppError::from)?;
+    let artifact = match artifact {
+        crate::backend::ipa::SigningArtifact::Ipa(path) => SignIpaArtifact::Ipa(path),
+        crate::backend::ipa::SigningArtifact::AppBundle(app) => SignIpaArtifact::AppBundle(app),
+    };
+
+    Ok(SignIpaOutcome {
+        artifact,
+        updated_account,
+    })
+}
+
+pub(crate) fn app_id_provisioning_plan(
+    team: &TeamOption,
+    auto_app_id: bool,
+    selected_app_id: Option<AppIdOption>,
+    app: &AppOption,
+) -> AppResult<AppIdProvisioningPlan> {
+    let mut missing = BTreeMap::<String, String>::new();
+    let root_identifier = developer_app_identifier(&team.identifier, app.bundle_id());
+
+    if auto_app_id {
+        add_missing_app_id(
+            &mut missing,
+            &team.app_ids,
+            root_identifier,
+            app.name().to_string(),
+        );
+    } else {
+        let selected_app_id = selected_app_id.ok_or_else(|| {
+            AppError::from("Select an App ID in Developer Settings before signing.")
+        })?;
+        if !app_id_matches_identifier(&selected_app_id.identifier, &root_identifier) {
+            return Err(AppError::from(format!(
+                "App ID {} does not match bundle identifier {}. Select a matching App ID in Developer Settings.",
+                selected_app_id.identifier,
+                app.bundle_id()
+            )));
+        }
+    }
+
+    for nested_bundle in &app.nested_bundles {
+        add_missing_app_id(
+            &mut missing,
+            &team.app_ids,
+            effective_nested_bundle_identifier(
+                app.original_bundle_id(),
+                app.bundle_id(),
+                &nested_bundle.bundle_id,
+                &team.identifier,
+            ),
+            nested_bundle.name.clone(),
+        );
+    }
+
+    let app_ids = missing
+        .into_iter()
+        .map(|(identifier, name)| AppIdProvisioningItem { name, identifier })
+        .collect::<Vec<_>>();
+    if let Some(available) = team.app_id_available_quantity {
+        if app_ids.len() as u64 > available {
+            return Err(AppError::from(format!(
+                "Signing requires {} new App IDs, but Apple reports only {available} remaining for {}.",
+                app_ids.len(),
+                team.name
+            )));
+        }
+    }
+
+    Ok(AppIdProvisioningPlan {
+        app_ids,
+        available_quantity: team.app_id_available_quantity,
+    })
+}
+
+fn add_missing_app_id(
+    missing: &mut BTreeMap<String, String>,
+    existing: &[AppIdOption],
+    identifier: String,
+    name: String,
+) {
+    if !existing
+        .iter()
+        .any(|app_id| app_id.identifier == identifier)
+    {
+        missing.entry(identifier).or_insert(name);
+    }
+}
+
+fn team_app_ids_for_account(account: &AccountOption, team_id: &str) -> Option<Vec<AppIdOption>> {
+    account
+        .teams
+        .iter()
+        .find(|team| team.identifier == team_id)
+        .map(|team| team.app_ids.clone())
+}
+
+async fn resolve_signing_app_id(
+    developer_context: DeveloperSessionContext,
+    team_id: &str,
+    team_app_ids: &[AppIdOption],
+    auto_app_id: bool,
+    selected_app_id: Option<AppIdOption>,
+    identifier: &str,
+    app_name: &str,
+) -> AppResult<(AppIdOption, Option<AccountOption>)> {
+    if let Some(app_id) =
+        existing_signing_app_id(team_app_ids, auto_app_id, selected_app_id, identifier)?
+    {
+        return Ok((app_id.clone(), None));
+    }
+
+    let account = add_app_id(
+        developer_context,
+        team_id.to_string(),
+        identifier.to_string(),
+        app_name.to_string(),
+    )
+    .await?;
+    let app_id = account
+        .teams
+        .iter()
+        .find(|team| team.identifier == team_id)
+        .and_then(|team| {
+            team.app_ids
+                .iter()
+                .find(|app_id| app_id.identifier == identifier)
+        })
+        .cloned()
+        .ok_or_else(|| {
+            AppError::from(format!(
+                "Apple created App ID {identifier}, but it was not returned by the developer portal. Refresh Developer Settings and try again."
+            ))
+        })?;
+    Ok((app_id, Some(account)))
+}
+
+fn existing_signing_app_id(
+    team_app_ids: &[AppIdOption],
+    auto_app_id: bool,
+    selected_app_id: Option<AppIdOption>,
+    automatic_identifier: &str,
+) -> AppResult<Option<AppIdOption>> {
+    if !auto_app_id {
+        return selected_app_id.map(Some).ok_or_else(|| {
+            AppError::from("Select an App ID in Developer Settings before signing.")
+        });
+    }
+
+    Ok(team_app_ids
+        .iter()
+        .find(|app_id| app_id.identifier == automatic_identifier)
+        .cloned())
+}
+
+fn developer_app_identifier(team_id: &str, bundle_id: &str) -> String {
+    effective_bundle_identifier(bundle_id.trim(), team_id)
+}
+
+fn app_id_matches_identifier(app_id: &str, expected_identifier: &str) -> bool {
+    app_id == expected_identifier
+        || app_id
+            .strip_suffix('*')
+            .is_some_and(|prefix| expected_identifier.starts_with(prefix))
+}
+
 pub(crate) fn is_ipa_path(path: &Path) -> bool {
     selection::is_ipa_path(path)
 }
@@ -251,6 +780,39 @@ pub(crate) async fn delete_app_id(
         .map_err(AppError::from)
 }
 
+pub(crate) async fn list_developer_devices(
+    context: DeveloperSessionContext,
+    team_id: String,
+) -> AppResult<Vec<DeveloperDeviceOption>> {
+    developer_services::list_developer_devices(context.into_backend(), team_id)
+        .await
+        .map(developer_device_options)
+        .map_err(AppError::from)
+}
+
+pub(crate) async fn add_developer_device(
+    context: DeveloperSessionContext,
+    team_id: String,
+    name: String,
+    udid: String,
+) -> AppResult<Vec<DeveloperDeviceOption>> {
+    developer_services::add_developer_device(context.into_backend(), team_id, name, udid)
+        .await
+        .map(developer_device_options)
+        .map_err(AppError::from)
+}
+
+pub(crate) async fn delete_developer_device(
+    context: DeveloperSessionContext,
+    team_id: String,
+    device_id: String,
+) -> AppResult<Vec<DeveloperDeviceOption>> {
+    developer_services::delete_developer_device(context.into_backend(), team_id, device_id)
+        .await
+        .map(developer_device_options)
+        .map_err(AppError::from)
+}
+
 pub(crate) async fn create_certificate(
     context: DeveloperSessionContext,
     team_id: String,
@@ -300,3 +862,277 @@ pub(crate) async fn download_provisioning_profile(
         .await
         .map_err(AppError::from)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::app::models::{
+        AppMetadata, EntitlementsSource, NestedBundleOption, SupportedDeviceFamily,
+    };
+
+    fn app_id(identifier: &str) -> AppIdOption {
+        AppIdOption {
+            developer_id: format!("xcode-{identifier}"),
+            name: identifier.to_string(),
+            identifier: identifier.to_string(),
+            kind: "Explicit App ID".to_string(),
+            capabilities: Vec::new(),
+        }
+    }
+
+    fn app(bundle_id: &str, nested_bundle_ids: &[&str]) -> AppOption {
+        AppOption {
+            metadata: AppMetadata::sample(
+                "Example",
+                bundle_id,
+                "1.0",
+                "1",
+                "Example",
+                "15.0",
+                vec![SupportedDeviceFamily::IPhone],
+            ),
+            nested_bundles: nested_bundle_ids
+                .iter()
+                .map(|bundle_id| NestedBundleOption {
+                    name: bundle_id.rsplit('.').next().unwrap().to_string(),
+                    bundle_id: (*bundle_id).to_string(),
+                })
+                .collect(),
+            path: "/tmp/Example.ipa".to_string(),
+            icon_path: None,
+            icon_override_path: None,
+            entitlements: Vec::new(),
+            entitlements_source: EntitlementsSource::GeneratedFallback,
+            entitlement_overrides: None,
+            patches: Vec::new(),
+        }
+    }
+
+    fn team(app_ids: Vec<AppIdOption>, available: Option<u64>) -> TeamOption {
+        TeamOption {
+            name: "Example Team".to_string(),
+            identifier: "TEAM".to_string(),
+            role: "Admin".to_string(),
+            app_id_available_quantity: available,
+            app_id_max_quantity: Some(10),
+            app_ids,
+            certificates: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn automatic_app_id_uses_exact_team_suffixed_match() {
+        let app_ids = vec![
+            app_id("com.example.other.TEAM"),
+            app_id("com.example.app.TEAM"),
+        ];
+
+        let selected = existing_signing_app_id(
+            &app_ids,
+            true,
+            Some(app_ids[0].clone()),
+            "com.example.app.TEAM",
+        )
+        .unwrap()
+        .unwrap();
+
+        assert_eq!(selected.identifier, "com.example.app.TEAM");
+    }
+
+    #[test]
+    fn automatic_app_id_requests_creation_when_exact_match_is_missing() {
+        let app_ids = vec![app_id("com.example.other.TEAM")];
+
+        assert!(
+            existing_signing_app_id(&app_ids, true, None, "com.example.app.TEAM")
+                .unwrap()
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn manual_app_id_requires_and_uses_selection() {
+        let selected = app_id("com.example.manual.TEAM");
+        assert_eq!(
+            existing_signing_app_id(&[], false, Some(selected), "ignored")
+                .unwrap()
+                .unwrap()
+                .identifier,
+            "com.example.manual.TEAM"
+        );
+        assert!(existing_signing_app_id(&[], false, None, "ignored").is_err());
+    }
+
+    #[test]
+    fn developer_identifier_is_suffixed_only_once() {
+        assert_eq!(
+            developer_app_identifier("TEAM", "com.example.app"),
+            "com.example.app.TEAM"
+        );
+        assert_eq!(
+            developer_app_identifier("TEAM", "com.example.app.TEAM"),
+            "com.example.app.TEAM"
+        );
+    }
+
+    #[test]
+    fn app_id_matching_accepts_exact_and_wildcard_identifiers() {
+        assert!(app_id_matches_identifier(
+            "TEAM.com.example.app",
+            "TEAM.com.example.app"
+        ));
+        assert!(app_id_matches_identifier(
+            "TEAM.com.example.*",
+            "TEAM.com.example.app"
+        ));
+        assert!(!app_id_matches_identifier(
+            "TEAM.com.other.app",
+            "TEAM.com.example.app"
+        ));
+    }
+
+    #[test]
+    fn provisioning_plan_counts_unique_missing_root_and_nested_app_ids() {
+        let app = app(
+            "com.example.app",
+            &[
+                "com.example.app.widget",
+                "com.example.app.widget",
+                "com.example.app.share",
+            ],
+        );
+        let team = team(vec![app_id("com.example.app.TEAM.widget")], Some(5));
+
+        let plan = app_id_provisioning_plan(&team, true, None, &app).unwrap();
+
+        assert_eq!(
+            plan.app_ids
+                .iter()
+                .map(|app_id| app_id.identifier.as_str())
+                .collect::<Vec<_>>(),
+            vec!["com.example.app.TEAM", "com.example.app.TEAM.share"]
+        );
+        assert_eq!(plan.available_quantity, Some(5));
+        assert_eq!(plan.remaining_after_signing(), Some(3));
+    }
+
+    #[test]
+    fn provisioning_plan_rebases_nested_ids_when_root_bundle_id_is_overridden() {
+        let mut app = app("com.example.app", &["com.example.app.SubApp.Extension"]);
+        app.metadata
+            .bundle_id
+            .set_override("altcom.example.app".to_string());
+
+        let plan = app_id_provisioning_plan(&team(Vec::new(), Some(5)), true, None, &app).unwrap();
+
+        assert_eq!(
+            plan.app_ids
+                .iter()
+                .map(|app_id| app_id.identifier.as_str())
+                .collect::<Vec<_>>(),
+            vec![
+                "altcom.example.app.TEAM",
+                "altcom.example.app.TEAM.SubApp.Extension",
+            ]
+        );
+    }
+
+    #[test]
+    fn provisioning_plan_does_not_create_manually_selected_root_app_id() {
+        let app = app("com.example.app", &["com.example.app.widget"]);
+        let selected = app_id("com.example.app.TEAM");
+        let team = team(vec![selected.clone()], Some(4));
+
+        let plan = app_id_provisioning_plan(&team, false, Some(selected), &app).unwrap();
+
+        assert_eq!(plan.app_ids.len(), 1);
+        assert_eq!(plan.app_ids[0].identifier, "com.example.app.TEAM.widget");
+    }
+
+    #[test]
+    fn provisioning_plan_rejects_insufficient_refreshed_quota() {
+        let app = app("com.example.app", &["com.example.app.widget"]);
+        let error =
+            app_id_provisioning_plan(&team(Vec::new(), Some(1)), true, None, &app).unwrap_err();
+
+        assert!(error.user_message().contains("requires 2 new App IDs"));
+        assert!(error.user_message().contains("only 1 remaining"));
+    }
+
+    #[test]
+    fn signing_progress_is_monotonic_across_pipeline_stages() {
+        let events = [
+            SignIpaProgress::Preparing,
+            SignIpaProgress::ResolvingAppId,
+            SignIpaProgress::DownloadingProfile,
+            SignIpaProgress::Extracting {
+                completed: 0,
+                total: 10,
+            },
+            SignIpaProgress::Extracting {
+                completed: 10,
+                total: 10,
+            },
+            SignIpaProgress::Patching,
+            SignIpaProgress::Signing,
+            SignIpaProgress::Packaging {
+                completed: 0,
+                total: 20,
+            },
+            SignIpaProgress::Packaging {
+                completed: 20,
+                total: 20,
+            },
+            SignIpaProgress::Saving,
+            SignIpaProgress::Ready,
+        ];
+        let values = events.map(SignIpaProgress::progress);
+
+        assert!(values.windows(2).all(|window| window[0] <= window[1]));
+        assert_eq!(SignIpaProgress::Saving.progress(), 0.98);
+        assert_eq!(
+            SignIpaProgress::Extracting {
+                completed: 4,
+                total: 10
+            }
+            .label(),
+            "Extracting IPA (4/10)"
+        );
+    }
+
+    #[test]
+    fn installation_progress_is_monotonic_and_reports_transfer_size() {
+        let events = [
+            InstallAppProgress::Connecting,
+            InstallAppProgress::Uploading {
+                transferred_bytes: 0,
+                total_bytes: 10 * 1024 * 1024,
+                completed_files: 0,
+                total_files: 20,
+            },
+            InstallAppProgress::Uploading {
+                transferred_bytes: 10 * 1024 * 1024,
+                total_bytes: 10 * 1024 * 1024,
+                completed_files: 20,
+                total_files: 20,
+            },
+            InstallAppProgress::Installing { percent: 0 },
+            InstallAppProgress::Installing { percent: 100 },
+            InstallAppProgress::Finalizing,
+        ];
+        let values = events.map(InstallAppProgress::progress);
+
+        assert!(values.windows(2).all(|window| window[0] <= window[1]));
+        assert_eq!(InstallAppProgress::Finalizing.progress(), 0.99);
+        assert_eq!(
+            InstallAppProgress::Uploading {
+                transferred_bytes: 5 * 1024 * 1024,
+                total_bytes: 10 * 1024 * 1024,
+                completed_files: 10,
+                total_files: 20,
+            }
+            .label(),
+            "Uploading app files (10/20, 5.0 MB / 10.0 MB)"
+        );
+    }
+}

super-sideloader/src/app/entitlements.rs

View file @ 65cd6c1

@@ -4,23 +4,56 @@ pub(crate) fn effective_entitlements_for_app(
     app: &AppOption,
     team_id: &str,
 ) -> Vec<AppEntitlement> {
+    let bundle_id = effective_bundle_identifier_for_app(app, team_id);
     effective_entitlements(
         app.entitlements_source,
         &app.entitlements,
         app.entitlement_overrides.as_deref(),
-        app.bundle_id(),
+        &bundle_id,
         team_id,
     )
 }
 
+pub(crate) fn effective_bundle_identifier_for_app(app: &AppOption, team_id: &str) -> String {
+    effective_bundle_identifier(app.bundle_id(), team_id)
+}
+
+pub(crate) fn effective_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
+    let team_id = team_id.trim();
+    if team_id.is_empty()
+        || bundle_id
+            .strip_suffix(team_id)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+    {
+        bundle_id.to_string()
+    } else {
+        format!("{bundle_id}.{team_id}")
+    }
+}
+
+pub(crate) fn effective_nested_bundle_identifier(
+    original_root_bundle_id: &str,
+    root_bundle_id: &str,
+    nested_bundle_id: &str,
+    team_id: &str,
+) -> String {
+    let effective_root = effective_bundle_identifier(root_bundle_id, team_id);
+    nested_bundle_id
+        .strip_prefix(original_root_bundle_id)
+        .filter(|suffix| suffix.starts_with('.'))
+        .map(|suffix| format!("{effective_root}{suffix}"))
+        .unwrap_or_else(|| effective_bundle_identifier(nested_bundle_id, team_id))
+}
+
 pub(crate) fn default_effective_entitlements_for_app(
     app: &AppOption,
     team_id: &str,
 ) -> Vec<AppEntitlement> {
+    let bundle_id = effective_bundle_identifier_for_app(app, team_id);
     default_effective_entitlements(
         app.entitlements_source,
         &app.entitlements,
-        app.bundle_id(),
+        &bundle_id,
         team_id,
     )
 }
@@ -93,11 +126,8 @@ fn team_adjusted_entitlement(
     let mut entitlement = entitlement.clone();
     match entitlement.key.as_str() {
         "application-identifier" => {
-            entitlement.value = EntitlementValue::String(team_prefixed_identifier(
-                &entitlement.value.edit_text(),
-                bundle_id,
-                team_id,
-            ));
+            entitlement.value =
+                EntitlementValue::String(team_prefixed_bundle_identifier(bundle_id, team_id));
         }
         "com.apple.developer.team-identifier" => {
             entitlement.value = EntitlementValue::String(team_id.to_string());
@@ -151,9 +181,13 @@ fn team_prefixed_identifier(value: &str, bundle_id: &str, team_id: &str) -> Stri
     team_prefixed_bundle_identifier(suffix, team_id)
 }
 
-fn team_prefixed_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
+pub(crate) fn team_prefixed_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
     let team_id = team_id.trim();
-    if team_id.is_empty() {
+    if team_id.is_empty()
+        || bundle_id
+            .strip_prefix(team_id)
+            .is_some_and(|suffix| suffix.starts_with('.'))
+    {
         bundle_id.to_string()
     } else {
         format!("{team_id}.{bundle_id}")
@@ -190,6 +224,48 @@ mod tests {
         assert!(!text.contains("TEAMID"));
     }
 
+    #[test]
+    fn team_prefixed_bundle_identifier_is_idempotent() {
+        assert_eq!(
+            team_prefixed_bundle_identifier("com.example.app", "TEAM123"),
+            "TEAM123.com.example.app"
+        );
+        assert_eq!(
+            team_prefixed_bundle_identifier("TEAM123.com.example.app", "TEAM123"),
+            "TEAM123.com.example.app"
+        );
+    }
+
+    #[test]
+    fn effective_bundle_identifiers_match_sideloader_layout() {
+        assert_eq!(
+            effective_bundle_identifier("com.example.app", "TEAM123"),
+            "com.example.app.TEAM123"
+        );
+        assert_eq!(
+            effective_bundle_identifier("com.example.app.TEAM123", "TEAM123"),
+            "com.example.app.TEAM123"
+        );
+        assert_eq!(
+            effective_nested_bundle_identifier(
+                "com.example.app",
+                "com.example.app",
+                "com.example.app.widget",
+                "TEAM123"
+            ),
+            "com.example.app.TEAM123.widget"
+        );
+        assert_eq!(
+            effective_nested_bundle_identifier(
+                "com.example.app",
+                "altcom.example.app",
+                "com.example.app.SubApp.Extension",
+                "TEAM123"
+            ),
+            "altcom.example.app.TEAM123.SubApp.Extension"
+        );
+    }
+
     #[test]
     fn embedded_entitlements_are_adjusted_for_selected_team() {
         let entitlements = default_effective_entitlements(
@@ -212,7 +288,7 @@ mod tests {
 
         assert_eq!(
             entitlements[0].value,
-            EntitlementValue::String("TEAM123.com.old.app".into())
+            EntitlementValue::String("TEAM123.com.example.app".into())
         );
         assert_eq!(
             entitlements[1].value,
@@ -232,6 +308,7 @@ mod tests {
                 "16.0",
                 vec![SupportedDeviceFamily::IPhone],
             ),
+            nested_bundles: Vec::new(),
             path: "/tmp/Example.ipa".to_string(),
             icon_path: None,
             icon_override_path: None,
@@ -250,7 +327,7 @@ mod tests {
                 app.entitlements_source,
                 &app.entitlements,
                 app.entitlement_overrides.as_deref(),
-                app.bundle_id(),
+                "com.example.app.TEAM123",
                 "TEAM123",
             )
         );
@@ -259,9 +336,13 @@ mod tests {
             default_effective_entitlements(
                 app.entitlements_source,
                 &app.entitlements,
-                app.bundle_id(),
+                "com.example.app.TEAM123",
                 "TEAM123",
             )
         );
+        assert_eq!(
+            effective_entitlements_for_app(&app, "TEAM123")[0].value,
+            EntitlementValue::String("TEAM123.com.example.app.TEAM123".into())
+        );
     }
 }

super-sideloader/src/app/models.rs

View file @ 65cd6c1

@@ -29,15 +29,23 @@ pub(crate) struct DevelopmentCertificateOption {
     pub(crate) serial_number: String,
     pub(crate) machine_name: String,
     pub(crate) private_key_available: bool,
+    pub(crate) certificate_fingerprint: Option<String>,
     pub(crate) public_key_fingerprint: Option<String>,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct DeveloperDeviceOption {
+    pub(crate) id: String,
+    pub(crate) name: String,
+    pub(crate) udid: String,
+}
+
 impl DevelopmentCertificateOption {
     pub(crate) fn private_key_status(&self) -> &'static str {
         if self.private_key_available {
-            "Private key available"
+            "Managed private key available"
         } else {
-            "Private key missing"
+            "Managed private key missing"
         }
     }
 
@@ -428,6 +436,7 @@ pub(crate) enum EntitlementsSource {
 #[derive(Clone, Debug)]
 pub(crate) struct AppOption {
     pub(crate) metadata: AppMetadata,
+    pub(crate) nested_bundles: Vec<NestedBundleOption>,
     pub(crate) path: String,
     pub(crate) icon_path: Option<String>,
     pub(crate) icon_override_path: Option<String>,
@@ -437,6 +446,12 @@ pub(crate) struct AppOption {
     pub(crate) patches: Vec<PatchOption>,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct NestedBundleOption {
+    pub(crate) name: String,
+    pub(crate) bundle_id: String,
+}
+
 impl AppOption {
     pub(crate) fn name(&self) -> &String {
         self.metadata.name.value()
@@ -446,6 +461,10 @@ impl AppOption {
         self.metadata.bundle_id.value()
     }
 
+    pub(crate) fn original_bundle_id(&self) -> &String {
+        &self.metadata.bundle_id.default
+    }
+
     pub(crate) fn version(&self) -> &String {
         self.metadata.version.value()
     }
@@ -626,9 +645,17 @@ pub(crate) enum SideloadPhase {
 #[derive(Clone, Debug)]
 pub(crate) enum SideloadOperation {
     Idle,
-    Running { phase: SideloadPhase, progress: f32 },
-    Finished,
-    Failed { message: String },
+    Running {
+        phase: SideloadPhase,
+        progress: f32,
+        detail: String,
+    },
+    Finished {
+        message: String,
+    },
+    Failed {
+        message: String,
+    },
 }
 
 impl SideloadOperation {
@@ -640,7 +667,7 @@ impl SideloadOperation {
         match self {
             Self::Idle => 0.,
             Self::Running { progress, .. } => progress.clamp(0., 1.),
-            Self::Finished => 1.,
+            Self::Finished { .. } => 1.,
             Self::Failed { .. } => 0.,
         }
     }

super-sideloader/src/app/preferences.rs

View file @ 65cd6c1

@@ -311,6 +311,7 @@ mod tests {
                 "16.0",
                 vec![SupportedDeviceFamily::IPhone],
             ),
+            nested_bundles: Vec::new(),
             path: "/tmp/App.ipa".to_string(),
             icon_path: None,
             icon_override_path: None,

super-sideloader/src/app/selection.rs

View file @ 65cd6c1

@@ -125,6 +125,7 @@ mod tests {
                 "16.0",
                 vec![SupportedDeviceFamily::IPhone],
             ),
+            nested_bundles: Vec::new(),
             path: path.to_string(),
             icon_path: None,
             icon_override_path: None,

super-sideloader/src/app/state.rs

View file @ 65cd6c1

@@ -579,6 +579,7 @@ mod tests {
             serial_number: serial_number.to_string(),
             machine_name: "Mac".to_string(),
             private_key_available: true,
+            certificate_fingerprint: Some(format!("certificate-fingerprint-{serial_number}")),
             public_key_fingerprint: Some(format!("fingerprint-{serial_number}")),
         }
     }

super-sideloader/src/app/view_models.rs

View file @ 65cd6c1

@@ -1,13 +1,14 @@
 use crate::app::models::{
     AccountOption, AdiBackendAvailability, AdiBackendDetail, AdiBackendKind, AdiBackendOption,
     AdiProvisioningState, AdiRepairAction, AppEntitlement, AppIdCapabilityOption, AppIdOption,
-    AppMetadata, AppOption, DevelopmentCertificateOption, DeviceOption, EntitlementValue,
-    EntitlementsSource, MachineIdentity, PatchOption, SupportedDeviceFamily, TeamOption,
+    AppMetadata, AppOption, DeveloperDeviceOption, DevelopmentCertificateOption, DeviceOption,
+    EntitlementValue, EntitlementsSource, MachineIdentity, NestedBundleOption, PatchOption,
+    SupportedDeviceFamily, TeamOption,
 };
 use crate::domain::{
     adi as domain_adi, device as domain_device, identity as domain_identity, ipa as domain_ipa,
     DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate,
-    DeveloperTeam,
+    DeveloperDevice, DeveloperTeam,
 };
 
 pub(crate) fn account_option(account: DeveloperAccount) -> AccountOption {
@@ -93,6 +94,14 @@ pub(crate) fn app_option(app: domain_ipa::IpaApp) -> AppOption {
                 .map(supported_device_family)
                 .collect(),
         ),
+        nested_bundles: app
+            .nested_bundles
+            .into_iter()
+            .map(|bundle| NestedBundleOption {
+                name: bundle.name,
+                bundle_id: bundle.bundle_id,
+            })
+            .collect(),
         path: app.path,
         icon_path: app.icon_path,
         icon_override_path: None,
@@ -114,6 +123,19 @@ pub(crate) fn device_options(devices: Vec<domain_device::Device>) -> Vec<DeviceO
     devices.into_iter().map(device_option).collect()
 }
 
+pub(crate) fn developer_device_options(
+    devices: Vec<DeveloperDevice>,
+) -> Vec<DeveloperDeviceOption> {
+    devices
+        .into_iter()
+        .map(|device| DeveloperDeviceOption {
+            id: device.id,
+            name: device.name,
+            udid: device.udid,
+        })
+        .collect()
+}
+
 pub(crate) fn domain_patch(patch: PatchOption) -> domain_ipa::Patch {
     domain_ipa::Patch {
         name: patch.name,
@@ -121,6 +143,35 @@ pub(crate) fn domain_patch(patch: PatchOption) -> domain_ipa::Patch {
     }
 }
 
+pub(crate) fn domain_app_metadata(app: &AppOption) -> domain_ipa::AppMetadata {
+    domain_ipa::AppMetadata {
+        name: app.name().to_string(),
+        bundle_id: app.bundle_id().to_string(),
+        version: app.version().to_string(),
+        build: app.build().to_string(),
+        executable: app.metadata.executable.value().to_string(),
+        minimum_os: app.metadata.minimum_os.value().to_string(),
+        supported_devices: app
+            .supported_devices()
+            .iter()
+            .copied()
+            .map(domain_supported_device_family)
+            .collect(),
+    }
+}
+
+pub(crate) fn domain_app_entitlements(
+    entitlements: &[AppEntitlement],
+) -> Vec<domain_ipa::AppEntitlement> {
+    entitlements
+        .iter()
+        .map(|entitlement| domain_ipa::AppEntitlement {
+            key: entitlement.key.clone(),
+            value: domain_entitlement_value(&entitlement.value),
+        })
+        .collect()
+}
+
 fn team_option(team: DeveloperTeam) -> TeamOption {
     TeamOption {
         name: team.name,
@@ -171,6 +222,7 @@ fn certificate_option(certificate: DeveloperCertificate) -> DevelopmentCertifica
         serial_number: certificate.serial_number,
         machine_name: certificate.machine_name,
         private_key_available: certificate.private_key_available,
+        certificate_fingerprint: certificate.certificate_fingerprint,
         public_key_fingerprint: certificate.public_key_fingerprint,
     }
 }
@@ -230,6 +282,18 @@ fn supported_device_family(family: domain_ipa::SupportedDeviceFamily) -> Support
     }
 }
 
+fn domain_supported_device_family(
+    family: SupportedDeviceFamily,
+) -> domain_ipa::SupportedDeviceFamily {
+    match family {
+        SupportedDeviceFamily::IPhone => domain_ipa::SupportedDeviceFamily::IPhone,
+        SupportedDeviceFamily::IPad => domain_ipa::SupportedDeviceFamily::IPad,
+        SupportedDeviceFamily::AppleTv => domain_ipa::SupportedDeviceFamily::AppleTv,
+        SupportedDeviceFamily::AppleWatch => domain_ipa::SupportedDeviceFamily::AppleWatch,
+        SupportedDeviceFamily::Mac => domain_ipa::SupportedDeviceFamily::Mac,
+    }
+}
+
 fn app_entitlement(entitlement: domain_ipa::AppEntitlement) -> AppEntitlement {
     AppEntitlement {
         key: entitlement.key,
@@ -259,6 +323,28 @@ fn entitlement_value(value: domain_ipa::EntitlementValue) -> EntitlementValue {
     }
 }
 
+fn domain_entitlement_value(value: &EntitlementValue) -> domain_ipa::EntitlementValue {
+    match value {
+        EntitlementValue::String(value) => domain_ipa::EntitlementValue::String(value.clone()),
+        EntitlementValue::Boolean(value) => domain_ipa::EntitlementValue::Boolean(*value),
+        EntitlementValue::Integer(value) => domain_ipa::EntitlementValue::Integer(*value),
+        EntitlementValue::Number(value) => domain_ipa::EntitlementValue::Number(*value),
+        EntitlementValue::Array(values) => domain_ipa::EntitlementValue::Array(
+            values.iter().map(domain_entitlement_value).collect(),
+        ),
+        EntitlementValue::Dictionary(values) => domain_ipa::EntitlementValue::Dictionary(
+            values
+                .iter()
+                .map(|(key, value)| (key.clone(), domain_entitlement_value(value)))
+                .collect(),
+        ),
+        EntitlementValue::Data(value) => domain_ipa::EntitlementValue::Data(value.clone()),
+        EntitlementValue::Date(value) => domain_ipa::EntitlementValue::Date(value.clone()),
+        EntitlementValue::Uid(value) => domain_ipa::EntitlementValue::Uid(*value),
+        EntitlementValue::Unknown(value) => domain_ipa::EntitlementValue::Unknown(value.clone()),
+    }
+}
+
 fn entitlements_source(source: domain_ipa::EntitlementsSource) -> EntitlementsSource {
     match source {
         domain_ipa::EntitlementsSource::Embedded => EntitlementsSource::Embedded,
@@ -313,6 +399,7 @@ mod tests {
                     serial_number: "SERIAL".to_string(),
                     machine_name: "Mac".to_string(),
                     private_key_available: true,
+                    certificate_fingerprint: Some("certificate-fingerprint".to_string()),
                     public_key_fingerprint: Some("fingerprint".to_string()),
                 }],
             }],
@@ -377,6 +464,19 @@ mod tests {
         assert_eq!(options[0].connection, "USB");
     }
 
+    #[test]
+    fn developer_device_maps_to_settings_option() {
+        let options = developer_device_options(vec![DeveloperDevice {
+            id: "portal-device-id".to_string(),
+            name: "Development iPhone".to_string(),
+            udid: "0000000000000000000000000000000000000000".to_string(),
+        }]);
+
+        assert_eq!(options[0].id, "portal-device-id");
+        assert_eq!(options[0].name, "Development iPhone");
+        assert_eq!(options[0].udid.len(), 40);
+    }
+
     #[test]
     fn ipa_app_maps_to_ui_app_option_at_app_boundary() {
         let option = app_option(domain_ipa::IpaApp {
@@ -392,6 +492,10 @@ mod tests {
                     domain_ipa::SupportedDeviceFamily::IPad,
                 ],
             },
+            nested_bundles: vec![domain_ipa::NestedBundle {
+                name: "Widget".to_string(),
+                bundle_id: "com.example.app.Widget".to_string(),
+            }],
             path: "/tmp/Example.ipa".to_string(),
             icon_path: Some("/tmp/icon.png".to_string()),
             entitlements: vec![domain_ipa::AppEntitlement {
@@ -407,6 +511,7 @@ mod tests {
 
         assert_eq!(option.name(), "Example");
         assert_eq!(option.bundle_id(), "com.example.app");
+        assert_eq!(option.nested_bundles[0].bundle_id, "com.example.app.Widget");
         assert_eq!(
             option.supported_devices(),
             &[SupportedDeviceFamily::IPhone, SupportedDeviceFamily::IPad]

super-sideloader/src/backend/developer/accounts.rs

View file @ 65cd6c1

@@ -1,12 +1,14 @@
 pub(crate) use crate::backend::developer::cache::load_cached_account_options;
 pub(crate) use crate::backend::developer::repository::{
-    add_developer_app_id, create_developer_certificate, delete_account_cache,
-    delete_developer_app_id, developer_secondary_action_not_supported,
+    add_developer_app_id, add_developer_device, create_developer_certificate, delete_account_cache,
+    delete_developer_app_id, delete_developer_device, developer_secondary_action_not_supported,
     download_developer_provisioning_profile, import_developer_certificate_private_key,
-    login_developer_account, refresh_developer_account, revoke_developer_certificate,
-    update_developer_app_id, DeveloperAccountRefreshRequest, DeveloperAppIdAddRequest,
-    DeveloperAppIdCapabilityUpdate, DeveloperAppIdDeleteRequest, DeveloperAppIdUpdateRequest,
-    DeveloperCertificateCreateRequest, DeveloperCertificatePrivateKeyImportRequest,
-    DeveloperCertificateRevokeRequest, DeveloperLoginOutcome, DeveloperLoginRequest,
-    DeveloperProvisioningProfileDownloadRequest, DownloadedProvisioningProfile,
+    list_developer_devices, login_developer_account, refresh_developer_account,
+    revoke_developer_certificate, update_developer_app_id, DeveloperAccountRefreshRequest,
+    DeveloperAppIdAddRequest, DeveloperAppIdCapabilityUpdate, DeveloperAppIdDeleteRequest,
+    DeveloperAppIdUpdateRequest, DeveloperCertificateCreateRequest,
+    DeveloperCertificatePrivateKeyImportRequest, DeveloperCertificateRevokeRequest,
+    DeveloperDeviceAddRequest, DeveloperDeviceDeleteRequest, DeveloperDeviceListRequest,
+    DeveloperLoginOutcome, DeveloperLoginRequest, DeveloperProvisioningProfileDownloadRequest,
+    DownloadedProvisioningProfile,
 };

super-sideloader/src/backend/developer/cache.rs

View file @ 65cd6c1

@@ -91,6 +91,8 @@ pub(crate) struct CachedDevelopmentCertificate {
     pub(crate) machine_name: String,
     pub(crate) private_key_available: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub(crate) certificate_fingerprint: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub(crate) public_key_fingerprint: Option<String>,
 }
 
@@ -199,6 +201,7 @@ impl From<CachedDevelopmentCertificate> for DeveloperCertificate {
             serial_number: certificate.serial_number,
             machine_name: certificate.machine_name,
             private_key_available: certificate.private_key_available,
+            certificate_fingerprint: certificate.certificate_fingerprint,
             public_key_fingerprint: certificate.public_key_fingerprint,
         }
     }
@@ -440,6 +443,7 @@ mod tests {
                 serial_number: id.to_string(),
                 machine_name: "Machine".to_string(),
                 private_key_available: false,
+                certificate_fingerprint: None,
                 public_key_fingerprint: None,
             }],
         }
@@ -471,4 +475,21 @@ mod tests {
         assert_eq!(account.teams.len(), 2);
         assert_eq!(account.teams[1].id, "TEAM2");
     }
+
+    #[test]
+    fn old_certificate_cache_entries_need_a_certificate_refresh() {
+        let certificate: CachedDevelopmentCertificate = toml::from_str(
+            r#"
+id = "cert-id"
+name = "Apple Development"
+serial_number = "serial"
+machine_name = "Mac"
+private_key_available = true
+public_key_fingerprint = "0123456789012345678901234567890123456789"
+"#,
+        )
+        .unwrap();
+
+        assert_eq!(certificate.certificate_fingerprint, None);
+    }
 }

super-sideloader/src/backend/developer/certificates.rs

View file @ 65cd6c1

@@ -6,6 +6,9 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use uuid::Uuid;
 
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
 #[derive(Clone, Debug)]
 pub(crate) struct GeneratedCertificateSigningRequest {
     pub(crate) machine_id: String,
@@ -15,6 +18,11 @@ pub(crate) struct GeneratedCertificateSigningRequest {
     pub(crate) private_key_pem: Vec<u8>,
 }
 
+pub(crate) struct AppManagedSigningMaterial {
+    pub(crate) private_key_pem: Vec<u8>,
+    pub(crate) certificate_der: Vec<u8>,
+}
+
 pub(crate) fn generate_development_certificate_signing_request(
 ) -> BackendResult<GeneratedCertificateSigningRequest> {
     let machine_id = Uuid::new_v4().to_string().to_uppercase();
@@ -124,29 +132,50 @@ pub(crate) fn app_managed_private_key_fingerprints() -> Vec<String> {
         .collect()
 }
 
-#[cfg(target_os = "macos")]
-pub(crate) fn local_code_signing_identity_fingerprints() -> Vec<String> {
-    let output = match Command::new("security")
-        .args(["find-identity", "-v", "-p", "codesigning"])
-        .output()
-    {
-        Ok(output) if output.status.success() => output,
-        _ => return Vec::new(),
-    };
-
-    String::from_utf8_lossy(&output.stdout)
-        .split_whitespace()
-        .filter_map(|part| {
-            let fingerprint = part.trim();
-            (fingerprint.len() == 40 && fingerprint.bytes().all(|byte| byte.is_ascii_hexdigit()))
-                .then(|| fingerprint.to_ascii_uppercase())
+pub(crate) fn save_app_managed_certificate(
+    fingerprint: &str,
+    certificate_der: &[u8],
+) -> BackendResult<()> {
+    let certificates_dir = signing_certificates_dir()?;
+    fs::create_dir_all(&certificates_dir).map_err(|source| BackendError::Io {
+        action: "Create signing certificate folder",
+        path: certificates_dir.clone(),
+        source,
+    })?;
+    let certificate_path = certificates_dir.join(format!("{}.der", safe_fingerprint(fingerprint)?));
+    fs::write(&certificate_path, certificate_der).map_err(|source| BackendError::Io {
+        action: "Save signing certificate",
+        path: certificate_path,
+        source,
     })
-        .collect()
 }
 
-#[cfg(not(target_os = "macos"))]
-pub(crate) fn local_code_signing_identity_fingerprints() -> Vec<String> {
-    Vec::new()
+pub(crate) fn load_app_managed_signing_material(
+    certificate_fingerprint: &str,
+    public_key_fingerprint: &str,
+) -> BackendResult<AppManagedSigningMaterial> {
+    let certificate_path = signing_certificates_dir()?.join(format!(
+        "{}.der",
+        safe_fingerprint(certificate_fingerprint)?
+    ));
+    let certificate_der = read_signing_resource(
+        &certificate_path,
+        "Read signing certificate",
+        "The selected certificate data is not cached. Refresh Developer Settings, then try signing again.",
+    )?;
+
+    let private_key_path =
+        certificate_keys_dir()?.join(format!("{}.pem", safe_fingerprint(public_key_fingerprint)?));
+    let private_key_pem = read_signing_resource(
+        &private_key_path,
+        "Read certificate private key",
+        "The selected certificate has no Super Sideloader managed private key. Create a certificate or import its matching PEM key in Developer Settings.",
+    )?;
+
+    Ok(AppManagedSigningMaterial {
+        private_key_pem,
+        certificate_der,
+    })
 }
 
 fn public_key_der_from_private_key(key_path: &Path) -> BackendResult<Vec<u8>> {
@@ -205,14 +234,60 @@ pub(crate) fn save_app_managed_private_key(
         path: keys_dir.clone(),
         source,
     })?;
-    let key_path = keys_dir.join(format!("{fingerprint}.pem"));
+    let key_path = keys_dir.join(format!("{}.pem", safe_fingerprint(fingerprint)?));
     fs::write(&key_path, private_key_pem).map_err(|source| BackendError::Io {
         action: "Save certificate private key",
-        path: key_path,
+        path: key_path.clone(),
         source,
+    })?;
+    secure_private_key_file(&key_path)
+}
+
+#[cfg(unix)]
+fn secure_private_key_file(path: &Path) -> BackendResult<()> {
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600)).map_err(|source| {
+        BackendError::Io {
+            action: "Secure certificate private key",
+            path: path.to_path_buf(),
+            source,
+        }
+    })
+}
+
+#[cfg(not(unix))]
+fn secure_private_key_file(_: &Path) -> BackendResult<()> {
+    Ok(())
+}
+
+fn read_signing_resource(
+    path: &Path,
+    action: &'static str,
+    missing_message: &str,
+) -> BackendResult<Vec<u8>> {
+    fs::read(path).map_err(|source| {
+        if source.kind() == std::io::ErrorKind::NotFound {
+            BackendError::Message(missing_message.to_string())
+        } else {
+            BackendError::Io {
+                action,
+                path: path.to_path_buf(),
+                source,
+            }
+        }
     })
 }
 
+fn safe_fingerprint(fingerprint: &str) -> BackendResult<String> {
+    let fingerprint = fingerprint.trim().to_ascii_uppercase();
+    if fingerprint.len() == 40 && fingerprint.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        Ok(fingerprint)
+    } else {
+        Err(BackendError::Cache(
+            "Signing certificate cache contains an invalid fingerprint.".to_string(),
+        ))
+    }
+}
+
 fn certificate_keys_dir() -> BackendResult<PathBuf> {
     app_data_dir()
         .map(|path| path.join("certificates").join("keys"))
@@ -221,6 +296,14 @@ fn certificate_keys_dir() -> BackendResult<PathBuf> {
         })
 }
 
+fn signing_certificates_dir() -> BackendResult<PathBuf> {
+    app_data_dir()
+        .map(|path| path.join("certificates").join("certificates"))
+        .ok_or_else(|| {
+            BackendError::Unsupported("The application data folder is not available.".to_string())
+        })
+}
+
 fn certificate_temp_dir() -> BackendResult<PathBuf> {
     app_data_dir()
         .map(|path| path.join("certificates").join("tmp"))

super-sideloader/src/backend/developer/keychain.rs

View file @ 65cd6c1

@@ -1,12 +1,43 @@
 use crate::backend::{BackendError, BackendResult};
 use grandslam::{AuthToken, Token};
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::sync::{Mutex, MutexGuard, OnceLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 const KEYCHAIN_SESSION_VERSION: u32 = 1;
 const KEYRING_SERVICE: &str = "com.Dadoum.Super-Sideloader";
 const TOKEN_EXPIRY_GRACE_MILLIS: u64 = 5 * 60 * 1000;
 
+type KeychainResult<T> = Result<T, String>;
+type SessionCache = HashMap<String, CachedKeychainLookup>;
+type SessionCacheGuard = MutexGuard<'static, SessionCache>;
+
+static SESSION_CACHE: OnceLock<Mutex<SessionCache>> = OnceLock::new();
+
+#[derive(Clone, Debug)]
+struct CachedKeychainSession {
+    encoded_contents: String,
+    session: DeveloperAccountKeychainSession,
+}
+
+#[derive(Clone, Debug)]
+enum CachedKeychainLookup {
+    Session(CachedKeychainSession),
+    Missing,
+    Failed(String),
+}
+
+impl CachedKeychainLookup {
+    fn result(&self) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
+        match self {
+            Self::Session(cached) => Ok(Some(cached.session.clone())),
+            Self::Missing => Ok(None),
+            Self::Failed(error) => Err(BackendError::Keychain(error.clone())),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub(crate) struct DeveloperAccountKeychainSession {
     pub(crate) version: u32,
@@ -34,44 +65,83 @@ pub(crate) fn save_keychain_session(
     account_id: &str,
     session: &DeveloperAccountKeychainSession,
 ) -> BackendResult<()> {
-    let contents = toml::to_string(session).map_err(|error| {
-        BackendError::Keychain(format!(
-            "Failed to encode account keychain payload: {error}"
-        ))
-    })?;
-    keyring_entry(account_id)?
+    let contents = encode_keychain_session(session).map_err(BackendError::Keychain)?;
+    let mut cache = lock_session_cache()?;
+    if matches!(
+        cache.get(account_id),
+        Some(CachedKeychainLookup::Session(cached))
+            if cached.encoded_contents == contents
+    ) {
+        return Ok(());
+    }
+
+    keyring_entry(account_id)
+        .map_err(BackendError::Keychain)?
         .set_password(&contents)
         .map_err(|error| {
             BackendError::Keychain(format!(
                 "Failed to save account session to the system keychain: {error}"
             ))
-        })
+        })?;
+    cache_keychain_session_locked(&mut cache, account_id, session.clone(), contents);
+    Ok(())
 }
 
 pub(crate) fn load_keychain_session(
     account_id: &str,
 ) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
-    let contents = match keyring_entry(account_id)?.get_password() {
-        Ok(contents) => contents,
-        Err(keyring::Error::NoEntry) => return Ok(None),
-        Err(error) => {
-            return Err(BackendError::Keychain(format!(
+    load_keychain_session_once(account_id, || {
+        let entry = keyring_entry(account_id)?;
+        match entry.get_password() {
+            Ok(contents) => Ok(Some(contents)),
+            Err(keyring::Error::NoEntry) => Ok(None),
+            Err(error) => Err(format!(
                 "Failed to read account session from the system keychain: {error}"
-            )));
+            )),
+        }
+    })
 }
+
+fn load_keychain_session_once(
+    account_id: &str,
+    read: impl FnOnce() -> KeychainResult<Option<String>>,
+) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
+    let mut cache = lock_session_cache()?;
+    if let Some(cached) = cache.get(account_id) {
+        return cached.result();
+    }
+
+    let lookup = match read() {
+        Ok(Some(contents)) => match decode_keychain_session(&contents) {
+            Ok(session) => CachedKeychainLookup::Session(session),
+            Err(error) => CachedKeychainLookup::Failed(error),
+        },
+        Ok(None) => CachedKeychainLookup::Missing,
+        Err(error) => CachedKeychainLookup::Failed(error),
     };
-    let mut session: DeveloperAccountKeychainSession =
-        toml::from_str(&contents).map_err(|error| {
-            BackendError::Keychain(format!(
-                "Failed to decode account keychain payload: {error}"
-            ))
-        })?;
-    session.version = KEYCHAIN_SESSION_VERSION;
-    Ok(Some(session))
+    let result = lookup.result();
+    cache.insert(account_id.to_string(), lookup);
+    result
+}
+
+pub(crate) fn cache_keychain_session(
+    account_id: &str,
+    session: &DeveloperAccountKeychainSession,
+) -> BackendResult<()> {
+    let contents = encode_keychain_session(session).map_err(BackendError::Keychain)?;
+    let mut cache = lock_session_cache()?;
+    cache_keychain_session_locked(&mut cache, account_id, session.clone(), contents);
+    Ok(())
 }
 
 pub(crate) fn delete_keychain_session(account_id: &str) -> BackendResult<()> {
-    match keyring_entry(account_id)?.delete_credential() {
+    let mut cache = lock_session_cache()?;
+    cache.remove(account_id);
+
+    match keyring_entry(account_id)
+        .map_err(BackendError::Keychain)?
+        .delete_credential()
+    {
         Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
         Err(error) => Err(BackendError::Keychain(format!(
             "Failed to remove account session from the system keychain: {error}"
@@ -103,15 +173,86 @@ pub(crate) fn current_epoch_millis() -> u64 {
         .unwrap_or(0)
 }
 
-fn keyring_entry(account_id: &str) -> BackendResult<keyring::Entry> {
-    keyring::Entry::new(keyring_service(), &keyring_account_name(account_id)).map_err(|error| {
-        BackendError::Keychain(format!("Failed to access the system keychain: {error}"))
+fn keyring_entry(account_id: &str) -> KeychainResult<keyring::Entry> {
+    keyring::Entry::new(keyring_service(), &keyring_account_name(account_id))
+        .map_err(|error| format!("Failed to access the system keychain: {error}"))
+}
+
+fn encode_keychain_session(session: &DeveloperAccountKeychainSession) -> KeychainResult<String> {
+    toml::to_string(session)
+        .map_err(|error| format!("Failed to encode account keychain payload: {error}"))
+}
+
+fn decode_keychain_session(contents: &str) -> KeychainResult<CachedKeychainSession> {
+    let mut session: DeveloperAccountKeychainSession = toml::from_str(contents)
+        .map_err(|error| format!("Failed to decode account keychain payload: {error}"))?;
+    session.version = KEYCHAIN_SESSION_VERSION;
+    let encoded_contents = encode_keychain_session(&session)?;
+    Ok(CachedKeychainSession {
+        encoded_contents,
+        session,
     })
 }
 
+fn session_cache() -> &'static Mutex<SessionCache> {
+    SESSION_CACHE.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+fn lock_session_cache() -> BackendResult<SessionCacheGuard> {
+    session_cache().lock().map_err(|_| {
+        BackendError::Keychain("Failed to lock account keychain session cache.".to_string())
+    })
+}
+
+fn cache_keychain_session_locked(
+    cache: &mut SessionCache,
+    account_id: &str,
+    session: DeveloperAccountKeychainSession,
+    encoded_contents: String,
+) {
+    cache.insert(
+        account_id.to_string(),
+        CachedKeychainLookup::Session(CachedKeychainSession {
+            encoded_contents,
+            session,
+        }),
+    );
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::cell::Cell;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::{Arc, Barrier};
+    use std::thread;
+    use std::time::Duration;
+
+    fn test_account_id(label: &str) -> String {
+        format!("{label}-{}-{}", std::process::id(), current_epoch_millis())
+    }
+
+    fn test_session() -> DeveloperAccountKeychainSession {
+        DeveloperAccountKeychainSession::new(
+            AuthToken {
+                alt_dsid: "alt-dsid".to_string(),
+                idms_token: "idms-token".to_string(),
+                session_key: vec![1, 2, 3],
+                cookie: vec![4, 5, 6],
+                identity_token: "identity-token".to_string(),
+            },
+            Token {
+                duration: 3600,
+                expiry_epoch_millis: current_epoch_millis() + 3_600_000,
+                token: "heartbeat-token".to_string(),
+            },
+            Token {
+                duration: 3600,
+                expiry_epoch_millis: current_epoch_millis() + 3_600_000,
+                token: "xcode-token".to_string(),
+            },
+        )
+    }
 
     #[test]
     fn zero_expiry_is_treated_as_unknown_not_expired() {
@@ -122,4 +263,93 @@ mod tests {
     fn near_expiry_is_detected() {
         assert!(token_is_near_expiry(current_epoch_millis() + 1));
     }
+
+    #[test]
+    fn concurrent_successful_lookups_read_the_keychain_once() {
+        let account_id = Arc::new(test_account_id("concurrent-session"));
+        let contents = Arc::new(encode_keychain_session(&test_session()).unwrap());
+        let reads = Arc::new(AtomicUsize::new(0));
+        let barrier = Arc::new(Barrier::new(2));
+
+        let handles = (0..2)
+            .map(|_| {
+                let account_id = Arc::clone(&account_id);
+                let contents = Arc::clone(&contents);
+                let reads = Arc::clone(&reads);
+                let barrier = Arc::clone(&barrier);
+                thread::spawn(move || {
+                    barrier.wait();
+                    load_keychain_session_once(&account_id, || {
+                        reads.fetch_add(1, Ordering::SeqCst);
+                        thread::sleep(Duration::from_millis(25));
+                        Ok(Some(contents.as_ref().clone()))
+                    })
+                    .unwrap()
+                    .unwrap()
+                })
+            })
+            .collect::<Vec<_>>();
+
+        for handle in handles {
+            assert_eq!(handle.join().unwrap().auth_token.idms_token, "idms-token");
+        }
+        assert_eq!(reads.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn missing_keychain_session_is_memoized() {
+        let account_id = test_account_id("missing-session");
+        let reads = Cell::new(0);
+
+        for _ in 0..2 {
+            let loaded = load_keychain_session_once(&account_id, || {
+                reads.set(reads.get() + 1);
+                Ok(None)
+            })
+            .unwrap();
+            assert!(loaded.is_none());
+        }
+
+        assert_eq!(reads.get(), 1);
+    }
+
+    #[test]
+    fn malformed_keychain_session_is_memoized() {
+        let account_id = test_account_id("malformed-session");
+        let reads = Cell::new(0);
+
+        for _ in 0..2 {
+            let error = load_keychain_session_once(&account_id, || {
+                reads.set(reads.get() + 1);
+                Ok(Some("not valid TOML".to_string()))
+            })
+            .unwrap_err();
+            assert!(error
+                .user_message()
+                .contains("decode account keychain payload"));
+        }
+
+        assert_eq!(reads.get(), 1);
+    }
+
+    #[test]
+    fn failed_keychain_lookup_is_memoized_and_can_be_replaced() {
+        let account_id = test_account_id("failed-session");
+        let reads = Cell::new(0);
+
+        for _ in 0..2 {
+            let error = load_keychain_session_once(&account_id, || {
+                reads.set(reads.get() + 1);
+                Err("Keychain access was denied.".to_string())
+            })
+            .unwrap_err();
+            assert!(error.user_message().contains("access was denied"));
+        }
+        assert_eq!(reads.get(), 1);
+
+        let session = test_session();
+        cache_keychain_session(&account_id, &session).unwrap();
+        let loaded = load_keychain_session(&account_id).unwrap().unwrap();
+        assert_eq!(loaded.auth_token.idms_token, session.auth_token.idms_token);
+    }
 }

super-sideloader/src/backend/developer/repository.rs

View file @ 65cd6c1

@@ -7,17 +7,17 @@ use crate::backend::developer::cache::{
 use crate::backend::developer::certificates::{
     app_managed_private_key_fingerprints, certificate_fingerprint,
     certificate_public_key_fingerprint, generate_development_certificate_signing_request,
-    import_app_managed_private_key, local_code_signing_identity_fingerprints,
-    save_app_managed_private_key, GeneratedCertificateSigningRequest,
+    import_app_managed_private_key, save_app_managed_certificate, save_app_managed_private_key,
+    GeneratedCertificateSigningRequest,
 };
 use crate::backend::developer::client::{with_developer_session, DeveloperSessionConfig};
 use crate::backend::developer::keychain::{
-    delete_keychain_session, load_keychain_session, save_keychain_session, token_is_near_expiry,
-    DeveloperAccountKeychainSession,
+    cache_keychain_session, delete_keychain_session, load_keychain_session, save_keychain_session,
+    token_is_near_expiry, DeveloperAccountKeychainSession,
 };
 use crate::backend::runtime as backend_runtime;
 use crate::backend::{BackendError, BackendResult};
-use crate::domain::{AdiBackendKind, DeveloperAccount, MachineIdentity};
+use crate::domain::{AdiBackendKind, DeveloperAccount, DeveloperDevice, MachineIdentity};
 use chrono::{DateTime, Local};
 use grandslam::http_session::AnisetteHTTPSession;
 use grandslam::{AuthOutcome, AuthenticatedHTTPSession, Token};
@@ -25,11 +25,11 @@ use plist::{Dictionary, Value};
 use std::path::PathBuf;
 use std::time::{Duration, UNIX_EPOCH};
 use xcode::{
-    AddAppIdAction, AppIdFeature, DeleteAppIdAction, DeveloperTeam,
-    DownloadTeamProvisioningProfileAction, IOSRequest, ListAllDevelopmentCertsAction,
-    ListAppIdsAction, ListTeamsAction, RevokeDevelopmentCertAction, SubmitDevelopmentCsrAction,
-    UpdateAppIdAction, ViewDeveloperAction, XcodeSession, XCODE_BUNDLE_INFORMATION,
-    XCODE_TOKEN_IDENTIFIER,
+    AddAppIdAction, AddDeviceAction, AppIdFeature, DeleteAppIdAction, DeleteDeviceAction,
+    DeveloperTeam, DownloadTeamProvisioningProfileAction, IOSRequest,
+    ListAllDevelopmentCertsAction, ListAppIdsAction, ListDevicesAction, ListTeamsAction,
+    RevokeDevelopmentCertAction, SubmitDevelopmentCsrAction, UpdateAppIdAction,
+    ViewDeveloperAction, XcodeSession, XCODE_BUNDLE_INFORMATION, XCODE_TOKEN_IDENTIFIER,
 };
 
 const HEARTBEAT_TOKEN_IDENTIFIER: &str = "com.apple.gs.idms.hb";
@@ -139,6 +139,39 @@ pub(crate) struct DeveloperProvisioningProfileDownloadRequest {
     pub(crate) android_adi_identifier: String,
 }
 
+#[derive(Clone, Debug)]
+pub(crate) struct DeveloperDeviceListRequest {
+    pub(crate) account_id: String,
+    pub(crate) email: String,
+    pub(crate) team_id: String,
+    pub(crate) adi_backend: AdiBackendKind,
+    pub(crate) machine_identity: MachineIdentity,
+    pub(crate) android_adi_identifier: String,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct DeveloperDeviceAddRequest {
+    pub(crate) account_id: String,
+    pub(crate) email: String,
+    pub(crate) team_id: String,
+    pub(crate) name: String,
+    pub(crate) udid: String,
+    pub(crate) adi_backend: AdiBackendKind,
+    pub(crate) machine_identity: MachineIdentity,
+    pub(crate) android_adi_identifier: String,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct DeveloperDeviceDeleteRequest {
+    pub(crate) account_id: String,
+    pub(crate) email: String,
+    pub(crate) team_id: String,
+    pub(crate) device_id: String,
+    pub(crate) adi_backend: AdiBackendKind,
+    pub(crate) machine_identity: MachineIdentity,
+    pub(crate) android_adi_identifier: String,
+}
+
 #[derive(Clone, Debug)]
 pub(crate) struct DownloadedProvisioningProfile {
     pub(crate) name: String,
@@ -350,6 +383,70 @@ pub(crate) async fn download_developer_provisioning_profile(
     .await?
 }
 
+pub(crate) async fn list_developer_devices(
+    request: DeveloperDeviceListRequest,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let account = refresh_account_seed(&request.account_id, &request.email);
+    let session = validated_keychain_session(&account)?;
+
+    backend_runtime::run("developer device list", move || async move {
+        let account_id = account.id.clone();
+        let result = with_developer_session(
+            session_config(
+                request.adi_backend,
+                request.machine_identity,
+                request.android_adi_identifier,
+            ),
+            session,
+            |xcode_session| {
+                Box::pin(
+                    async move { fetch_developer_devices(xcode_session, &request.team_id).await },
+                )
+            },
+        )
+        .await?;
+
+        save_keychain_session(&account_id, &result.keychain_session)?;
+        Ok(result.value)
+    })
+    .await?
+}
+
+pub(crate) async fn add_developer_device(
+    request: DeveloperDeviceAddRequest,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    mutate_developer_devices(
+        request.account_id,
+        request.email,
+        request.adi_backend,
+        request.machine_identity,
+        request.android_adi_identifier,
+        request.team_id,
+        DeveloperDeviceOperation::Add {
+            name: request.name,
+            udid: request.udid,
+        },
+    )
+    .await
+}
+
+pub(crate) async fn delete_developer_device(
+    request: DeveloperDeviceDeleteRequest,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    mutate_developer_devices(
+        request.account_id,
+        request.email,
+        request.adi_backend,
+        request.machine_identity,
+        request.android_adi_identifier,
+        request.team_id,
+        DeveloperDeviceOperation::Delete {
+            device_id: request.device_id,
+        },
+    )
+    .await
+}
+
 pub(crate) async fn login_developer_account(
     request: DeveloperLoginRequest,
 ) -> BackendResult<DeveloperLoginOutcome> {
@@ -392,6 +489,11 @@ enum DeveloperTeamOperation {
     },
 }
 
+enum DeveloperDeviceOperation {
+    Add { name: String, udid: String },
+    Delete { device_id: String },
+}
+
 async fn mutate_team_resources(
     account_id: &str,
     email: &str,
@@ -570,6 +672,129 @@ async fn perform_team_operation(
     }
 }
 
+async fn mutate_developer_devices(
+    account_id: String,
+    email: String,
+    adi_backend: AdiBackendKind,
+    machine_identity: MachineIdentity,
+    android_adi_identifier: String,
+    team_id: String,
+    operation: DeveloperDeviceOperation,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let account = refresh_account_seed(&account_id, &email);
+    let session = validated_keychain_session(&account)?;
+
+    backend_runtime::run("developer device update", move || async move {
+        let account_id = account.id.clone();
+        let result = with_developer_session(
+            session_config(adi_backend, machine_identity, android_adi_identifier),
+            session,
+            |xcode_session| {
+                Box::pin(async move {
+                    perform_device_operation(xcode_session, &team_id, operation).await?;
+                    fetch_developer_devices(xcode_session, &team_id).await
+                })
+            },
+        )
+        .await?;
+
+        save_keychain_session(&account_id, &result.keychain_session)?;
+        Ok(result.value)
+    })
+    .await?
+}
+
+async fn perform_device_operation(
+    xcode_session: &XcodeSession<'_, '_>,
+    team_id: &str,
+    operation: DeveloperDeviceOperation,
+) -> BackendResult<()> {
+    match operation {
+        DeveloperDeviceOperation::Add { name, udid } => {
+            if name.trim().is_empty() {
+                return Err(BackendError::Message(
+                    "Enter a device name before registering it.".to_string(),
+                ));
+            }
+            if udid.trim().is_empty() {
+                return Err(BackendError::Message(
+                    "Enter a device UDID before registering it.".to_string(),
+                ));
+            }
+            xcode_session
+                .perform_developer_action(IOSRequest::new(AddDeviceAction {
+                    team_id: team_id.into(),
+                    name,
+                    device_number: udid,
+                }))
+                .await
+                .map_err(|error| {
+                    BackendError::Network(format!("Failed to register device: {error}"))
+                })?
+                .map_err(|error| {
+                    BackendError::AppleAuth(format!(
+                        "Failed to parse device registration response: {error}"
+                    ))
+                })?;
+        }
+        DeveloperDeviceOperation::Delete { device_id } => {
+            xcode_session
+                .perform_developer_action(IOSRequest::new(DeleteDeviceAction {
+                    team_id: team_id.into(),
+                    device_id,
+                }))
+                .await
+                .map_err(|error| {
+                    BackendError::Network(format!("Failed to remove device: {error}"))
+                })?
+                .map_err(|error| {
+                    BackendError::AppleAuth(format!(
+                        "Failed to parse device removal response: {error}"
+                    ))
+                })?;
+        }
+    }
+    Ok(())
+}
+
+async fn fetch_developer_devices(
+    xcode_session: &XcodeSession<'_, '_>,
+    team_id: &str,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let mut devices = xcode_session
+        .perform_developer_action(IOSRequest::new(ListDevicesAction {
+            team_id: team_id.into(),
+        }))
+        .await
+        .map_err(|error| {
+            BackendError::Network(format!("Failed to fetch registered devices: {error}"))
+        })?
+        .map_err(|error| {
+            BackendError::AppleAuth(format!(
+                "Failed to parse registered devices response: {error}"
+            ))
+        })?
+        .devices
+        .into_iter()
+        .map(|device| DeveloperDevice {
+            id: device.device_id,
+            name: device.name,
+            udid: device.device_number,
+        })
+        .collect::<Vec<_>>();
+    sort_developer_devices(&mut devices);
+    Ok(devices)
+}
+
+fn sort_developer_devices(devices: &mut [DeveloperDevice]) {
+    devices.sort_by(|left, right| {
+        left.name
+            .to_ascii_lowercase()
+            .cmp(&right.name.to_ascii_lowercase())
+            .then_with(|| left.udid.cmp(&right.udid))
+    });
+}
+
 async fn refresh_cached_team_only(
     account_id: &str,
     email: &str,
@@ -762,6 +987,8 @@ async fn login_developer_account_async(
             }
             return Err(error);
         }
+    } else {
+        cache_keychain_session(&account_cache.id, &keychain_session)?;
     }
 
     Ok(DeveloperLoginOutcome::SignedIn(account_cache.into()))
@@ -847,7 +1074,6 @@ async fn fetch_team_resources(
     team: CachedDeveloperTeam,
     xcode_session: &XcodeSession<'_, '_>,
 ) -> BackendResult<CachedDeveloperTeam> {
-    let local_identity_fingerprints = local_code_signing_identity_fingerprints();
     let app_managed_key_fingerprints = app_managed_private_key_fingerprints();
     let certificates = xcode_session
         .perform_developer_action(IOSRequest::new(ListAllDevelopmentCertsAction {
@@ -868,27 +1094,26 @@ async fn fetch_team_resources(
         })?
         .certificates
         .into_iter()
-        .map(|certificate| {
+        .map(|certificate| -> BackendResult<_> {
             let fingerprint = certificate_fingerprint(&certificate.cert_content);
             let public_key_fingerprint =
                 certificate_public_key_fingerprint(&certificate.cert_content);
-            CachedDevelopmentCertificate {
+            save_app_managed_certificate(&fingerprint, &certificate.cert_content)?;
+            Ok(CachedDevelopmentCertificate {
                 id: certificate.certificate_id,
                 name: certificate.name,
                 serial_number: certificate.serial_number,
                 machine_name: certificate.machine_name,
-                private_key_available: local_identity_fingerprints
-                    .iter()
-                    .any(|identity| identity == &fingerprint)
-                    || public_key_fingerprint.as_ref().is_some_and(|fingerprint| {
+                private_key_available: public_key_fingerprint.as_ref().is_some_and(|fingerprint| {
                     app_managed_key_fingerprints
                         .iter()
                         .any(|candidate| candidate == fingerprint)
                 }),
+                certificate_fingerprint: Some(fingerprint),
                 public_key_fingerprint,
-            }
             })
-        .collect();
+        })
+        .collect::<BackendResult<Vec<_>>>()?;
 
     let app_id_response = xcode_session
         .perform_developer_action(IOSRequest::new(ListAppIdsAction {
@@ -1188,4 +1413,35 @@ mod tests {
         assert_eq!(seed.id, "TEAM");
         assert_eq!(seed.role, "Individual");
     }
+
+    #[test]
+    fn developer_devices_are_sorted_by_name_then_udid() {
+        let mut devices = vec![
+            DeveloperDevice {
+                id: "3".into(),
+                name: "iPhone".into(),
+                udid: "B".into(),
+            },
+            DeveloperDevice {
+                id: "1".into(),
+                name: "iPad".into(),
+                udid: "Z".into(),
+            },
+            DeveloperDevice {
+                id: "2".into(),
+                name: "iphone".into(),
+                udid: "A".into(),
+            },
+        ];
+
+        sort_developer_devices(&mut devices);
+
+        assert_eq!(
+            devices
+                .into_iter()
+                .map(|device| device.id)
+                .collect::<Vec<_>>(),
+            vec!["1", "2", "3"]
+        );
+    }
 }

super-sideloader/src/backend/developer/service.rs

View file @ 65cd6c1

@@ -1,6 +1,7 @@
 use crate::backend::developer::accounts;
+use crate::backend::developer::certificates::{self, AppManagedSigningMaterial};
 use crate::backend::BackendResult;
-use crate::domain::{AdiBackendKind, DeveloperAccount, MachineIdentity};
+use crate::domain::{AdiBackendKind, DeveloperAccount, DeveloperDevice, MachineIdentity};
 use std::path::PathBuf;
 
 #[derive(Clone, Debug)]
@@ -66,6 +67,13 @@ pub(crate) fn delete_account_cache(account_id: &str) -> BackendResult<()> {
     accounts::delete_account_cache(account_id)
 }
 
+pub(crate) fn load_signing_material(
+    certificate_fingerprint: &str,
+    public_key_fingerprint: &str,
+) -> BackendResult<AppManagedSigningMaterial> {
+    certificates::load_app_managed_signing_material(certificate_fingerprint, public_key_fingerprint)
+}
+
 pub(crate) async fn login(request: DeveloperLoginRequest) -> BackendResult<DeveloperLoginOutcome> {
     accounts::login_developer_account(accounts::DeveloperLoginRequest {
         email: request.email,
@@ -154,6 +162,60 @@ pub(crate) async fn delete_app_id(
     .await
 }
 
+pub(crate) async fn list_developer_devices(
+    context: DeveloperSessionContext,
+    team_id: String,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let request = context.refresh_request();
+    accounts::list_developer_devices(accounts::DeveloperDeviceListRequest {
+        account_id: request.account_id,
+        email: request.email,
+        team_id,
+        adi_backend: request.adi_backend,
+        machine_identity: request.machine_identity,
+        android_adi_identifier: request.android_adi_identifier,
+    })
+    .await
+}
+
+pub(crate) async fn add_developer_device(
+    context: DeveloperSessionContext,
+    team_id: String,
+    name: String,
+    udid: String,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let request = context.refresh_request();
+    accounts::add_developer_device(accounts::DeveloperDeviceAddRequest {
+        account_id: request.account_id,
+        email: request.email,
+        team_id,
+        name,
+        udid,
+        adi_backend: request.adi_backend,
+        machine_identity: request.machine_identity,
+        android_adi_identifier: request.android_adi_identifier,
+    })
+    .await
+}
+
+pub(crate) async fn delete_developer_device(
+    context: DeveloperSessionContext,
+    team_id: String,
+    device_id: String,
+) -> BackendResult<Vec<DeveloperDevice>> {
+    let request = context.refresh_request();
+    accounts::delete_developer_device(accounts::DeveloperDeviceDeleteRequest {
+        account_id: request.account_id,
+        email: request.email,
+        team_id,
+        device_id,
+        adi_backend: request.adi_backend,
+        machine_identity: request.machine_identity,
+        android_adi_identifier: request.android_adi_identifier,
+    })
+    .await
+}
+
 pub(crate) async fn create_certificate(
     context: DeveloperSessionContext,
     team_id: String,

super-sideloader/src/backend/device.rs

View file @ 65cd6c1

@@ -1,13 +1,22 @@
+use crate::backend::ipa::SignedAppBundle;
 use crate::backend::{runtime as backend_runtime, BackendError, BackendResult};
-use crate::domain::{Device, DeviceWatchEvent};
+use crate::domain::{Device, DeviceInstallProgress, DeviceWatchEvent};
 use futures::{channel::mpsc::UnboundedSender, StreamExt};
 use idevice::{
+    afc::{opcode::AfcFopenMode, AfcClient},
     provider::UsbmuxdProvider,
+    services::installation_proxy::InstallationProxyClient,
     services::lockdown::LockdownClient,
     usbmuxd::{Connection, UsbmuxdAddr, UsbmuxdDevice},
     IdeviceService,
 };
 use plist::Value;
+use std::path::{Component, Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use walkdir::WalkDir;
+
+const APP_UPLOAD_BUFFER_SIZE: usize = 1024 * 1024;
 
 pub(crate) async fn discover_devices() -> BackendResult<Vec<Device>> {
     backend_runtime::run_send("device discovery", discover_devices_async()).await?
@@ -19,6 +28,327 @@ pub(crate) async fn watch_device_changes(
     backend_runtime::run("device watcher", move || watch_device_changes_async(sender)).await?
 }
 
+pub(crate) async fn install_app(
+    udid: String,
+    signed_app: SignedAppBundle,
+    progress: impl FnMut(DeviceInstallProgress) + Send + 'static,
+) -> BackendResult<()> {
+    backend_runtime::run_send(
+        "app installation",
+        install_app_async(udid, signed_app, progress),
+    )
+    .await?
+}
+
+async fn install_app_async(
+    udid: String,
+    signed_app: SignedAppBundle,
+    progress: impl FnMut(DeviceInstallProgress) + Send + 'static,
+) -> BackendResult<()> {
+    let progress = Arc::new(Mutex::new(progress));
+    report_install_progress(&progress, DeviceInstallProgress::Connecting);
+
+    let provider = provider_for_udid(&udid).await?;
+    let app_path = signed_app.path().to_path_buf();
+    let upload_plan = app_upload_plan(&app_path)?;
+
+    let mut afc = AfcClient::connect(&provider).await.map_err(|error| {
+        BackendError::DeviceInstall(format!("Unable to open AFC on {udid}: {error}"))
+    })?;
+    if afc.get_file_info("PublicStaging").await.is_err() {
+        afc.mk_dir("PublicStaging").await.map_err(|error| {
+            BackendError::DeviceInstall(format!(
+                "Unable to create the device staging directory: {error}"
+            ))
+        })?;
+    }
+
+    let app_folder_name = app_path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .filter(|name| name.ends_with(".app"))
+        .ok_or_else(|| {
+            BackendError::DeviceInstall(format!(
+                "Signed app path {} does not end in an .app folder.",
+                app_path.display()
+            ))
+        })?;
+    let remote_path = format!("PublicStaging/{app_folder_name}");
+    if afc.get_file_info(&remote_path).await.is_ok() {
+        afc.remove_all(&remote_path).await.map_err(|error| {
+            BackendError::DeviceInstall(format!(
+                "Unable to replace the existing staged app folder: {error}"
+            ))
+        })?;
+    }
+    afc.mk_dir(&remote_path).await.map_err(|error| {
+        BackendError::DeviceInstall(format!("Unable to create the staged app folder: {error}"))
+    })?;
+    if let Err(error) = upload_app_bundle(&mut afc, &remote_path, &upload_plan, &progress).await {
+        remove_staged_app(&mut afc, &remote_path).await;
+        return Err(error);
+    }
+
+    let mut options = plist::Dictionary::new();
+    options.insert(
+        "PackageType".to_string(),
+        Value::String("Developer".to_string()),
+    );
+    let mut installer = match InstallationProxyClient::connect(&provider).await {
+        Ok(installer) => installer,
+        Err(error) => {
+            remove_staged_app(&mut afc, &remote_path).await;
+            return Err(BackendError::DeviceInstall(format!(
+                "Unable to open InstallationProxy on {udid}: {error}"
+            )));
+        }
+    };
+    let install_progress = Arc::clone(&progress);
+    let result = installer
+        .install_with_callback(
+            remote_path.clone(),
+            Some(Value::Dictionary(options)),
+            move |(percent, progress)| async move {
+                report_install_progress(&progress, DeviceInstallProgress::Installing { percent });
+            },
+            install_progress,
+        )
+        .await;
+
+    report_install_progress(&progress, DeviceInstallProgress::Finalizing);
+    remove_staged_app(&mut afc, &remote_path).await;
+    drop(signed_app);
+
+    result.map_err(|error| {
+        BackendError::DeviceInstall(format!("Unable to install the app on {udid}: {error}"))
+    })
+}
+
+struct AppUploadPlan {
+    entries: Vec<AppUploadEntry>,
+    total_bytes: u64,
+    total_files: usize,
+}
+
+struct AppUploadEntry {
+    local_path: PathBuf,
+    relative_path: String,
+    is_directory: bool,
+}
+
+fn app_upload_plan(app_path: &Path) -> BackendResult<AppUploadPlan> {
+    let mut entries = Vec::new();
+    let mut total_bytes = 0_u64;
+    let mut total_files = 0_usize;
+
+    for entry in WalkDir::new(app_path).min_depth(1).sort_by_file_name() {
+        let entry = entry.map_err(|error| {
+            BackendError::DeviceInstall(format!("Unable to inspect signed app files: {error}"))
+        })?;
+        let relative = entry.path().strip_prefix(app_path).map_err(|error| {
+            BackendError::DeviceInstall(format!("Unable to stage signed app path: {error}"))
+        })?;
+        let relative_path = device_relative_path(relative)?;
+        let file_type = entry.file_type();
+        if file_type.is_dir() {
+            entries.push(AppUploadEntry {
+                local_path: entry.into_path(),
+                relative_path,
+                is_directory: true,
+            });
+        } else if file_type.is_file() {
+            let metadata = entry.metadata().map_err(|error| {
+                BackendError::DeviceInstall(format!(
+                    "Unable to inspect {}: {error}",
+                    entry.path().display()
+                ))
+            })?;
+            total_bytes = total_bytes.saturating_add(metadata.len());
+            total_files += 1;
+            entries.push(AppUploadEntry {
+                local_path: entry.into_path(),
+                relative_path,
+                is_directory: false,
+            });
+        } else {
+            return Err(BackendError::DeviceInstall(format!(
+                "Signed app contains unsupported file {}.",
+                entry.path().display()
+            )));
+        }
+    }
+
+    Ok(AppUploadPlan {
+        entries,
+        total_bytes,
+        total_files,
+    })
+}
+
+fn device_relative_path(path: &Path) -> BackendResult<String> {
+    let mut parts = Vec::new();
+    for component in path.components() {
+        let Component::Normal(component) = component else {
+            return Err(BackendError::DeviceInstall(format!(
+                "Signed app contains unsafe path {}.",
+                path.display()
+            )));
+        };
+        parts.push(component.to_string_lossy().into_owned());
+    }
+    if parts.is_empty() {
+        return Err(BackendError::DeviceInstall(
+            "Signed app contains an empty relative path.".to_string(),
+        ));
+    }
+    Ok(parts.join("/"))
+}
+
+async fn upload_app_bundle<P>(
+    afc: &mut AfcClient,
+    remote_root: &str,
+    plan: &AppUploadPlan,
+    progress: &Arc<Mutex<P>>,
+) -> BackendResult<()>
+where
+    P: FnMut(DeviceInstallProgress),
+{
+    let mut transferred_bytes = 0_u64;
+    let mut completed_files = 0_usize;
+    report_install_progress(
+        progress,
+        DeviceInstallProgress::Uploading {
+            transferred_bytes,
+            total_bytes: plan.total_bytes,
+            completed_files,
+            total_files: plan.total_files,
+        },
+    );
+
+    for entry in &plan.entries {
+        let remote_path = format!("{remote_root}/{}", entry.relative_path);
+        if entry.is_directory {
+            afc.mk_dir(&remote_path).await.map_err(|error| {
+                BackendError::DeviceInstall(format!(
+                    "Unable to create staged folder {remote_path}: {error}"
+                ))
+            })?;
+            continue;
+        }
+
+        let mut source = tokio::fs::File::open(&entry.local_path)
+            .await
+            .map_err(|error| {
+                BackendError::DeviceInstall(format!(
+                    "Unable to open signed app file {}: {error}",
+                    entry.local_path.display()
+                ))
+            })?;
+        let mut destination =
+            afc.open(&remote_path, AfcFopenMode::WrOnly)
+                .await
+                .map_err(|error| {
+                    BackendError::DeviceInstall(format!(
+                        "Unable to stage app file {remote_path}: {error}"
+                    ))
+                })?;
+        let mut buffer = vec![0; APP_UPLOAD_BUFFER_SIZE];
+        let upload_result = async {
+            loop {
+                let read = source.read(&mut buffer).await.map_err(|error| {
+                    BackendError::DeviceInstall(format!(
+                        "Unable to read signed app file {}: {error}",
+                        entry.local_path.display()
+                    ))
+                })?;
+                if read == 0 {
+                    return Ok(());
+                }
+                destination
+                    .write_all(&buffer[..read])
+                    .await
+                    .map_err(|error| {
+                        BackendError::DeviceInstall(format!(
+                            "Unable to upload app file {remote_path}: {error}"
+                        ))
+                    })?;
+                transferred_bytes = transferred_bytes.saturating_add(read as u64);
+                report_install_progress(
+                    progress,
+                    DeviceInstallProgress::Uploading {
+                        transferred_bytes,
+                        total_bytes: plan.total_bytes,
+                        completed_files,
+                        total_files: plan.total_files,
+                    },
+                );
+            }
+        }
+        .await;
+        let close_result = destination.close().await.map_err(|error| {
+            BackendError::DeviceInstall(format!("Unable to finish app file {remote_path}: {error}"))
+        });
+        upload_result.and(close_result)?;
+        completed_files += 1;
+        report_install_progress(
+            progress,
+            DeviceInstallProgress::Uploading {
+                transferred_bytes,
+                total_bytes: plan.total_bytes,
+                completed_files,
+                total_files: plan.total_files,
+            },
+        );
+    }
+
+    Ok(())
+}
+
+async fn remove_staged_app(afc: &mut AfcClient, remote_path: &str) {
+    if let Err(error) = afc.remove_all(remote_path).await {
+        log::warn!("Unable to remove staged app {remote_path}: {error}");
+    }
+}
+
+async fn provider_for_udid(udid: &str) -> BackendResult<UsbmuxdProvider> {
+    let addr = UsbmuxdAddr::from_env_var().map_err(|error| {
+        BackendError::DeviceInstall(format!("Invalid usbmuxd address: {error}"))
+    })?;
+    let mut usbmuxd = addr.connect(100).await.map_err(|error| {
+        BackendError::DeviceInstall(format!("Unable to connect to usbmuxd: {error}"))
+    })?;
+    let device = usbmuxd
+        .get_devices()
+        .await
+        .map_err(|error| {
+            BackendError::DeviceInstall(format!("Unable to list connected devices: {error}"))
+        })?
+        .into_iter()
+        .find(|device| device.udid == udid)
+        .ok_or_else(|| {
+            BackendError::DeviceInstall(format!(
+                "Device {udid} is no longer connected. Reconnect it and try again."
+            ))
+        })?;
+
+    Ok(UsbmuxdProvider {
+        addr,
+        tag: 101,
+        udid: device.udid,
+        device_id: device.device_id,
+        label: "super-sideloader.install".to_string(),
+    })
+}
+
+fn report_install_progress<P>(progress: &Arc<Mutex<P>>, event: DeviceInstallProgress)
+where
+    P: FnMut(DeviceInstallProgress),
+{
+    if let Ok(mut progress) = progress.lock() {
+        progress(event);
+    }
+}
+
 async fn watch_device_changes_async(
     sender: UnboundedSender<DeviceWatchEvent>,
 ) -> BackendResult<()> {
@@ -139,3 +469,31 @@ fn os_name(device_class: Option<&str>, model: &str) -> &'static str {
         _ => "iOS",
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+
+    #[test]
+    fn app_upload_plan_counts_files_bytes_and_device_paths() {
+        let temp = tempfile::tempdir().unwrap();
+        let app = temp.path().join("Example.app");
+        let plug_in = app.join("PlugIns").join("Widget.appex");
+        fs::create_dir_all(&plug_in).unwrap();
+        fs::write(app.join("Info.plist"), b"plist").unwrap();
+        fs::write(plug_in.join("Widget"), b"executable").unwrap();
+
+        let plan = app_upload_plan(&app).unwrap();
+
+        assert_eq!(plan.total_files, 2);
+        assert_eq!(plan.total_bytes, 15);
+        assert!(plan.entries.iter().any(|entry| {
+            entry.relative_path == "PlugIns/Widget.appex/Widget" && !entry.is_directory
+        }));
+        assert_eq!(
+            device_relative_path(Path::new("Frameworks/Example.framework/Example")).unwrap(),
+            "Frameworks/Example.framework/Example"
+        );
+    }
+}

super-sideloader/src/backend/error.rs

View file @ 65cd6c1

@@ -36,6 +36,8 @@ pub(crate) enum BackendError {
     Adi(String),
     #[error("Device discovery failed: {0}")]
     DeviceDiscovery(String),
+    #[error("Device installation failed: {0}")]
+    DeviceInstall(String),
     #[error("Cache operation failed: {0}")]
     Cache(String),
     #[error("Preferences operation failed: {0}")]
@@ -112,6 +114,7 @@ mod tests {
             BackendError::AppleAuth("invalid password".to_string()).user_message(),
             BackendError::Adi("not provisioned".to_string()).user_message(),
             BackendError::DeviceDiscovery("usbmuxd stopped".to_string()).user_message(),
+            BackendError::DeviceInstall("verification failed".to_string()).user_message(),
             BackendError::Cache("cache corrupt".to_string()).user_message(),
             BackendError::Preferences("settings corrupt".to_string()).user_message(),
             BackendError::Unsupported("not on this platform".to_string()).user_message(),

super-sideloader/src/backend/icon.rs

View file @ 65cd6c1

...	...	@@ -0,0 +1,389 @@
	1	+use crate::backend::{BackendError, BackendResult};
	2	+use crc32fast::Hasher;
	3	+use flate2::read::DeflateDecoder;
	4	+use flate2::write::ZlibEncoder;
	5	+use flate2::Compression;
	6	+use image::imageops::FilterType;
	7	+use image::{DynamicImage, ImageFormat, Rgba};
	8	+use std::fs;
	9	+use std::io::{Cursor, Read, Write};
	10	+use std::path::Path;
	11	+
	12	+const PNG_SIGNATURE: &[u8; 8] = b"\x89PNG\r\n\x1a\n";
	13	+const GENERATED_ICON_PREFIX: &str = "SuperSideloaderIcon";
	14	+
	15	+pub(crate) const IPHONE_ICON_NAMES: &[&str] = &[
	16	+ "SuperSideloaderIcon20",
	17	+ "SuperSideloaderIcon29",
	18	+ "SuperSideloaderIcon40",
	19	+ "SuperSideloaderIcon60",
	20	+];
	21	+pub(crate) const IPAD_ICON_NAMES: &[&str] = &[
	22	+ "SuperSideloaderIcon20",
	23	+ "SuperSideloaderIcon29",
	24	+ "SuperSideloaderIcon40",
	25	+ "SuperSideloaderIcon76",
	26	+ "SuperSideloaderIcon83_5",
	27	+];
	28	+pub(crate) const IPHONE_PRIMARY_ICON_NAME: &str = "SuperSideloaderIcon60";
	29	+pub(crate) const IPAD_PRIMARY_ICON_NAME: &str = "SuperSideloaderIcon76";
	30	+
	31	+struct IconVariant {
	32	+ file_name: &'static str,
	33	+ pixels: u32,
	34	+}
	35	+
	36	+const ICON_VARIANTS: &[IconVariant] = &[
	37	+ IconVariant {
	38	+ file_name: "SuperSideloaderIcon20.png",
	39	+ pixels: 20,
	40	+ },
	41	+ IconVariant {
	42	+ file_name: "SuperSideloaderIcon20@2x.png",
	43	+ pixels: 40,
	44	+ },
	45	+ IconVariant {
	46	+ file_name: "SuperSideloaderIcon20@3x.png",
	47	+ pixels: 60,
	48	+ },
	49	+ IconVariant {
	50	+ file_name: "SuperSideloaderIcon29.png",
	51	+ pixels: 29,
	52	+ },
	53	+ IconVariant {
	54	+ file_name: "SuperSideloaderIcon29@2x.png",
	55	+ pixels: 58,
	56	+ },
	57	+ IconVariant {
	58	+ file_name: "SuperSideloaderIcon29@3x.png",
	59	+ pixels: 87,
	60	+ },
	61	+ IconVariant {
	62	+ file_name: "SuperSideloaderIcon40.png",
	63	+ pixels: 40,
	64	+ },
	65	+ IconVariant {
	66	+ file_name: "SuperSideloaderIcon40@2x.png",
	67	+ pixels: 80,
	68	+ },
	69	+ IconVariant {
	70	+ file_name: "SuperSideloaderIcon40@3x.png",
	71	+ pixels: 120,
	72	+ },
	73	+ IconVariant {
	74	+ file_name: "SuperSideloaderIcon60.png",
	75	+ pixels: 60,
	76	+ },
	77	+ IconVariant {
	78	+ file_name: "SuperSideloaderIcon60@2x.png",
	79	+ pixels: 120,
	80	+ },
	81	+ IconVariant {
	82	+ file_name: "SuperSideloaderIcon60@3x.png",
	83	+ pixels: 180,
	84	+ },
	85	+ IconVariant {
	86	+ file_name: "SuperSideloaderIcon76.png",
	87	+ pixels: 76,
	88	+ },
	89	+ IconVariant {
	90	+ file_name: "SuperSideloaderIcon76@2x.png",
	91	+ pixels: 152,
	92	+ },
	93	+ IconVariant {
	94	+ file_name: "SuperSideloaderIcon83_5@2x.png",
	95	+ pixels: 167,
	96	+ },
	97	+];
	98	+
	99	+pub(crate) fn normalize_png_for_display(bytes: &[u8]) -> Result<Vec<u8>, String> {
	100	+ let image = decode_png(bytes)?;
	101	+ encode_png(&image)
	102	+}
	103	+
	104	+pub(crate) fn write_icon_variants(app_path: &Path, source_path: &Path) -> BackendResult<()> {
	105	+ let source_bytes = fs::read(source_path).map_err(\|source\| BackendError::Io {
	106	+ action: "Read app icon override",
	107	+ path: source_path.to_path_buf(),
	108	+ source,
	109	+ })?;
	110	+ let source = decode_png(&source_bytes).map_err(\|error\| {
	111	+ BackendError::Message(format!(
	112	+ "Failed to decode app icon override {}: {error}",
	113	+ source_path.display()
	114	+ ))
	115	+ })?;
	116	+ if source.width() != source.height() {
	117	+ return Err(BackendError::Message(format!(
	118	+ "The app icon override must be square, but it is {}x{} pixels.",
	119	+ source.width(),
	120	+ source.height()
	121	+ )));
	122	+ }
	123	+
	124	+ remove_previous_variants(app_path)?;
	125	+ for variant in ICON_VARIANTS {
	126	+ let destination = app_path.join(variant.file_name);
	127	+ source
	128	+ .resize_exact(variant.pixels, variant.pixels, FilterType::Lanczos3)
	129	+ .save_with_format(&destination, ImageFormat::Png)
	130	+ .map_err(\|error\| {
	131	+ BackendError::Message(format!(
	132	+ "Failed to write app icon variant {}: {error}",
	133	+ destination.display()
	134	+ ))
	135	+ })?;
	136	+ }
	137	+ Ok(())
	138	+}
	139	+
	140	+fn decode_png(bytes: &[u8]) -> Result<DynamicImage, String> {
	141	+ let chunks = parse_png_chunks(bytes)?;
	142	+ if chunks.iter().any(\|chunk\| chunk.kind == *b"CgBI") {
	143	+ decode_cgbi_png(&chunks)
	144	+ } else {
	145	+ image::load_from_memory_with_format(bytes, ImageFormat::Png)
	146	+ .map_err(\|error\| format!("invalid PNG: {error}"))
	147	+ }
	148	+}
	149	+
	150	+fn decode_cgbi_png(chunks: &[PngChunk<'_>]) -> Result<DynamicImage, String> {
	151	+ let ihdr = chunks
	152	+ .iter()
	153	+ .find(\|chunk\| chunk.kind == *b"IHDR")
	154	+ .ok_or_else(\|\| "CgBI PNG has no IHDR chunk".to_string())?;
	155	+ if ihdr.data.len() != 13 \|\| ihdr.data[8] != 8 \|\| ihdr.data[9] != 6 {
	156	+ return Err("CgBI PNG must use 8-bit RGBA pixels".to_string());
	157	+ }
	158	+
	159	+ let compressed = chunks
	160	+ .iter()
	161	+ .filter(\|chunk\| chunk.kind == *b"IDAT")
	162	+ .flat_map(\|chunk\| chunk.data.iter().copied())
	163	+ .collect::<Vec<_>>();
	164	+ if compressed.is_empty() {
	165	+ return Err("CgBI PNG has no IDAT data".to_string());
	166	+ }
	167	+
	168	+ let mut filtered_pixels = Vec::new();
	169	+ DeflateDecoder::new(compressed.as_slice())
	170	+ .read_to_end(&mut filtered_pixels)
	171	+ .map_err(\|error\| format!("failed to inflate CgBI pixel data: {error}"))?;
	172	+ let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
	173	+ encoder
	174	+ .write_all(&filtered_pixels)
	175	+ .map_err(\|error\| format!("failed to recompress CgBI pixel data: {error}"))?;
	176	+ let standard_idat = encoder
	177	+ .finish()
	178	+ .map_err(\|error\| format!("failed to finish CgBI pixel data: {error}"))?;
	179	+
	180	+ let mut standard_png = PNG_SIGNATURE.to_vec();
	181	+ let mut wrote_idat = false;
	182	+ for chunk in chunks {
	183	+ match &chunk.kind {
	184	+ b"CgBI" => {}
	185	+ b"IDAT" if !wrote_idat => {
	186	+ write_png_chunk(&mut standard_png, *b"IDAT", &standard_idat)?;
	187	+ wrote_idat = true;
	188	+ }
	189	+ b"IDAT" => {}
	190	+ _ => write_png_chunk(&mut standard_png, chunk.kind, chunk.data)?,
	191	+ }
	192	+ }
	193	+
	194	+ let mut image = image::load_from_memory_with_format(&standard_png, ImageFormat::Png)
	195	+ .map_err(\|error\| format!("failed to decode normalized CgBI PNG: {error}"))?
	196	+ .to_rgba8();
	197	+ for pixel in image.pixels_mut() {
	198	+ let [blue, green, red, alpha] = pixel.0;
	199	+ *pixel = Rgba([
	200	+ unpremultiply(red, alpha),
	201	+ unpremultiply(green, alpha),
	202	+ unpremultiply(blue, alpha),
	203	+ alpha,
	204	+ ]);
	205	+ }
	206	+ Ok(DynamicImage::ImageRgba8(image))
	207	+}
	208	+
	209	+fn encode_png(image: &DynamicImage) -> Result<Vec<u8>, String> {
	210	+ let mut output = Cursor::new(Vec::new());
	211	+ image
	212	+ .write_to(&mut output, ImageFormat::Png)
	213	+ .map_err(\|error\| format!("failed to encode PNG: {error}"))?;
	214	+ Ok(output.into_inner())
	215	+}
	216	+
	217	+fn unpremultiply(value: u8, alpha: u8) -> u8 {
	218	+ if alpha == 0 {
	219	+ return 0;
	220	+ }
	221	+ ((u32::from(value) * 255 + u32::from(alpha) / 2) / u32::from(alpha)).min(255) as u8
	222	+}
	223	+
	224	+struct PngChunk<'a> {
	225	+ kind: [u8; 4],
	226	+ data: &'a [u8],
	227	+}
	228	+
	229	+fn parse_png_chunks(bytes: &[u8]) -> Result<Vec<PngChunk<'_>>, String> {
	230	+ if !bytes.starts_with(PNG_SIGNATURE) {
	231	+ return Err("file is not a PNG".to_string());
	232	+ }
	233	+
	234	+ let mut chunks = Vec::new();
	235	+ let mut offset = PNG_SIGNATURE.len();
	236	+ while offset < bytes.len() {
	237	+ let header_end = offset
	238	+ .checked_add(8)
	239	+ .filter(\|end\| *end <= bytes.len())
	240	+ .ok_or_else(\|\| "PNG has a truncated chunk header".to_string())?;
	241	+ let length = u32::from_be_bytes(bytes[offset..offset + 4].try_into().unwrap()) as usize;
	242	+ let kind = bytes[offset + 4..header_end].try_into().unwrap();
	243	+ let data_start = header_end;
	244	+ let data_end = data_start
	245	+ .checked_add(length)
	246	+ .filter(\|end\| {
	247	+ end.checked_add(4)
	248	+ .is_some_and(\|crc_end\| crc_end <= bytes.len())
	249	+ })
	250	+ .ok_or_else(\|\| "PNG has a truncated chunk".to_string())?;
	251	+ chunks.push(PngChunk {
	252	+ kind,
	253	+ data: &bytes[data_start..data_end],
	254	+ });
	255	+ offset = data_end + 4;
	256	+ if kind == *b"IEND" {
	257	+ break;
	258	+ }
	259	+ }
	260	+
	261	+ if !chunks.iter().any(\|chunk\| chunk.kind == *b"IHDR") {
	262	+ return Err("PNG has no IHDR chunk".to_string());
	263	+ }
	264	+ if !chunks.iter().any(\|chunk\| chunk.kind == *b"IEND") {
	265	+ return Err("PNG has no IEND chunk".to_string());
	266	+ }
	267	+ Ok(chunks)
	268	+}
	269	+
	270	+fn write_png_chunk(output: &mut Vec<u8>, kind: [u8; 4], data: &[u8]) -> Result<(), String> {
	271	+ let length = u32::try_from(data.len()).map_err(\|_\| "PNG chunk is too large".to_string())?;
	272	+ output.extend_from_slice(&length.to_be_bytes());
	273	+ output.extend_from_slice(&kind);
	274	+ output.extend_from_slice(data);
	275	+ let mut crc = Hasher::new();
	276	+ crc.update(&kind);
	277	+ crc.update(data);
	278	+ output.extend_from_slice(&crc.finalize().to_be_bytes());
	279	+ Ok(())
	280	+}
	281	+
	282	+fn remove_previous_variants(app_path: &Path) -> BackendResult<()> {
	283	+ let entries = fs::read_dir(app_path).map_err(\|source\| BackendError::Io {
	284	+ action: "Read app bundle while replacing icons",
	285	+ path: app_path.to_path_buf(),
	286	+ source,
	287	+ })?;
	288	+ for entry in entries {
	289	+ let entry = entry.map_err(\|source\| BackendError::Io {
	290	+ action: "Read app bundle entry while replacing icons",
	291	+ path: app_path.to_path_buf(),
	292	+ source,
	293	+ })?;
	294	+ let path = entry.path();
	295	+ let generated_png = path
	296	+ .file_name()
	297	+ .and_then(\|name\| name.to_str())
	298	+ .is_some_and(\|name\| {
	299	+ name.starts_with(GENERATED_ICON_PREFIX)
	300	+ && name.to_ascii_lowercase().ends_with(".png")
	301	+ });
	302	+ if generated_png {
	303	+ fs::remove_file(&path).map_err(\|source\| BackendError::Io {
	304	+ action: "Remove previous app icon variant",
	305	+ path,
	306	+ source,
	307	+ })?;
	308	+ }
	309	+ }
	310	+ Ok(())
	311	+}
	312	+
	313	+#[cfg(test)]
	314	+mod tests {
	315	+ use super::*;
	316	+ use flate2::write::DeflateEncoder;
	317	+ use image::{GenericImageView, RgbaImage};
	318	+
	319	+ #[test]
	320	+ fn cgbi_png_is_normalized_to_standard_rgba_png() {
	321	+ let cgbi = cgbi_test_png();
	322	+
	323	+ let normalized = normalize_png_for_display(&cgbi).unwrap();
	324	+ assert!(!parse_png_chunks(&normalized)
	325	+ .unwrap()
	326	+ .iter()
	327	+ .any(\|chunk\| chunk.kind == *b"CgBI"));
	328	+
	329	+ let image = image::load_from_memory_with_format(&normalized, ImageFormat::Png).unwrap();
	330	+ assert_eq!(image.dimensions(), (2, 1));
	331	+ assert_eq!(image.to_rgba8().get_pixel(0, 0).0, [128, 64, 32, 128]);
	332	+ assert_eq!(image.to_rgba8().get_pixel(1, 0).0, [20, 40, 80, 255]);
	333	+ }
	334	+
	335	+ #[test]
	336	+ fn icon_variants_have_the_expected_pixel_sizes() {
	337	+ let temp = tempfile::tempdir().unwrap();
	338	+ let app_path = temp.path().join("Example.app");
	339	+ fs::create_dir(&app_path).unwrap();
	340	+ let source_path = temp.path().join("source.png");
	341	+ RgbaImage::from_pixel(180, 180, Rgba([20, 40, 80, 255]))
	342	+ .save(&source_path)
	343	+ .unwrap();
	344	+
	345	+ write_icon_variants(&app_path, &source_path).unwrap();
	346	+
	347	+ for variant in ICON_VARIANTS {
	348	+ let image = image::open(app_path.join(variant.file_name)).unwrap();
	349	+ assert_eq!(
	350	+ image.dimensions(),
	351	+ (variant.pixels, variant.pixels),
	352	+ "{}",
	353	+ variant.file_name
	354	+ );
	355	+ }
	356	+ }
	357	+
	358	+ #[test]
	359	+ fn icon_override_must_be_square() {
	360	+ let temp = tempfile::tempdir().unwrap();
	361	+ let app_path = temp.path().join("Example.app");
	362	+ fs::create_dir(&app_path).unwrap();
	363	+ let source_path = temp.path().join("source.png");
	364	+ RgbaImage::new(180, 120).save(&source_path).unwrap();
	365	+
	366	+ let error = write_icon_variants(&app_path, &source_path).unwrap_err();
	367	+ assert!(error.user_message().contains("must be square"));
	368	+ }
	369	+
	370	+ fn cgbi_test_png() -> Vec<u8> {
	371	+ let mut raw_pixels = vec![0];
	372	+ raw_pixels.extend_from_slice(&[16, 32, 64, 128]);
	373	+ raw_pixels.extend_from_slice(&[80, 40, 20, 255]);
	374	+ let mut deflater = DeflateEncoder::new(Vec::new(), Compression::default());
	375	+ deflater.write_all(&raw_pixels).unwrap();
	376	+ let idat = deflater.finish().unwrap();
	377	+
	378	+ let mut png = PNG_SIGNATURE.to_vec();
	379	+ write_png_chunk(&mut png, *b"CgBI", &[0x40, 0, 0, 0]).unwrap();
	380	+ let mut ihdr = Vec::new();
	381	+ ihdr.extend_from_slice(&2u32.to_be_bytes());
	382	+ ihdr.extend_from_slice(&1u32.to_be_bytes());
	383	+ ihdr.extend_from_slice(&[8, 6, 0, 0, 0]);
	384	+ write_png_chunk(&mut png, *b"IHDR", &ihdr).unwrap();
	385	+ write_png_chunk(&mut png, *b"IDAT", &idat).unwrap();
	386	+ write_png_chunk(&mut png, *b"IEND", &[]).unwrap();
	387	+ png
	388	+ }
	389	+}

super-sideloader/src/backend/ipa.rs

View file @ 65cd6c1

@@ -1,20 +1,95 @@
+use crate::backend::icon::{
+    normalize_png_for_display, write_icon_variants, IPAD_ICON_NAMES, IPAD_PRIMARY_ICON_NAME,
+    IPHONE_ICON_NAMES, IPHONE_PRIMARY_ICON_NAME,
+};
 use crate::backend::paths::app_data_dir;
 use crate::backend::{runtime as backend_runtime, BackendError, BackendResult};
 use crate::domain::{
-    AppEntitlement, AppMetadata, EntitlementValue, EntitlementsSource, IpaApp, Patch,
+    AppEntitlement, AppMetadata, EntitlementValue, EntitlementsSource, IpaApp, NestedBundle, Patch,
     SupportedDeviceFamily,
 };
+use apple_codesign::{
+    sign_bundle, BundleSigningSettings, ProvisioningProfile, RustCryptoCmsSigner,
+};
+use async_zip::base::read::mem::ZipFileReader as MemoryZipFileReader;
+use async_zip::base::write::ZipFileWriter;
 use async_zip::tokio::read::fs::ZipFileReader;
+use async_zip::{Compression, ZipEntry, ZipEntryBuilder};
+use flate2::write::DeflateEncoder;
+use flate2::Compression as FlateCompression;
 use futures_lite::io::AsyncReadExt;
 use plist::{Dictionary, Value};
+use std::collections::BTreeMap;
 use std::fs;
-use std::io::Cursor;
-use std::path::PathBuf;
+use std::io::{Cursor, Write as _};
+use std::path::{Component, Path, PathBuf};
+use tempfile::{Builder as TempBuilder, TempDir};
+use tokio::io::AsyncWriteExt;
+use tokio::task::JoinSet;
+use walkdir::WalkDir;
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+const MAX_EXTRACTION_WORKERS: usize = 4;
+const MAX_PACKAGING_WORKERS: usize = 4;
+const FAST_DEFLATE_LEVEL: u32 = 4;
+const IN_MEMORY_EXTRACTION_LIMIT: u64 = 256 * 1024 * 1024;
+
+pub(crate) struct IpaSigningRequest {
+    pub(crate) source_path: PathBuf,
+    pub(crate) destination: SigningDestination,
+    pub(crate) metadata: AppMetadata,
+    pub(crate) bundle_id_replacements: BTreeMap<String, String>,
+    pub(crate) icon_override_path: Option<PathBuf>,
+    pub(crate) team_id: String,
+    pub(crate) provisioning_profiles: BTreeMap<String, Vec<u8>>,
+    pub(crate) private_key_pem: Vec<u8>,
+    pub(crate) certificate_der: Vec<u8>,
+}
+
+pub(crate) enum SigningDestination {
+    Ipa(PathBuf),
+    AppBundle,
+}
+
+pub(crate) enum SigningArtifact {
+    Ipa(PathBuf),
+    AppBundle(SignedAppBundle),
+}
+
+pub(crate) struct SignedAppBundle {
+    app_path: PathBuf,
+    _work_dir: TempDir,
+}
+
+impl SignedAppBundle {
+    pub(crate) fn path(&self) -> &Path {
+        &self.app_path
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum IpaSigningProgress {
+    Extracting { completed: usize, total: usize },
+    Patching,
+    Signing,
+    Packaging { completed: usize, total: usize },
+    Saving,
+    Ready,
+}
 
 pub(crate) async fn read_ipa(path: PathBuf, patches: Vec<Patch>) -> BackendResult<IpaApp> {
     backend_runtime::run_send("IPA reader", read_ipa_async(path, patches)).await?
 }
 
+pub(crate) async fn sign_ipa(
+    request: IpaSigningRequest,
+    progress: impl FnMut(IpaSigningProgress) + Send + 'static,
+) -> BackendResult<SigningArtifact> {
+    backend_runtime::run_send("IPA signer", sign_ipa_async(request, progress)).await?
+}
+
 async fn read_ipa_async(path: PathBuf, patches: Vec<Patch>) -> BackendResult<IpaApp> {
     let reader = ZipFileReader::new(&path)
         .await
@@ -48,6 +123,7 @@ async fn read_ipa_async(path: PathBuf, patches: Vec<Patch>) -> BackendResult<Ipa
         .or_else(|| plist_string(&info, "CFBundleName"))
         .unwrap_or(executable);
     let supported_devices = supported_devices(&info);
+    let nested_bundles = read_nested_signable_bundles(&reader, &app_prefix).await?;
 
     let icon_path = extract_icon(&reader, &app_prefix, &info, bundle_id).await;
     let (entitlements_source, entitlements) = match extract_entitlements(&reader, &app_prefix).await
@@ -66,6 +142,7 @@ async fn read_ipa_async(path: PathBuf, patches: Vec<Patch>) -> BackendResult<Ipa
             minimum_os: minimum_os.to_string(),
             supported_devices,
         },
+        nested_bundles,
         path: path.to_string_lossy().to_string(),
         icon_path: icon_path.map(|path| path.to_string_lossy().to_string()),
         entitlements,
@@ -74,10 +151,60 @@ async fn read_ipa_async(path: PathBuf, patches: Vec<Patch>) -> BackendResult<Ipa
     })
 }
 
+async fn read_nested_signable_bundles(
+    reader: &ZipFileReader,
+    app_prefix: &str,
+) -> BackendResult<Vec<NestedBundle>> {
+    let candidates = reader
+        .file()
+        .entries()
+        .iter()
+        .enumerate()
+        .filter_map(|(index, entry)| {
+            let path = entry_name(entry)?;
+            is_nested_signable_info_plist(path, app_prefix).then(|| (index, path.to_string()))
+        })
+        .collect::<Vec<_>>();
+    let mut bundles = Vec::with_capacity(candidates.len());
+
+    for (index, path) in candidates {
+        let bytes = read_entry(reader, index, &path).await?;
+        let info = plist::from_bytes::<Dictionary>(&bytes)
+            .map_err(|error| BackendError::Plist(format!("{path}: {error}")))?;
+        if plist_string(&info, "CFBundleExecutable").is_none() {
+            continue;
+        }
+        let bundle_id = required_plist_string(&info, "CFBundleIdentifier")?.to_string();
+        let name = plist_string(&info, "CFBundleDisplayName")
+            .or_else(|| plist_string(&info, "CFBundleName"))
+            .unwrap_or(&bundle_id)
+            .to_string();
+        bundles.push(NestedBundle { name, bundle_id });
+    }
+
+    bundles.sort_by(|left, right| left.bundle_id.cmp(&right.bundle_id));
+    bundles.dedup_by(|left, right| left.bundle_id == right.bundle_id);
+    Ok(bundles)
+}
+
+fn is_nested_signable_info_plist(path: &str, app_prefix: &str) -> bool {
+    let Some(relative) = path
+        .strip_prefix(app_prefix)
+        .and_then(|path| path.strip_suffix("/Info.plist"))
+    else {
+        return false;
+    };
+    !relative.is_empty()
+        && relative
+            .rsplit('/')
+            .next()
+            .is_some_and(|folder| folder.ends_with(".appex") || folder.ends_with(".app"))
+}
+
 fn is_app_info_plist(path: &str) -> bool {
-    path.starts_with("Payload/")
-        && path.ends_with(".app/Info.plist")
-        && path["Payload/".len()..].contains(".app/")
+    path.strip_prefix("Payload/")
+        .and_then(|path| path.strip_suffix("/Info.plist"))
+        .is_some_and(|bundle| bundle.ends_with(".app") && !bundle.contains('/'))
 }
 
 fn entry_name(entry: &async_zip::ZipEntry) -> Option<&str> {
@@ -226,10 +353,17 @@ fn find_icon_entry<'a>(
 }
 
 fn cache_icon(bundle_id: &str, bytes: &[u8]) -> Option<PathBuf> {
+    let normalized = match normalize_png_for_display(bytes) {
+        Ok(normalized) => normalized,
+        Err(error) => {
+            log::warn!("Failed to normalize app icon for {bundle_id}: {error}");
+            return None;
+        }
+    };
     let mut path = app_data_dir()?.join("icons");
     fs::create_dir_all(&path).ok()?;
     path.push(format!("{}.png", cache_safe_name(bundle_id)));
-    fs::write(&path, bytes).ok()?;
+    fs::write(&path, normalized).ok()?;
     Some(path)
 }
 
@@ -308,18 +442,1056 @@ fn entitlement_value(value: &Value) -> EntitlementValue {
     }
 }
 
+async fn sign_ipa_async(
+    request: IpaSigningRequest,
+    mut progress: impl FnMut(IpaSigningProgress) + Send,
+) -> BackendResult<SigningArtifact> {
+    let work_parent = app_data_dir()
+        .ok_or_else(|| {
+            BackendError::Unsupported(
+                "The application data folder is not available for IPA signing.".to_string(),
+            )
+        })?
+        .join("signing");
+    fs::create_dir_all(&work_parent).map_err(|source| BackendError::Io {
+        action: "Create IPA signing work folder",
+        path: work_parent.clone(),
+        source,
+    })?;
+    let work_dir = TempBuilder::new()
+        .prefix("sign-")
+        .tempdir_in(&work_parent)
+        .map_err(|source| BackendError::Io {
+            action: "Create temporary IPA signing folder",
+            path: work_parent,
+            source,
+        })?;
+
+    extract_ipa(&request.source_path, work_dir.path(), &mut progress).await?;
+    let app_path = root_app_bundle(work_dir.path())?;
+    progress(IpaSigningProgress::Patching);
+    patch_app_bundle(
+        &app_path,
+        &request.metadata,
+        request.icon_override_path.as_deref(),
+    )?;
+    patch_nested_bundle_identifiers(&app_path, &request.bundle_id_replacements)?;
+    progress(IpaSigningProgress::Signing);
+    sign_staged_app(&app_path, &request)?;
+
+    if matches!(&request.destination, SigningDestination::AppBundle) {
+        progress(IpaSigningProgress::Ready);
+        return Ok(SigningArtifact::AppBundle(SignedAppBundle {
+            app_path,
+            _work_dir: work_dir,
+        }));
+    }
+
+    let SigningDestination::Ipa(output_path) = request.destination else {
+        unreachable!("app bundle destination returned above");
+    };
+
+    let output_parent = output_path
+        .parent()
+        .filter(|path| !path.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    fs::create_dir_all(output_parent).map_err(|source| BackendError::Io {
+        action: "Create signed IPA output folder",
+        path: output_parent.to_path_buf(),
+        source,
+    })?;
+    let output_temp = TempBuilder::new()
+        .prefix(".super-sideloader-")
+        .suffix(".ipa.tmp")
+        .tempfile_in(output_parent)
+        .map_err(|source| BackendError::Io {
+            action: "Create temporary signed IPA",
+            path: output_parent.to_path_buf(),
+            source,
+        })?
+        .into_temp_path();
+
+    package_ipa(work_dir.path(), output_temp.as_ref(), &mut progress).await?;
+    progress(IpaSigningProgress::Saving);
+    output_temp
+        .persist(&output_path)
+        .map_err(|error| BackendError::Io {
+            action: "Save signed IPA",
+            path: output_path.clone(),
+            source: error.error,
+        })?;
+    Ok(SigningArtifact::Ipa(output_path))
+}
+
+async fn extract_ipa(
+    source_path: &Path,
+    destination: &Path,
+    progress: &mut impl FnMut(IpaSigningProgress),
+) -> BackendResult<()> {
+    let reader = ExtractionReader::open(source_path).await?;
+    let total = reader.file().entries().len();
+    progress(IpaSigningProgress::Extracting {
+        completed: 0,
+        total,
+    });
+
+    let mut files = Vec::new();
+    let mut completed = 0;
+    for index in 0..total {
+        let entry = &reader.file().entries()[index];
+        let name = entry_name(entry)
+            .ok_or_else(|| BackendError::Zip("IPA contains an invalid entry name.".to_string()))?
+            .to_string();
+        let relative_path = safe_zip_entry_path(&name)?;
+        let output_path = destination.join(&relative_path);
+        let unix_permissions = entry.unix_permissions();
+        if unix_permissions.is_some_and(is_symlink_mode) {
+            return Err(BackendError::Zip(format!(
+                "IPA contains unsupported symbolic link entry {name}."
+            )));
+        }
+
+        if name.ends_with('/') {
+            fs::create_dir_all(&output_path).map_err(|source| BackendError::Io {
+                action: "Create extracted IPA folder",
+                path: output_path,
+                source,
+            })?;
+            completed += 1;
+            report_extracting_progress(progress, completed, total);
+            continue;
+        }
+
+        if let Some(parent) = output_path.parent() {
+            fs::create_dir_all(parent).map_err(|source| BackendError::Io {
+                action: "Create extracted IPA folder",
+                path: parent.to_path_buf(),
+                source,
+            })?;
+        }
+        files.push(ExtractionPlan {
+            index,
+            name,
+            output_path,
+            unix_permissions,
+        });
+    }
+
+    let mut files = files.into_iter();
+    let mut workers = JoinSet::new();
+    let concurrency = archive_worker_count(MAX_EXTRACTION_WORKERS);
+    for _ in 0..concurrency {
+        let Some(plan) = files.next() else {
+            break;
+        };
+        spawn_extraction_worker(&mut workers, reader.clone(), plan);
+    }
+
+    while let Some(result) = workers.join_next().await {
+        result.map_err(|error| {
+            BackendError::Zip(format!("IPA extraction worker failed: {error}"))
+        })??;
+        completed += 1;
+        report_extracting_progress(progress, completed, total);
+
+        if let Some(plan) = files.next() {
+            spawn_extraction_worker(&mut workers, reader.clone(), plan);
+        }
+    }
+
+    Ok(())
+}
+
+struct ExtractionPlan {
+    index: usize,
+    name: String,
+    output_path: PathBuf,
+    unix_permissions: Option<u16>,
+}
+
+fn spawn_extraction_worker(
+    workers: &mut JoinSet<BackendResult<()>>,
+    reader: ExtractionReader,
+    plan: ExtractionPlan,
+) {
+    workers.spawn(async move {
+        let data = reader.read_entry(plan.index, &plan.name).await?;
+        tokio::fs::write(&plan.output_path, data)
+            .await
+            .map_err(|source| BackendError::Io {
+                action: "Extract IPA file",
+                path: plan.output_path.clone(),
+                source,
+            })?;
+        set_extracted_permissions(&plan.output_path, plan.unix_permissions)
+    });
+}
+
+#[derive(Clone)]
+enum ExtractionReader {
+    FileSystem(ZipFileReader),
+    Memory(MemoryZipFileReader),
+}
+
+impl ExtractionReader {
+    async fn open(path: &Path) -> BackendResult<Self> {
+        let metadata = tokio::fs::metadata(path)
+            .await
+            .map_err(|source| BackendError::Io {
+                action: "Inspect IPA before extraction",
+                path: path.to_path_buf(),
+                source,
+            })?;
+        if metadata.len() <= IN_MEMORY_EXTRACTION_LIMIT {
+            let data = tokio::fs::read(path)
+                .await
+                .map_err(|source| BackendError::Io {
+                    action: "Read IPA for extraction",
+                    path: path.to_path_buf(),
+                    source,
+                })?;
+            let reader = MemoryZipFileReader::new(data)
+                .await
+                .map_err(|error| BackendError::Zip(format!("{}: {error}", path.display())))?;
+            Ok(Self::Memory(reader))
+        } else {
+            let reader = ZipFileReader::new(path)
+                .await
+                .map_err(|error| BackendError::Zip(format!("{}: {error}", path.display())))?;
+            Ok(Self::FileSystem(reader))
+        }
+    }
+
+    fn file(&self) -> &async_zip::ZipFile {
+        match self {
+            Self::FileSystem(reader) => reader.file(),
+            Self::Memory(reader) => reader.file(),
+        }
+    }
+
+    async fn read_entry(&self, index: usize, label: &str) -> BackendResult<Vec<u8>> {
+        match self {
+            Self::FileSystem(reader) => read_entry(reader, index, label).await,
+            Self::Memory(reader) => {
+                let mut entry_reader =
+                    reader.reader_without_entry(index).await.map_err(|error| {
+                        BackendError::Zip(format!("Failed to read {label} from IPA: {error}"))
+                    })?;
+                let mut data = Vec::new();
+                entry_reader.read_to_end(&mut data).await.map_err(|error| {
+                    BackendError::Zip(format!("Failed to extract {label} from IPA: {error}"))
+                })?;
+                Ok(data)
+            }
+        }
+    }
+}
+
+fn archive_worker_count(maximum: usize) -> usize {
+    std::thread::available_parallelism()
+        .map(|parallelism| parallelism.get())
+        .unwrap_or(1)
+        .clamp(1, maximum)
+}
+
+fn safe_zip_entry_path(name: &str) -> BackendResult<PathBuf> {
+    if name.is_empty() || name.contains('\\') {
+        return Err(unsafe_zip_path_error(name));
+    }
+
+    let mut result = PathBuf::new();
+    for component in Path::new(name).components() {
+        match component {
+            Component::Normal(component) => result.push(component),
+            _ => return Err(unsafe_zip_path_error(name)),
+        }
+    }
+    if result.as_os_str().is_empty() {
+        Err(unsafe_zip_path_error(name))
+    } else {
+        Ok(result)
+    }
+}
+
+fn unsafe_zip_path_error(name: &str) -> BackendError {
+    BackendError::Zip(format!("IPA contains unsafe entry path {name:?}."))
+}
+
+fn is_symlink_mode(mode: u16) -> bool {
+    mode & 0o170000 == 0o120000
+}
+
+#[cfg(unix)]
+fn set_extracted_permissions(path: &Path, mode: Option<u16>) -> BackendResult<()> {
+    let Some(mode) = mode else {
+        return Ok(());
+    };
+    let mode = mode & 0o7777;
+    if mode == 0 {
+        return Ok(());
+    }
+    fs::set_permissions(path, fs::Permissions::from_mode(u32::from(mode))).map_err(|source| {
+        BackendError::Io {
+            action: "Restore extracted IPA permissions",
+            path: path.to_path_buf(),
+            source,
+        }
+    })
+}
+
+#[cfg(not(unix))]
+fn set_extracted_permissions(_: &Path, _: Option<u16>) -> BackendResult<()> {
+    Ok(())
+}
+
+fn root_app_bundle(staging_root: &Path) -> BackendResult<PathBuf> {
+    let payload = staging_root.join("Payload");
+    let entries = fs::read_dir(&payload).map_err(|source| BackendError::Io {
+        action: "Read extracted IPA Payload folder",
+        path: payload.clone(),
+        source,
+    })?;
+    let mut apps = entries
+        .filter_map(Result::ok)
+        .filter_map(|entry| {
+            let path = entry.path();
+            entry
+                .file_type()
+                .ok()
+                .filter(|kind| kind.is_dir())
+                .and_then(|_| {
+                    (path.extension().and_then(|value| value.to_str()) == Some("app"))
+                        .then_some(path)
+                })
+        })
+        .collect::<Vec<_>>();
+    apps.sort();
+
+    match apps.len() {
+        1 => Ok(apps.remove(0)),
+        0 => Err(BackendError::Zip(
+            "IPA does not contain a root Payload/*.app bundle.".to_string(),
+        )),
+        count => Err(BackendError::Zip(format!(
+            "IPA contains {count} root app bundles; exactly one is required."
+        ))),
+    }
+}
+
+fn patch_app_bundle(
+    app_path: &Path,
+    metadata: &AppMetadata,
+    icon_override_path: Option<&Path>,
+) -> BackendResult<()> {
+    validate_metadata(metadata)?;
+    let info_path = app_path.join("Info.plist");
+    let mut info = match Value::from_file(&info_path).map_err(|error| {
+        BackendError::Plist(format!("Failed to read {}: {error}", info_path.display()))
+    })? {
+        Value::Dictionary(info) => info,
+        _ => {
+            return Err(BackendError::Plist(format!(
+                "{} is not a dictionary.",
+                info_path.display()
+            )));
+        }
+    };
+
+    let old_executable = required_plist_string(&info, "CFBundleExecutable")?.to_string();
+    validate_executable_name(&old_executable)?;
+    validate_executable_name(&metadata.executable)?;
+    if old_executable != metadata.executable {
+        let old_path = app_path.join(&old_executable);
+        let new_path = app_path.join(&metadata.executable);
+        if new_path.exists() {
+            return Err(BackendError::Message(format!(
+                "Cannot rename the app executable to {} because that file already exists.",
+                metadata.executable
+            )));
+        }
+        fs::rename(&old_path, &new_path).map_err(|source| BackendError::Io {
+            action: "Rename app executable",
+            path: old_path,
+            source,
+        })?;
+    }
+
+    set_info_string(&mut info, "CFBundleIdentifier", &metadata.bundle_id);
+    set_info_string(&mut info, "CFBundleDisplayName", &metadata.name);
+    set_info_string(&mut info, "CFBundleName", &metadata.name);
+    set_info_string(&mut info, "CFBundleShortVersionString", &metadata.version);
+    set_info_string(&mut info, "CFBundleVersion", &metadata.build);
+    set_info_string(&mut info, "CFBundleExecutable", &metadata.executable);
+    set_info_string(&mut info, "MinimumOSVersion", &metadata.minimum_os);
+    if metadata.supported_devices.is_empty() {
+        info.remove("UIDeviceFamily");
+    } else {
+        info.insert(
+            "UIDeviceFamily".to_string(),
+            Value::Array(
+                metadata
+                    .supported_devices
+                    .iter()
+                    .map(|family| Value::Integer(device_family_id(*family).into()))
+                    .collect(),
+            ),
+        );
+    }
+
+    if let Some(icon_path) = icon_override_path {
+        patch_icon(app_path, &mut info, icon_path, &metadata.supported_devices)?;
+    }
+
+    Value::Dictionary(info)
+        .to_file_binary(&info_path)
+        .map_err(|error| {
+            BackendError::Plist(format!("Failed to write {}: {error}", info_path.display()))
+        })
+}
+
+fn patch_nested_bundle_identifiers(
+    app_path: &Path,
+    replacements: &BTreeMap<String, String>,
+) -> BackendResult<()> {
+    for entry in WalkDir::new(app_path).follow_links(false) {
+        let entry = entry.map_err(|error| {
+            BackendError::Message(format!(
+                "Failed to inspect nested bundles in {}: {error}",
+                app_path.display()
+            ))
+        })?;
+        let info_path = entry.path();
+        if !entry.file_type().is_file() || entry.file_name() != "Info.plist" {
+            continue;
+        }
+        let mut info = match Value::from_file(info_path).map_err(|error| {
+            BackendError::Plist(format!("Failed to read {}: {error}", info_path.display()))
+        })? {
+            Value::Dictionary(info) => info,
+            _ => continue,
+        };
+        let Some(bundle_id) = plist_string(&info, "CFBundleIdentifier") else {
+            continue;
+        };
+        let Some(replacement) = replacements.get(bundle_id) else {
+            continue;
+        };
+        if replacement == bundle_id {
+            continue;
+        }
+        info.insert(
+            "CFBundleIdentifier".to_string(),
+            Value::String(replacement.clone()),
+        );
+        Value::Dictionary(info)
+            .to_file_binary(info_path)
+            .map_err(|error| {
+                BackendError::Plist(format!("Failed to write {}: {error}", info_path.display()))
+            })?;
+    }
+    Ok(())
+}
+
+fn validate_metadata(metadata: &AppMetadata) -> BackendResult<()> {
+    for (label, value) in [
+        ("app name", metadata.name.as_str()),
+        ("bundle identifier", metadata.bundle_id.as_str()),
+        ("version", metadata.version.as_str()),
+        ("build", metadata.build.as_str()),
+        ("executable", metadata.executable.as_str()),
+        ("minimum OS version", metadata.minimum_os.as_str()),
+    ] {
+        if value.trim().is_empty() {
+            return Err(BackendError::Message(format!(
+                "The {label} cannot be empty when signing."
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn validate_executable_name(name: &str) -> BackendResult<()> {
+    let mut components = Path::new(name).components();
+    if matches!(components.next(), Some(Component::Normal(_))) && components.next().is_none() {
+        Ok(())
+    } else {
+        Err(BackendError::Message(format!(
+            "The app executable name {name:?} must be a file name, not a path."
+        )))
+    }
+}
+
+fn set_info_string(info: &mut Dictionary, key: &str, value: &str) {
+    info.insert(key.to_string(), Value::String(value.to_string()));
+}
+
+fn device_family_id(family: SupportedDeviceFamily) -> i64 {
+    match family {
+        SupportedDeviceFamily::IPhone => 1,
+        SupportedDeviceFamily::IPad => 2,
+        SupportedDeviceFamily::AppleTv => 3,
+        SupportedDeviceFamily::AppleWatch => 4,
+        SupportedDeviceFamily::Mac => 6,
+    }
+}
+
+fn patch_icon(
+    app_path: &Path,
+    info: &mut Dictionary,
+    icon_path: &Path,
+    supported_devices: &[SupportedDeviceFamily],
+) -> BackendResult<()> {
+    if !icon_path.is_file() {
+        return Err(BackendError::Message(format!(
+            "The app icon override does not exist: {}",
+            icon_path.display()
+        )));
+    }
+    if !icon_path
+        .extension()
+        .and_then(|value| value.to_str())
+        .is_some_and(|extension| extension.eq_ignore_ascii_case("png"))
+    {
+        return Err(BackendError::Message(
+            "The app icon override must be a PNG file.".to_string(),
+        ));
+    }
+
+    write_icon_variants(app_path, icon_path)?;
+
+    let supports_ipad = supported_devices.contains(&SupportedDeviceFamily::IPad);
+    let supports_iphone = supported_devices.contains(&SupportedDeviceFamily::IPhone);
+    let (primary_icon_name, primary_icon_names) = if supports_iphone || !supports_ipad {
+        (IPHONE_PRIMARY_ICON_NAME, IPHONE_ICON_NAMES)
+    } else {
+        (IPAD_PRIMARY_ICON_NAME, IPAD_ICON_NAMES)
+    };
+    info.remove("CFBundleIconName");
+    info.insert(
+        "CFBundleIconFile".to_string(),
+        Value::String(primary_icon_name.to_string()),
+    );
+    info.insert(
+        "CFBundleIconFiles".to_string(),
+        icon_file_names(primary_icon_names),
+    );
+    info.insert(
+        "CFBundleIcons".to_string(),
+        Value::Dictionary(icon_dictionary(primary_icon_names)),
+    );
+    if supports_ipad {
+        info.insert(
+            "CFBundleIconFiles~ipad".to_string(),
+            icon_file_names(IPAD_ICON_NAMES),
+        );
+        info.insert(
+            "CFBundleIcons~ipad".to_string(),
+            Value::Dictionary(icon_dictionary(IPAD_ICON_NAMES)),
+        );
+    } else {
+        info.remove("CFBundleIconFiles~ipad");
+        info.remove("CFBundleIcons~ipad");
+    }
+    Ok(())
+}
+
+fn icon_file_names(names: &[&str]) -> Value {
+    Value::Array(
+        names
+            .iter()
+            .map(|name| Value::String((*name).to_string()))
+            .collect(),
+    )
+}
+
+fn icon_dictionary(names: &[&str]) -> Dictionary {
+    let mut primary = Dictionary::new();
+    primary.insert("CFBundleIconFiles".to_string(), icon_file_names(names));
+    let mut icons = Dictionary::new();
+    icons.insert(
+        "CFBundlePrimaryIcon".to_string(),
+        Value::Dictionary(primary),
+    );
+    icons
+}
+
+fn sign_staged_app(app_path: &Path, request: &IpaSigningRequest) -> BackendResult<()> {
+    let root_profile_data = request
+        .provisioning_profiles
+        .get(&request.metadata.bundle_id)
+        .ok_or_else(|| {
+            BackendError::Message(format!(
+                "No provisioning profile was downloaded for {}.",
+                request.metadata.bundle_id
+            ))
+        })?;
+    let root_profile = ProvisioningProfile::parse(root_profile_data).map_err(|error| {
+        BackendError::Message(format!(
+            "Failed to parse the downloaded provisioning profile: {error}"
+        ))
+    })?;
+    validate_signing_profile(&root_profile, &request.metadata.bundle_id, request)?;
+
+    let private_key_der = decode_private_key(&request.private_key_pem)?;
+    let signer = RustCryptoCmsSigner::from_der(
+        &private_key_der,
+        &request.certificate_der,
+        root_profile
+            .certificate_chain_der()
+            .iter()
+            .map(Vec::as_slice),
+    )
+    .map_err(|error| {
+        BackendError::Message(format!("Failed to prepare the code signer: {error}"))
+    })?;
+    let mut settings = BundleSigningSettings::new(
+        request.team_id.clone(),
+        root_profile.entitlements().clone(),
+        Some(&signer),
+    );
+    settings.embedded_mobileprovisions_by_bundle_id = request
+        .provisioning_profiles
+        .iter()
+        .map(|(bundle_id, data)| (bundle_id.clone(), data.as_slice()))
+        .collect();
+    for (bundle_id, data) in &request.provisioning_profiles {
+        if bundle_id == &request.metadata.bundle_id {
+            continue;
+        }
+        let profile = ProvisioningProfile::parse(data).map_err(|error| {
+            BackendError::Message(format!(
+                "Failed to parse the provisioning profile for {bundle_id}: {error}"
+            ))
+        })?;
+        validate_signing_profile(&profile, bundle_id, request)?;
+        settings
+            .entitlements_by_bundle_id
+            .insert(bundle_id.clone(), profile.entitlements().clone());
+    }
+    sign_bundle(app_path, &settings)
+        .map_err(|error| BackendError::Message(format!("Failed to sign the app bundle: {error}")))
+}
+
+fn validate_signing_profile(
+    profile: &ProvisioningProfile,
+    bundle_id: &str,
+    request: &IpaSigningRequest,
+) -> BackendResult<()> {
+    if profile.team_id() != request.team_id {
+        return Err(BackendError::Message(format!(
+            "The provisioning profile for {bundle_id} belongs to team {}, not selected team {}.",
+            profile.team_id(),
+            request.team_id
+        )));
+    }
+    if !profile_contains_certificate(profile, &request.certificate_der) {
+        return Err(BackendError::Message(format!(
+            "The provisioning profile for {bundle_id} does not include the selected certificate. Refresh Developer Settings and try again."
+        )));
+    }
+
+    let expected_identifier = if bundle_id
+        .strip_prefix(&request.team_id)
+        .is_some_and(|suffix| suffix.starts_with('.'))
+    {
+        bundle_id.to_string()
+    } else {
+        format!("{}.{bundle_id}", request.team_id)
+    };
+    let profile_identifier = profile
+        .entitlements()
+        .get("application-identifier")
+        .and_then(Value::as_string)
+        .ok_or_else(|| {
+            BackendError::Message(format!(
+                "The provisioning profile for {bundle_id} has no application identifier."
+            ))
+        })?;
+    if profile_identifier != expected_identifier
+        && !profile_identifier
+            .strip_suffix('*')
+            .is_some_and(|prefix| expected_identifier.starts_with(prefix))
+    {
+        return Err(BackendError::Message(format!(
+            "Provisioning profile {profile_identifier} does not match bundle {bundle_id}."
+        )));
+    }
+    Ok(())
+}
+
+fn profile_contains_certificate(profile: &ProvisioningProfile, certificate_der: &[u8]) -> bool {
+    profile
+        .plist()
+        .get("DeveloperCertificates")
+        .and_then(Value::as_array)
+        .is_some_and(|certificates| {
+            certificates
+                .iter()
+                .filter_map(Value::as_data)
+                .any(|candidate| candidate == certificate_der)
+        })
+}
+
+fn decode_private_key(data: &[u8]) -> BackendResult<Vec<u8>> {
+    if !data.starts_with(b"-----BEGIN ") {
+        return Ok(data.to_vec());
+    }
+    let (label, der) = pem_rfc7468::decode_vec(data).map_err(|error| {
+        BackendError::Message(format!(
+            "Failed to decode the managed PEM private key: {error}"
+        ))
+    })?;
+    if matches!(label, "PRIVATE KEY" | "RSA PRIVATE KEY") {
+        Ok(der)
+    } else {
+        Err(BackendError::Message(format!(
+            "Unsupported managed private key PEM label {label:?}."
+        )))
+    }
+}
+
+async fn package_ipa(
+    staging_root: &Path,
+    output_path: &Path,
+    progress: &mut impl FnMut(IpaSigningProgress),
+) -> BackendResult<()> {
+    let mut entries = WalkDir::new(staging_root)
+        .follow_links(false)
+        .into_iter()
+        .skip(1)
+        .map(|entry| {
+            entry.map_err(|error| {
+                BackendError::Zip(format!(
+                    "Failed to enumerate staged IPA files under {}: {error}",
+                    staging_root.display()
+                ))
+            })
+        })
+        .collect::<BackendResult<Vec<_>>>()?;
+    entries.sort_by_key(|entry| entry.path().to_path_buf());
+
+    let output = tokio::fs::File::create(output_path)
+        .await
+        .map_err(|source| BackendError::Io {
+            action: "Create signed IPA archive",
+            path: output_path.to_path_buf(),
+            source,
+        })?;
+    let mut writer = ZipFileWriter::with_tokio(output);
+    let total = entries.len();
+    progress(IpaSigningProgress::Packaging {
+        completed: 0,
+        total,
+    });
+
+    let mut directories = Vec::new();
+    let mut files = Vec::new();
+    for entry in entries {
+        let path = entry.path();
+        let relative = path.strip_prefix(staging_root).map_err(|_| {
+            BackendError::Zip(format!(
+                "Failed to create a relative path for {}.",
+                path.display()
+            ))
+        })?;
+        let mut name = relative
+            .to_string_lossy()
+            .replace(std::path::MAIN_SEPARATOR, "/");
+        let metadata = entry.metadata().map_err(|error| {
+            BackendError::Zip(format!("Failed to inspect {}: {error}", path.display()))
+        })?;
+        if metadata.file_type().is_symlink() {
+            return Err(BackendError::Zip(format!(
+                "Staged IPA contains unsupported symbolic link {}.",
+                path.display()
+            )));
+        }
+
+        if metadata.is_dir() {
+            name.push('/');
+            directories.push(PackageDirectory {
+                path: path.to_path_buf(),
+                name,
+                unix_mode: zip_mode(&metadata, true),
+            });
+        } else if metadata.is_file() {
+            files.push(PackageFilePlan {
+                path: path.to_path_buf(),
+                name,
+                unix_mode: zip_mode(&metadata, false),
+            });
+        }
+    }
+
+    let mut completed = 0;
+    for directory in directories {
+        let builder = ZipEntryBuilder::new(directory.name.into(), Compression::Stored)
+            .unix_permissions(directory.unix_mode);
+        writer
+            .write_entry_whole(builder, &[])
+            .await
+            .map_err(|error| {
+                BackendError::Zip(format!("Failed to package {:?}: {error}", directory.path))
+            })?;
+        completed += 1;
+        report_packaging_progress(progress, completed, total);
+    }
+
+    let mut files = files.into_iter();
+    let mut workers = JoinSet::new();
+    let concurrency = archive_worker_count(MAX_PACKAGING_WORKERS);
+    for _ in 0..concurrency {
+        let Some(plan) = files.next() else {
+            break;
+        };
+        workers.spawn_blocking(move || prepare_zip_file(plan));
+    }
+
+    while let Some(result) = workers.join_next().await {
+        let prepared = result.map_err(|error| {
+            BackendError::Zip(format!("IPA packaging worker failed: {error}"))
+        })??;
+        writer
+            .write_entry_whole_precompressed(prepared.entry, &prepared.data)
+            .await
+            .map_err(|error| {
+                BackendError::Zip(format!(
+                    "Failed to package {:?}: {error}",
+                    prepared.source_path
+                ))
+            })?;
+        completed += 1;
+        report_packaging_progress(progress, completed, total);
+
+        if let Some(plan) = files.next() {
+            workers.spawn_blocking(move || prepare_zip_file(plan));
+        }
+    }
+
+    let mut output = writer
+        .close()
+        .await
+        .map_err(|error| BackendError::Zip(format!("Failed to finish signed IPA: {error}")))?
+        .into_inner();
+    output.flush().await.map_err(|source| BackendError::Io {
+        action: "Flush signed IPA archive",
+        path: output_path.to_path_buf(),
+        source,
+    })?;
+    output.sync_all().await.map_err(|source| BackendError::Io {
+        action: "Sync signed IPA archive",
+        path: output_path.to_path_buf(),
+        source,
+    })
+}
+
+struct PackageDirectory {
+    path: PathBuf,
+    name: String,
+    unix_mode: u16,
+}
+
+struct PackageFilePlan {
+    path: PathBuf,
+    name: String,
+    unix_mode: u16,
+}
+
+struct PreparedZipFile {
+    source_path: PathBuf,
+    entry: ZipEntry,
+    data: Vec<u8>,
+}
+
+fn prepare_zip_file(plan: PackageFilePlan) -> BackendResult<PreparedZipFile> {
+    let source_data = fs::read(&plan.path).map_err(|source| BackendError::Io {
+        action: "Read staged IPA file",
+        path: plan.path.clone(),
+        source,
+    })?;
+    let source_size = source_data.len() as u64;
+    let crc32 = crc32fast::hash(&source_data);
+    let preferred_compression = compression_for_path(&plan.path);
+    let (compression, data) = if preferred_compression == Compression::Deflate {
+        let mut encoder =
+            DeflateEncoder::new(Vec::new(), FlateCompression::new(FAST_DEFLATE_LEVEL));
+        encoder
+            .write_all(&source_data)
+            .map_err(|source| BackendError::Io {
+                action: "Compress staged IPA file",
+                path: plan.path.clone(),
+                source,
+            })?;
+        let compressed = encoder.finish().map_err(|source| BackendError::Io {
+            action: "Finish compressing staged IPA file",
+            path: plan.path.clone(),
+            source,
+        })?;
+        if compressed.len() < source_data.len() {
+            (Compression::Deflate, compressed)
+        } else {
+            (Compression::Stored, source_data)
+        }
+    } else {
+        (Compression::Stored, source_data)
+    };
+    let compressed_size = data.len() as u64;
+    let entry = ZipEntryBuilder::new(plan.name.into(), compression)
+        .unix_permissions(plan.unix_mode)
+        .crc32(crc32)
+        .uncompressed_size(source_size)
+        .compressed_size(compressed_size)
+        .build();
+
+    Ok(PreparedZipFile {
+        source_path: plan.path,
+        entry,
+        data,
+    })
+}
+
+fn compression_for_path(path: &Path) -> Compression {
+    let already_compressed = path
+        .extension()
+        .and_then(|extension| extension.to_str())
+        .is_some_and(|extension| {
+            matches!(
+                extension.to_ascii_lowercase().as_str(),
+                "7z" | "aac"
+                    | "bz2"
+                    | "car"
+                    | "gif"
+                    | "gz"
+                    | "heic"
+                    | "heif"
+                    | "ipa"
+                    | "jpeg"
+                    | "jpg"
+                    | "m4a"
+                    | "m4v"
+                    | "mov"
+                    | "mp3"
+                    | "mp4"
+                    | "pdf"
+                    | "png"
+                    | "rar"
+                    | "webp"
+                    | "xz"
+                    | "zip"
+                    | "zst"
+            )
+        });
+    if already_compressed {
+        Compression::Stored
+    } else {
+        Compression::Deflate
+    }
+}
+
+fn report_extracting_progress(
+    progress: &mut impl FnMut(IpaSigningProgress),
+    completed: usize,
+    total: usize,
+) {
+    if should_report_item_progress(completed, total) {
+        progress(IpaSigningProgress::Extracting { completed, total });
+    }
+}
+
+fn report_packaging_progress(
+    progress: &mut impl FnMut(IpaSigningProgress),
+    completed: usize,
+    total: usize,
+) {
+    if should_report_item_progress(completed, total) {
+        progress(IpaSigningProgress::Packaging { completed, total });
+    }
+}
+
+fn should_report_item_progress(completed: usize, total: usize) -> bool {
+    completed == 0
+        || completed >= total
+        || (completed.saturating_mul(100) / total.max(1))
+            != (completed.saturating_sub(1).saturating_mul(100) / total.max(1))
+}
+
+#[cfg(unix)]
+fn zip_mode(metadata: &fs::Metadata, _: bool) -> u16 {
+    (metadata.permissions().mode() & 0xffff) as u16
+}
+
+#[cfg(not(unix))]
+fn zip_mode(_: &fs::Metadata, directory: bool) -> u16 {
+    if directory {
+        0o755
+    } else {
+        0o644
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    fn signing_metadata(executable: &str) -> AppMetadata {
+        AppMetadata {
+            name: "Patched App".to_string(),
+            bundle_id: "com.example.patched".to_string(),
+            version: "2.0".to_string(),
+            build: "42".to_string(),
+            executable: executable.to_string(),
+            minimum_os: "16.0".to_string(),
+            supported_devices: vec![SupportedDeviceFamily::IPhone, SupportedDeviceFamily::IPad],
+        }
+    }
+
+    fn write_test_app(app_path: &Path, executable: &str) {
+        fs::create_dir_all(app_path).unwrap();
+        fs::write(app_path.join(executable), b"executable").unwrap();
+        let mut info = Dictionary::new();
+        info.insert(
+            "CFBundleIdentifier".to_string(),
+            Value::String("com.example.original".to_string()),
+        );
+        info.insert(
+            "CFBundleExecutable".to_string(),
+            Value::String(executable.to_string()),
+        );
+        Value::Dictionary(info)
+            .to_file_binary(app_path.join("Info.plist"))
+            .unwrap();
+    }
+
     #[test]
     fn info_plist_paths_require_payload_app_prefix() {
         assert!(is_app_info_plist("Payload/App.app/Info.plist"));
-        assert!(is_app_info_plist("Payload/Nested/App.app/Info.plist"));
+        assert!(!is_app_info_plist("Payload/Nested/App.app/Info.plist"));
         assert!(!is_app_info_plist("App.app/Info.plist"));
         assert!(!is_app_info_plist("Payload/App.app/Other.plist"));
     }
 
+    #[test]
+    fn nested_signable_bundle_paths_include_extensions_and_nested_apps() {
+        let root = "Payload/App.app/";
+
+        assert!(is_nested_signable_info_plist(
+            "Payload/App.app/PlugIns/Widget.appex/Info.plist",
+            root
+        ));
+        assert!(is_nested_signable_info_plist(
+            "Payload/App.app/Watch/WatchApp.app/Info.plist",
+            root
+        ));
+        assert!(!is_nested_signable_info_plist(
+            "Payload/App.app/Frameworks/Example.framework/Info.plist",
+            root
+        ));
+        assert!(!is_nested_signable_info_plist(
+            "Payload/App.app/Info.plist",
+            root
+        ));
+    }
+
     #[test]
     fn required_plist_string_reports_missing_key() {
         let mut info = Dictionary::new();
@@ -340,6 +1512,24 @@ mod tests {
         );
     }
 
+    #[test]
+    fn item_progress_is_sampled_at_percent_boundaries_and_completion() {
+        assert!(should_report_item_progress(0, 1_000));
+        assert!(!should_report_item_progress(1, 1_000));
+        assert!(should_report_item_progress(10, 1_000));
+        assert!(should_report_item_progress(1_000, 1_000));
+    }
+
+    #[test]
+    fn packaging_skips_deflate_for_already_compressed_formats() {
+        for path in ["Icon.PNG", "Assets.car", "Video.mp4", "Nested/archive.zip"] {
+            assert_eq!(compression_for_path(Path::new(path)), Compression::Stored);
+        }
+        for path in ["Info.plist", "Executable", "Framework.dylib"] {
+            assert_eq!(compression_for_path(Path::new(path)), Compression::Deflate);
+        }
+    }
+
     #[test]
     fn supported_device_family_values_are_normalized() {
         let mut info = Dictionary::new();
@@ -379,4 +1569,241 @@ mod tests {
                 && entitlement.value == EntitlementValue::Boolean(true)
         }));
     }
+
+    #[test]
+    fn zip_entry_paths_reject_traversal_and_platform_separators() {
+        assert_eq!(
+            safe_zip_entry_path("Payload/App.app/Info.plist").unwrap(),
+            PathBuf::from("Payload/App.app/Info.plist")
+        );
+        for path in [
+            "../outside",
+            "Payload/../../outside",
+            "/absolute/path",
+            "Payload\\..\\outside",
+        ] {
+            assert!(safe_zip_entry_path(path).is_err(), "accepted {path}");
+        }
+    }
+
+    #[test]
+    fn plist_patching_updates_metadata_and_renames_executable() {
+        let temp = tempfile::tempdir().unwrap();
+        let app_path = temp.path().join("Payload").join("Test.app");
+        write_test_app(&app_path, "OriginalExecutable");
+
+        patch_app_bundle(&app_path, &signing_metadata("PatchedExecutable"), None).unwrap();
+
+        assert!(!app_path.join("OriginalExecutable").exists());
+        assert!(app_path.join("PatchedExecutable").exists());
+        let info = Value::from_file(app_path.join("Info.plist"))
+            .unwrap()
+            .into_dictionary()
+            .unwrap();
+        assert_eq!(
+            info.get("CFBundleIdentifier").and_then(Value::as_string),
+            Some("com.example.patched")
+        );
+        assert_eq!(
+            info.get("CFBundleDisplayName").and_then(Value::as_string),
+            Some("Patched App")
+        );
+        assert_eq!(
+            info.get("CFBundleExecutable").and_then(Value::as_string),
+            Some("PatchedExecutable")
+        );
+        assert_eq!(
+            info.get("UIDeviceFamily")
+                .and_then(Value::as_array)
+                .map(Vec::len),
+            Some(2)
+        );
+    }
+
+    #[test]
+    fn nested_bundle_identifiers_are_patched_from_provisioning_map() {
+        let temp = tempfile::tempdir().unwrap();
+        let app_path = temp.path().join("Payload").join("Test.app");
+        let extension_path = app_path.join("PlugIns").join("Widget.appex");
+        let framework_path = app_path.join("Frameworks").join("Example.framework");
+        for (path, bundle_id) in [
+            (&extension_path, "com.example.app.widget"),
+            (&framework_path, "com.example.framework"),
+        ] {
+            fs::create_dir_all(path).unwrap();
+            let mut info = Dictionary::new();
+            info.insert(
+                "CFBundleIdentifier".to_string(),
+                Value::String(bundle_id.to_string()),
+            );
+            Value::Dictionary(info)
+                .to_file_binary(path.join("Info.plist"))
+                .unwrap();
+        }
+
+        patch_nested_bundle_identifiers(
+            &app_path,
+            &BTreeMap::from([(
+                "com.example.app.widget".to_string(),
+                "com.example.app.TEAM.widget".to_string(),
+            )]),
+        )
+        .unwrap();
+
+        let extension_info = Value::from_file(extension_path.join("Info.plist"))
+            .unwrap()
+            .into_dictionary()
+            .unwrap();
+        let framework_info = Value::from_file(framework_path.join("Info.plist"))
+            .unwrap()
+            .into_dictionary()
+            .unwrap();
+        assert_eq!(
+            plist_string(&extension_info, "CFBundleIdentifier"),
+            Some("com.example.app.TEAM.widget")
+        );
+        assert_eq!(
+            plist_string(&framework_info, "CFBundleIdentifier"),
+            Some("com.example.framework")
+        );
+    }
+
+    #[test]
+    fn icon_override_generates_variants_and_updates_info_plist() {
+        let temp = tempfile::tempdir().unwrap();
+        let app_path = temp.path().join("Payload").join("Test.app");
+        write_test_app(&app_path, "TestExecutable");
+        let icon_path = temp.path().join("override.png");
+        image::RgbaImage::from_pixel(180, 180, image::Rgba([20, 40, 80, 255]))
+            .save(&icon_path)
+            .unwrap();
+
+        patch_app_bundle(
+            &app_path,
+            &signing_metadata("TestExecutable"),
+            Some(&icon_path),
+        )
+        .unwrap();
+
+        assert!(app_path.join("SuperSideloaderIcon60@3x.png").exists());
+        assert!(app_path.join("SuperSideloaderIcon76@2x.png").exists());
+        assert!(app_path.join("SuperSideloaderIcon83_5@2x.png").exists());
+        let info = Value::from_file(app_path.join("Info.plist"))
+            .unwrap()
+            .into_dictionary()
+            .unwrap();
+        assert_eq!(
+            info.get("CFBundleIconFiles")
+                .and_then(Value::as_array)
+                .and_then(|files| files.first())
+                .and_then(Value::as_string),
+            Some("SuperSideloaderIcon20")
+        );
+        assert_eq!(
+            info.get("CFBundleIconFiles")
+                .and_then(Value::as_array)
+                .map(Vec::len),
+            Some(IPHONE_ICON_NAMES.len())
+        );
+        assert_eq!(
+            info.get("CFBundleIconFiles~ipad")
+                .and_then(Value::as_array)
+                .map(Vec::len),
+            Some(IPAD_ICON_NAMES.len())
+        );
+        assert!(info.contains_key("CFBundleIcons~ipad"));
+    }
+
+    #[tokio::test]
+    async fn ipa_packaging_round_trips_files_permissions_and_compression() {
+        let temp = tempfile::tempdir().unwrap();
+        let staging = temp.path().join("staging");
+        let executable = staging.join("Payload/Test.app/TestExecutable");
+        fs::create_dir_all(executable.parent().unwrap()).unwrap();
+        fs::write(&executable, b"executable").unwrap();
+        let text = executable.parent().unwrap().join("Config.txt");
+        let text_contents = vec![b'A'; 64 * 1024];
+        fs::write(&text, &text_contents).unwrap();
+        let png = executable.parent().unwrap().join("Icon.png");
+        let png_contents = b"already-compressed-image-data";
+        fs::write(&png, png_contents).unwrap();
+        #[cfg(unix)]
+        fs::set_permissions(&executable, fs::Permissions::from_mode(0o755)).unwrap();
+
+        let ipa_path = temp.path().join("signed.ipa");
+        let mut progress_events = Vec::new();
+        package_ipa(&staging, &ipa_path, &mut |event| {
+            progress_events.push(event)
+        })
+        .await
+        .unwrap();
+
+        assert!(matches!(
+            progress_events.first(),
+            Some(IpaSigningProgress::Packaging { completed: 0, .. })
+        ));
+        assert!(matches!(
+            progress_events.last(),
+            Some(IpaSigningProgress::Packaging { completed, total }) if completed == total
+        ));
+
+        let reader = ZipFileReader::new(&ipa_path).await.unwrap();
+        let find_entry = |name: &str| {
+            reader
+                .file()
+                .entries()
+                .iter()
+                .find(|entry| entry_name(entry) == Some(name))
+                .unwrap()
+        };
+        let entry = find_entry("Payload/Test.app/TestExecutable");
+        #[cfg(unix)]
+        assert_ne!(entry.unix_permissions().unwrap_or_default() & 0o111, 0);
+        assert_eq!(
+            find_entry("Payload/Test.app/Config.txt").compression(),
+            Compression::Deflate
+        );
+        assert_eq!(
+            find_entry("Payload/Test.app/Icon.png").compression(),
+            Compression::Stored
+        );
+
+        let extracted = temp.path().join("round-trip");
+        fs::create_dir(&extracted).unwrap();
+        let mut extraction_progress = Vec::new();
+        extract_ipa(&ipa_path, &extracted, &mut |event| {
+            extraction_progress.push(event)
+        })
+        .await
+        .unwrap();
+        assert_eq!(
+            fs::read(extracted.join("Payload/Test.app/TestExecutable")).unwrap(),
+            b"executable"
+        );
+        assert_eq!(
+            fs::read(extracted.join("Payload/Test.app/Config.txt")).unwrap(),
+            text_contents
+        );
+        assert_eq!(
+            fs::read(extracted.join("Payload/Test.app/Icon.png")).unwrap(),
+            png_contents
+        );
+        assert!(matches!(
+            extraction_progress.first(),
+            Some(IpaSigningProgress::Extracting { completed: 0, .. })
+        ));
+        assert!(matches!(
+            extraction_progress.last(),
+            Some(IpaSigningProgress::Extracting { completed, total }) if completed == total
+        ));
+        #[cfg(unix)]
+        assert_ne!(
+            fs::metadata(extracted.join("Payload/Test.app/TestExecutable"))
+                .unwrap()
+                .permissions()
+                .mode()
+                & 0o111,
+            0
+        );
+    }
 }

super-sideloader/src/backend/mod.rs

View file @ 65cd6c1

@@ -2,6 +2,7 @@ pub(crate) mod adi;
 pub(crate) mod adi_service;
 pub(crate) mod device;
 pub(crate) mod error;
+mod icon;
 pub(crate) mod ipa;
 pub(crate) mod paths;
 pub(crate) mod preferences;

super-sideloader/src/domain/developer.rs

View file @ 65cd6c1

@@ -44,5 +44,13 @@ pub(crate) struct DeveloperCertificate {
     pub(crate) serial_number: String,
     pub(crate) machine_name: String,
     pub(crate) private_key_available: bool,
+    pub(crate) certificate_fingerprint: Option<String>,
     pub(crate) public_key_fingerprint: Option<String>,
 }
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct DeveloperDevice {
+    pub(crate) id: String,
+    pub(crate) name: String,
+    pub(crate) udid: String,
+}

super-sideloader/src/domain/device.rs

View file @ 65cd6c1

...	...	@@ -12,3 +12,18 @@ pub(crate) enum DeviceWatchEvent {
12	12	Changed,
13	13	Failed(String),
14	14	}
	15	+
	16	+#[derive(Clone, Debug, Eq, PartialEq)]
	17	+pub(crate) enum DeviceInstallProgress {
	18	+ Connecting,
	19	+ Uploading {
	20	+ transferred_bytes: u64,
	21	+ total_bytes: u64,
	22	+ completed_files: usize,
	23	+ total_files: usize,
	24	+ },
	25	+ Installing {
	26	+ percent: u64,
	27	+ },
	28	+ Finalizing,
	29	+}

super-sideloader/src/domain/ipa.rs

View file @ 65cd6c1

@@ -37,6 +37,12 @@ pub(crate) struct AppMetadata {
     pub(crate) supported_devices: Vec<SupportedDeviceFamily>,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct NestedBundle {
+    pub(crate) name: String,
+    pub(crate) bundle_id: String,
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub(crate) struct AppEntitlement {
     pub(crate) key: String,
@@ -66,6 +72,7 @@ pub(crate) enum EntitlementsSource {
 #[derive(Clone, Debug, PartialEq)]
 pub(crate) struct IpaApp {
     pub(crate) metadata: AppMetadata,
+    pub(crate) nested_bundles: Vec<NestedBundle>,
     pub(crate) path: String,
     pub(crate) icon_path: Option<String>,
     pub(crate) entitlements: Vec<AppEntitlement>,

super-sideloader/src/domain/mod.rs

View file @ 65cd6c1

@@ -6,7 +6,8 @@ pub(crate) mod ipa;
 
 pub(crate) use adi::*;
 pub(crate) use developer::{
-    DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate, DeveloperTeam,
+    DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate,
+    DeveloperDevice, DeveloperTeam,
 };
 pub(crate) use device::*;
 pub(crate) use identity::*;

super-sideloader/src/ui/main_view.rs

View file @ 65cd6c1

@@ -18,11 +18,34 @@ use crate::ui::widgets::{
 use futures::{channel::mpsc, StreamExt};
 use gpui::{
     div, prelude::*, px, App, ClickEvent, Context, ExternalPaths, FocusHandle, FontWeight,
-    InteractiveElement, IntoElement, ParentElement, PathPromptOptions, Render, Styled, Window,
+    InteractiveElement, IntoElement, ParentElement, PathPromptOptions, PromptButton, PromptLevel,
+    Render, Styled, Window,
 };
 use gpui_component::button::Button;
+use gpui_component::text::TextView;
 use std::ops::{Deref, DerefMut};
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
+
+const SIDELOAD_SIGNING_WEIGHT: f32 = 0.72;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum SigningAction {
+    Save,
+    Sideload,
+}
+
+impl SigningAction {
+    fn installs_after_signing(self) -> bool {
+        self == Self::Sideload
+    }
+
+    fn confirmation_label(self) -> &'static str {
+        match self {
+            Self::Save => "Create and Sign",
+            Self::Sideload => "Create and Sideload",
+        }
+    }
+}
 
 pub(crate) struct SideloaderView {
     pub(crate) focus_handle: FocusHandle,
@@ -300,6 +323,7 @@ impl SideloaderView {
         if self.device_selection.select(index) {
             self.open_picker = None;
             self.save_preferences();
+            self.sync_developer_settings_window(cx);
             cx.notify();
         }
     }
@@ -448,33 +472,508 @@ impl SideloaderView {
         .detach();
     }
 
-    fn sideload(&mut self, _: &ClickEvent, window: &mut Window, cx: &mut Context<Self>) {
+    fn sideload(&mut self, event: &ClickEvent, window: &mut Window, cx: &mut Context<Self>) {
+        self.start_signing(SigningAction::Sideload, event, window, cx);
+    }
+
+    fn sign(&mut self, event: &ClickEvent, window: &mut Window, cx: &mut Context<Self>) {
+        self.start_signing(SigningAction::Save, event, window, cx);
+    }
+
+    fn start_signing(
+        &mut self,
+        action: SigningAction,
+        event: &ClickEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
         window.focus(&self.focus_handle, cx);
         if self.is_busy()
             || self.selected_account().is_none()
             || self.selected_app().is_none()
-            || self.selected_device().is_none()
+            || (action.installs_after_signing() && self.selected_device().is_none())
         {
             return;
         }
-        self.start_signing_operation(cx);
+
+        let Some(account) = self.selected_account().cloned() else {
+            return;
+        };
+        let Some(team) = account.teams.get(self.selected_team).cloned() else {
+            self.fail_signing_and_open_developer_settings(
+                "Select a developer team before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
+        };
+        let Some(certificate) = team.certificates.get(self.selected_certificate).cloned() else {
+            self.fail_signing_and_open_developer_settings(
+                "Create a development certificate in Developer Settings before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
+        };
+        if !certificate.private_key_available {
+            self.fail_signing_and_open_developer_settings(
+                "Import the selected certificate's PEM private key in Developer Settings before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
         }
+        let Some(certificate_fingerprint) = certificate.certificate_fingerprint.clone() else {
+            self.fail_signing_and_open_developer_settings(
+                "Refresh Developer Settings to cache the selected certificate before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
+        };
+        let Some(public_key_fingerprint) = certificate.public_key_fingerprint.clone() else {
+            self.fail_signing_and_open_developer_settings(
+                "Refresh Developer Settings to inspect the selected certificate before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
+        };
+        let selected_app_id = team.app_ids.get(self.selected_app_id).cloned();
+        if !self.auto_app_id && selected_app_id.is_none() {
+            self.fail_signing_and_open_developer_settings(
+                "Select an App ID in Developer Settings before signing.",
+                event,
+                window,
+                cx,
+            );
+            return;
+        }
+        let developer_context = match self.selected_developer_context() {
+            Ok(context) => context,
+            Err(error) => {
+                self.sideload_operation = SideloadOperation::Failed { message: error };
+                cx.notify();
+                return;
+            }
+        };
+        let app = self
+            .selected_app()
+            .cloned()
+            .expect("selected app checked above");
+        let selected_device = action
+            .installs_after_signing()
+            .then(|| self.selected_device().cloned())
+            .flatten();
+        let app_name = app.name().to_string();
+        let (directory, suggested_name) = signed_ipa_destination(&app.path);
+        let destination_receiver = if action == SigningAction::Save {
+            Some(cx.prompt_for_new_path(&directory, Some(&suggested_name)))
+        } else {
+            None
+        };
+        let auto_app_id = self.auto_app_id;
+        let team_id = team.identifier;
+        let selected_app_id_identifier = selected_app_id
+            .as_ref()
+            .map(|app_id| app_id.identifier.clone());
+        self.open_picker = None;
+        let (progress_sender, mut progress_receiver) = mpsc::unbounded();
+        cx.spawn(async move |view, cx| {
+            while let Some(event) = progress_receiver.next().await {
+                let _ = view.update(cx, |view, cx| {
+                    view.set_signing_progress(event, action.installs_after_signing());
+                    cx.notify();
+                });
+            }
+        })
+        .detach();
+        let (install_progress_sender, mut install_progress_receiver) = mpsc::unbounded();
+        cx.spawn(async move |view, cx| {
+            while let Some(event) = install_progress_receiver.next().await {
+                let _ = view.update(cx, |view, cx| {
+                    view.set_installing_progress(event);
+                    cx.notify();
+                });
+            }
+        })
+        .detach();
+        cx.notify();
 
-    fn sign(&mut self, _: &ClickEvent, window: &mut Window, cx: &mut Context<Self>) {
-        window.focus(&self.focus_handle, cx);
-        if self.is_busy() || self.selected_account().is_none() || self.selected_app().is_none() {
+        cx.spawn_in(window, async move |view, cx| {
+            let signing_output = if let Some(receiver) = destination_receiver {
+                match receiver.await {
+                    Ok(Ok(Some(path))) => app_effects::SignIpaOutput::Ipa(path),
+                    Ok(Ok(None)) | Err(_) => return,
+                    Ok(Err(error)) => {
+                        let _ = view.update(cx, |view, cx| {
+                            view.sideload_operation = SideloadOperation::Failed {
+                                message: format!(
+                                    "Failed to choose a signed IPA destination: {error}"
+                                ),
+                            };
+                            cx.notify();
+                        });
                         return;
                     }
-        self.start_signing_operation(cx);
                 }
+            } else {
+                app_effects::SignIpaOutput::AppBundle
+            };
 
-    fn start_signing_operation(&mut self, cx: &mut Context<Self>) {
-        self.open_picker = None;
-        self.sideload_operation = SideloadOperation::Running {
+            let _ = view.update(cx, |view, cx| {
+                view.sideload_operation = SideloadOperation::Running {
+                    phase: SideloadPhase::Signing,
+                    progress: 0.02,
+                    detail: "Refreshing App IDs".to_string(),
+                };
+                cx.notify();
+            });
+
+            let refreshed_account = match cx
+                .background_spawn(app_effects::refresh_account(developer_context.clone()))
+                .await
+            {
+                Ok(account) => account,
+                Err(error) => {
+                    let _ = view.update(cx, |view, cx| {
+                        view.sideload_operation = SideloadOperation::Failed {
+                            message: format!(
+                                "Could not refresh App IDs before signing: {}",
+                                error.user_message()
+                            ),
+                        };
+                        cx.notify();
+                    });
+                    return;
+                }
+            };
+            let Some(refreshed_team) = refreshed_account
+                .teams
+                .iter()
+                .find(|team| team.identifier == team_id)
+                .cloned()
+            else {
+                let _ = view.update(cx, |view, cx| {
+                    view.sideload_operation = SideloadOperation::Failed {
+                        message: "The selected developer team was not returned by Apple."
+                            .to_string(),
+                    };
+                    cx.notify();
+                });
+                return;
+            };
+            if let Some(device) = selected_device.as_ref() {
+                let _ = view.update(cx, |view, cx| {
+                    view.sideload_operation = SideloadOperation::Running {
+                        phase: SideloadPhase::Signing,
+                        progress: 0.03,
+                        detail: "Checking device registration".to_string(),
+                    };
+                    cx.notify();
+                });
+                let registered_devices = match cx
+                    .background_spawn(app_effects::list_developer_devices(
+                        developer_context.clone(),
+                        team_id.clone(),
+                    ))
+                    .await
+                {
+                    Ok(devices) => devices,
+                    Err(error) => {
+                        let _ = view.update(cx, |view, cx| {
+                            view.sideload_operation = SideloadOperation::Failed {
+                                message: format!(
+                                    "Could not check whether {} is registered with Apple: {}",
+                                    device.name,
+                                    error.user_message()
+                                ),
+                            };
+                            cx.notify();
+                        });
+                        return;
+                    }
+                };
+                let device_is_registered = registered_devices.iter().any(|registered| {
+                    registered
+                        .udid
+                        .trim()
+                        .eq_ignore_ascii_case(device.udid.trim())
+                });
+                if !device_is_registered {
+                    let _ = view.update(cx, |view, cx| {
+                        view.sideload_operation = SideloadOperation::Running {
                             phase: SideloadPhase::Signing,
-            progress: 0.34,
+                            progress: 0.035,
+                            detail: format!("Registering {} with Apple", device.name),
                         };
                         cx.notify();
+                    });
+                    if let Err(error) = cx
+                        .background_spawn(app_effects::add_developer_device(
+                            developer_context.clone(),
+                            team_id.clone(),
+                            device.name.clone(),
+                            device.udid.clone(),
+                        ))
+                        .await
+                    {
+                        let _ = view.update(cx, |view, cx| {
+                            view.sideload_operation = SideloadOperation::Failed {
+                                message: format!(
+                                    "Could not register {} with Apple: {}",
+                                    device.name,
+                                    error.user_message()
+                                ),
+                            };
+                            cx.notify();
+                        });
+                        return;
+                    }
+                }
+            }
+            let refreshed_selected_app_id = selected_app_id_identifier.as_deref().and_then(|id| {
+                refreshed_team
+                    .app_ids
+                    .iter()
+                    .find(|app_id| app_id.identifier == id)
+                    .cloned()
+            });
+            let plan = match app_effects::app_id_provisioning_plan(
+                &refreshed_team,
+                auto_app_id,
+                refreshed_selected_app_id.clone(),
+                &app,
+            ) {
+                Ok(plan) => plan,
+                Err(error) => {
+                    let _ = view.update(cx, |view, cx| {
+                        view.state
+                            .replace_developer_account_preserving_selection(refreshed_account);
+                        view.save_preferences();
+                        view.sync_settings_windows(cx);
+                        view.sideload_operation = SideloadOperation::Failed {
+                            message: error.user_message(),
+                        };
+                        cx.notify();
+                    });
+                    return;
+                }
+            };
+
+            let _ = view.update(cx, |view, cx| {
+                view.state
+                    .replace_developer_account_preserving_selection(refreshed_account);
+                view.save_preferences();
+                view.sync_settings_windows(cx);
+                cx.notify();
+            });
+
+            if plan.app_ids.len() > 1 {
+                let (message, detail) = app_id_provisioning_prompt(&plan);
+                let prompt = match view.update_in(cx, |_, window, cx| {
+                    window.prompt(
+                        PromptLevel::Warning,
+                        &message,
+                        Some(&detail),
+                        &[
+                            PromptButton::new(action.confirmation_label()),
+                            PromptButton::Cancel("Cancel".into()),
+                        ],
+                        cx,
+                    )
+                }) {
+                    Ok(prompt) => prompt,
+                    Err(_) => return,
+                };
+                if prompt.await != Ok(0) {
+                    let _ = view.update(cx, |view, cx| {
+                        view.sideload_operation = SideloadOperation::Idle;
+                        cx.notify();
+                    });
+                    return;
+                }
+            }
+
+            let _ = view.update(cx, |view, cx| {
+                view.sideload_operation = SideloadOperation::Running {
+                    phase: SideloadPhase::Signing,
+                    progress: 0.04,
+                    detail: "Preparing signing resources".to_string(),
+                };
+                cx.notify();
+            });
+            let request = app_effects::SignIpaRequest {
+                developer_context,
+                team_id,
+                team_app_ids: refreshed_team.app_ids,
+                certificate_fingerprint,
+                public_key_fingerprint,
+                auto_app_id,
+                selected_app_id: refreshed_selected_app_id,
+                app,
+                output: signing_output,
+            };
+            let result = cx
+                .background_spawn(async move {
+                    app_effects::sign_ipa(request, move |event| {
+                        let _ = progress_sender.unbounded_send(event);
+                    })
+                    .await
+                    .map_err(|error| error.user_message())
+                })
+                .await;
+            let outcome = match result {
+                Ok(outcome) => outcome,
+                Err(message) => {
+                    let _ = view.update(cx, |view, cx| {
+                        view.sideload_operation = SideloadOperation::Failed { message };
+                        cx.notify();
+                    });
+                    return;
+                }
+            };
+            let app_effects::SignIpaOutcome {
+                artifact,
+                updated_account,
+            } = outcome;
+
+            let _ = view.update(cx, |view, cx| {
+                if let Some(account) = updated_account {
+                    view.state
+                        .replace_developer_account_preserving_selection(account);
+                    view.save_preferences();
+                    view.sync_settings_windows(cx);
+                }
+                cx.notify();
+            });
+            if action == SigningAction::Save {
+                let app_effects::SignIpaArtifact::Ipa(output_path) = artifact else {
+                    let _ = view.update(cx, |view, cx| {
+                        view.sideload_operation = SideloadOperation::Failed {
+                            message: "Signing completed without producing an IPA.".to_string(),
+                        };
+                        cx.notify();
+                    });
+                    return;
+                };
+                let file_name = output_path
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .unwrap_or("signed IPA");
+                let _ = view.update(cx, |view, cx| {
+                    view.sideload_operation = SideloadOperation::Finished {
+                        message: format!("Signed {file_name}"),
+                    };
+                    cx.notify();
+                });
+                return;
+            }
+
+            let app_effects::SignIpaArtifact::AppBundle(signed_app) = artifact else {
+                let _ = view.update(cx, |view, cx| {
+                    view.sideload_operation = SideloadOperation::Failed {
+                        message: "Signing unexpectedly produced an IPA for sideloading."
+                            .to_string(),
+                    };
+                    cx.notify();
+                });
+                return;
+            };
+
+            let device = selected_device.expect("sideload device selected above");
+            let _ = view.update(cx, |view, cx| {
+                view.sideload_operation = SideloadOperation::Running {
+                    phase: SideloadPhase::Installing,
+                    progress: SIDELOAD_SIGNING_WEIGHT,
+                    detail: format!("Connecting to {}", device.name),
+                };
+                cx.notify();
+            });
+            let install_result = cx
+                .background_spawn(app_effects::install_app(
+                    device.udid.clone(),
+                    signed_app,
+                    move |event| {
+                        let _ = install_progress_sender.unbounded_send(event);
+                    },
+                ))
+                .await
+                .map_err(|error| error.user_message());
+
+            let _ = view.update(cx, |view, cx| {
+                view.sideload_operation = match install_result {
+                    Ok(()) => SideloadOperation::Finished {
+                        message: format!("Installed {app_name} on {}", device.name),
+                    },
+                    Err(message) => SideloadOperation::Failed { message },
+                };
+                cx.notify();
+            });
+        })
+        .detach();
+    }
+
+    fn fail_signing_and_open_developer_settings(
+        &mut self,
+        message: &str,
+        event: &ClickEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.sideload_operation = SideloadOperation::Failed {
+            message: message.to_string(),
+        };
+        self.open_team_settings(event, window, cx);
+    }
+
+    fn set_signing_progress(
+        &mut self,
+        event: app_effects::SignIpaProgress,
+        installs_after_signing: bool,
+    ) {
+        let SideloadOperation::Running {
+            phase: SideloadPhase::Signing,
+            progress: current_progress,
+            ..
+        } = &self.sideload_operation
+        else {
+            return;
+        };
+        let next_progress = if installs_after_signing {
+            event.progress() * SIDELOAD_SIGNING_WEIGHT
+        } else {
+            event.progress()
+        };
+        let progress = next_progress.max(*current_progress);
+        self.sideload_operation = SideloadOperation::Running {
+            phase: SideloadPhase::Signing,
+            progress,
+            detail: event.label(),
+        };
+    }
+
+    fn set_installing_progress(&mut self, event: app_effects::InstallAppProgress) {
+        let SideloadOperation::Running {
+            phase: SideloadPhase::Installing,
+            progress: current_progress,
+            ..
+        } = &self.sideload_operation
+        else {
+            return;
+        };
+        let next_progress =
+            SIDELOAD_SIGNING_WEIGHT + event.progress() * (1. - SIDELOAD_SIGNING_WEIGHT);
+        self.sideload_operation = SideloadOperation::Running {
+            phase: SideloadPhase::Installing,
+            progress: next_progress.max(*current_progress),
+            detail: event.label(),
+        };
     }
 
     fn refresh_devices_from_button(
@@ -544,6 +1043,7 @@ impl SideloaderView {
                 .await;
             let _ = view.update(cx, |view, cx| {
                 view.finish_device_refresh(generation, result);
+                view.sync_developer_settings_window(cx);
                 cx.notify();
             });
         })
@@ -1200,6 +1700,26 @@ impl SideloaderView {
             selected_app,
             self.selected_device(),
         );
+        let status_label = if matches!(self.sideload_operation, SideloadOperation::Failed { .. }) {
+            TextView::markdown("sideload-error-text", escape_markdown_text(&status_text))
+                .selectable(true)
+                .w(px(SIDELOAD_BUTTON_WIDTH))
+                .text_center()
+                .text_xs()
+                .line_height(px(16.))
+                .text_color(rgb(status_color))
+                .into_any_element()
+        } else {
+            div()
+                .w(px(SIDELOAD_BUTTON_WIDTH))
+                .text_center()
+                .text_xs()
+                .line_height(px(16.))
+                .text_color(rgb(status_color))
+                .whitespace_normal()
+                .child(status_text)
+                .into_any_element()
+        };
 
         div()
             .w(px(SIDELOAD_CONNECTOR_WIDTH))
@@ -1245,7 +1765,7 @@ impl SideloaderView {
             )
             .child(
                 div()
-                    .h(px(SIDELOAD_STATUS_HEIGHT))
+                    .min_h(px(SIDELOAD_STATUS_HEIGHT))
                     .flex()
                     .items_center()
                     .gap_2()
@@ -1270,15 +1790,7 @@ impl SideloaderView {
                                             .bg(rgb(status_color)),
                                     ),
                             )
-                            .child(
-                                div()
-                                    .w(px(SIDELOAD_BUTTON_WIDTH))
-                                    .text_center()
-                                    .text_xs()
-                                    .text_color(rgb(status_color))
-                                    .text_ellipsis()
-                                    .child(status_text),
-                            ),
+                            .child(status_label),
                     )
                     .child(div().flex_none().w_6()),
             )
@@ -1509,7 +2021,7 @@ fn sideload_top_label(operation: &SideloadOperation) -> &'static str {
     match operation {
         SideloadOperation::Idle => "Draft",
         SideloadOperation::Running { phase, .. } => sideload_phase_label(*phase),
-        SideloadOperation::Finished => "Done",
+        SideloadOperation::Finished { .. } => "Done",
         SideloadOperation::Failed { .. } => "Failed",
     }
 }
@@ -1518,7 +2030,7 @@ fn sideload_status_color(operation: &SideloadOperation) -> u32 {
     match operation {
         SideloadOperation::Idle => 0x53666d,
         SideloadOperation::Running { .. } => 0x173f45,
-        SideloadOperation::Finished => 0x1d6b45,
+        SideloadOperation::Finished { .. } => 0x1d6b45,
         SideloadOperation::Failed { .. } => 0x9a302b,
     }
 }
@@ -1526,7 +2038,7 @@ fn sideload_status_color(operation: &SideloadOperation) -> u32 {
 fn sideload_button_label(operation: &SideloadOperation) -> &'static str {
     match operation {
         SideloadOperation::Idle
-        | SideloadOperation::Finished
+        | SideloadOperation::Finished { .. }
         | SideloadOperation::Failed { .. } => "Sideload",
         SideloadOperation::Running { phase, .. } => sideload_phase_label(*phase),
     }
@@ -1550,7 +2062,15 @@ fn sideload_status_text(
                 "Ready to sign".to_string()
             }
         }
-        SideloadOperation::Running { phase, .. } => match phase {
+        SideloadOperation::Running {
+            phase,
+            progress,
+            detail,
+        } => {
+            if !detail.is_empty() {
+                format!("{detail} - {:.0}%", progress.clamp(0., 1.) * 100.)
+            } else {
+                match phase {
                     SideloadPhase::Signing => {
                         let app_name = app.map(|app| app.name().as_str()).unwrap_or("app");
                         format!("Signing {app_name}")
@@ -1561,17 +2081,43 @@ fn sideload_status_text(
                             .unwrap_or("device");
                         format!("Installing to {device_name}")
                     }
-        },
-        SideloadOperation::Finished => {
-            let device_name = device
-                .map(|device| device.name.as_str())
-                .unwrap_or("device");
-            format!("Installed on {device_name}")
                 }
+            }
+        }
+        SideloadOperation::Finished { message } => message.clone(),
         SideloadOperation::Failed { message } => message.clone(),
     }
 }
 
+fn escape_markdown_text(text: &str) -> String {
+    text.chars()
+        .flat_map(|character| {
+            if matches!(
+                character,
+                '\\' | '`'
+                    | '*'
+                    | '_'
+                    | '{'
+                    | '}'
+                    | '['
+                    | ']'
+                    | '<'
+                    | '>'
+                    | '#'
+                    | '+'
+                    | '-'
+                    | '.'
+                    | '!'
+                    | '|'
+            ) {
+                vec!['\\', character]
+            } else {
+                vec![character]
+            }
+        })
+        .collect()
+}
+
 fn sideload_phase_label(phase: SideloadPhase) -> &'static str {
     match phase {
         SideloadPhase::Signing => "Signing",
@@ -1587,6 +2133,43 @@ fn first_ipa_path(paths: &ExternalPaths) -> Option<PathBuf> {
         .cloned()
 }
 
+fn signed_ipa_destination(app_path: &str) -> (PathBuf, String) {
+    let path = Path::new(app_path);
+    let directory = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."))
+        .to_path_buf();
+    let stem = path
+        .file_stem()
+        .and_then(|value| value.to_str())
+        .filter(|value| !value.is_empty())
+        .unwrap_or("app");
+    (directory, format!("{stem}-signed.ipa"))
+}
+
+fn app_id_provisioning_prompt(plan: &app_effects::AppIdProvisioningPlan) -> (String, String) {
+    let count = plan.app_ids.len();
+    let message = format!("Create {count} App IDs before signing?");
+    let mut detail = format!(
+        "Super Sideloader needs to add these App IDs:\n\n{}",
+        plan.app_ids
+            .iter()
+            .map(|app_id| format!("- {} ({})", app_id.name, app_id.identifier))
+            .collect::<Vec<_>>()
+            .join("\n")
+    );
+    if let Some(available) = plan.available_quantity {
+        let remaining = plan.remaining_after_signing().unwrap_or_default();
+        detail.push_str(&format!(
+            "\n\nApple currently reports {available} App IDs remaining. {remaining} will remain after these are created."
+        ));
+    } else {
+        detail.push_str("\n\nApple did not report the remaining App ID quota.");
+    }
+    (message, detail)
+}
+
 fn paths_include_ipa(paths: &ExternalPaths) -> bool {
     first_ipa_path(paths).is_some()
 }

super-sideloader/src/ui/settings.rs

View file @ 65cd6c1

@@ -8,8 +8,8 @@ use crate::app::effects::{
 };
 use crate::app::models::{
     AccountOption, AdiBackendKind, AdiBackendOption, AdiProvisioningState, AppEntitlement,
-    AppIdOption, AppMetadataField, AppOption, DevelopmentCertificateOption, EntitlementValue,
-    MachineIdentity, SupportedDeviceFamily, TeamOption,
+    AppIdOption, AppMetadataField, AppOption, DeveloperDeviceOption, DevelopmentCertificateOption,
+    DeviceOption, EntitlementValue, MachineIdentity, SupportedDeviceFamily, TeamOption,
 };
 use crate::app::preferences::ThemePreference;
 use crate::app::state::SideloaderState;
@@ -62,6 +62,7 @@ struct TeamSettingsSnapshot {
     selected_certificate: usize,
     auto_app_id: bool,
     selected_app_id: usize,
+    selected_device: Option<DeviceOption>,
 }
 
 #[derive(Clone)]
@@ -108,6 +109,12 @@ pub(crate) struct SettingsWindow {
     app_detail_edit: Option<AppDetailEdit>,
     app_id_add_form: Option<AppIdAddForm>,
     app_id_edit_form: Option<AppIdEditForm>,
+    developer_device_add_form: Option<DeveloperDeviceAddForm>,
+    developer_devices: Vec<DeveloperDeviceOption>,
+    developer_devices_team_id: Option<String>,
+    developer_devices_loading: bool,
+    developer_devices_error: Option<SharedString>,
+    developer_devices_request_generation: u64,
     selected_entitlement: Option<usize>,
     entitlement_edit: Option<EntitlementEdit>,
     entitlement_type_picker_open: bool,
@@ -313,6 +320,13 @@ struct AppIdEditForm {
     capabilities: Vec<AppIdCapabilityEdit>,
 }
 
+#[derive(Clone)]
+struct DeveloperDeviceAddForm {
+    team_id: String,
+    name: Entity<InputState>,
+    udid: Entity<InputState>,
+}
+
 #[derive(Clone)]
 struct AppIdCapabilityEdit {
     key: String,
@@ -460,6 +474,12 @@ fn settings_task_is_current(
     current_generation == task_generation && current_mode == expected_mode
 }
 
+fn developer_device_form_defaults(selected_device: Option<&DeviceOption>) -> (String, String) {
+    selected_device
+        .map(|device| (device.name.clone(), device.udid.clone()))
+        .unwrap_or_default()
+}
+
 impl SettingsSnapshot {
     fn from_state(mode: &SettingsMode, state: &SideloaderState) -> Option<Self> {
         match mode {
@@ -483,6 +503,7 @@ impl SettingsSnapshot {
                     selected_certificate: state.selected_certificate,
                     auto_app_id: state.auto_app_id,
                     selected_app_id: state.selected_app_id,
+                    selected_device: state.selected_device().cloned(),
                 }))
             }
             SettingsMode::AppSettings { app_index } => {
@@ -520,7 +541,13 @@ impl SettingsWindow {
     ) -> Self {
         let focus_handle = cx.focus_handle();
         window.focus(&focus_handle, cx);
-        cx.defer_in(window, |_, _, cx| cx.notify());
+        cx.defer_in(window, |settings, window, cx| {
+            if matches!(settings.mode, SettingsMode::Team) {
+                settings.load_developer_devices(window, cx);
+            } else {
+                cx.notify();
+            }
+        });
         cx.observe_window_appearance(window, |settings, window, cx| {
             sync_window_theme(window, cx, settings.theme_preference);
             cx.notify();
@@ -545,6 +572,12 @@ impl SettingsWindow {
             app_detail_edit: None,
             app_id_add_form: None,
             app_id_edit_form: None,
+            developer_device_add_form: None,
+            developer_devices: Vec::new(),
+            developer_devices_team_id: None,
+            developer_devices_loading: false,
+            developer_devices_error: None,
+            developer_devices_request_generation: 0,
             selected_entitlement: None,
             entitlement_edit: None,
             entitlement_type_picker_open: false,
@@ -858,6 +891,13 @@ impl SettingsWindow {
         self.app_detail_edit = None;
         self.app_id_add_form = None;
         self.app_id_edit_form = None;
+        self.developer_device_add_form = None;
+        self.developer_devices.clear();
+        self.developer_devices_team_id = None;
+        self.developer_devices_loading = false;
+        self.developer_devices_error = None;
+        self.developer_devices_request_generation =
+            self.developer_devices_request_generation.wrapping_add(1);
         self.selected_entitlement = None;
         self.entitlement_edit = None;
         self.entitlement_type_picker_open = false;
@@ -871,6 +911,9 @@ impl SettingsWindow {
         window.set_window_title(title);
         window.activate_window();
         window.focus(&self.focus_handle, cx);
+        if matches!(self.mode, SettingsMode::Team) {
+            self.load_developer_devices(window, cx);
+        }
         cx.defer_in(window, |_, _, cx| cx.notify());
         cx.notify();
     }
@@ -1058,7 +1101,7 @@ impl SettingsWindow {
         &mut self,
         index: usize,
         _: &ClickEvent,
-        _: &mut Window,
+        window: &mut Window,
         cx: &mut Context<Self>,
     ) {
         let Some(snapshot) = self.team_snapshot(cx) else {
@@ -1074,7 +1117,323 @@ impl SettingsWindow {
         self.app_id_picker_open = false;
         self.app_id_add_form = None;
         self.app_id_edit_form = None;
-        let _ = self.dispatch_parent_action(SettingsParentAction::SelectTeam(index), cx);
+        self.developer_device_add_form = None;
+        if self
+            .dispatch_parent_action(SettingsParentAction::SelectTeam(index), cx)
+            .is_ok()
+        {
+            self.load_developer_devices(window, cx);
+        }
+        cx.notify();
+    }
+
+    fn current_developer_team_id(&self, cx: &mut Context<Self>) -> Option<String> {
+        let snapshot = self.team_snapshot(cx)?;
+        snapshot
+            .teams
+            .get(snapshot.selected_team)
+            .map(|team| team.identifier.clone())
+    }
+
+    fn accepts_developer_device_result(
+        &self,
+        task_generation: u64,
+        task_mode: &SettingsMode,
+        device_request_generation: u64,
+        team_id: &str,
+        cx: &mut Context<Self>,
+    ) -> bool {
+        self.accepts_task_result(task_generation, task_mode)
+            && self.developer_devices_request_generation == device_request_generation
+            && self.current_developer_team_id(cx).as_deref() == Some(team_id)
+    }
+
+    fn begin_developer_device_request(&mut self, team_id: &str) -> u64 {
+        self.developer_devices_request_generation =
+            self.developer_devices_request_generation.wrapping_add(1);
+        self.developer_devices_team_id = Some(team_id.to_string());
+        self.developer_devices_loading = true;
+        self.developer_devices_error = None;
+        self.developer_devices_request_generation
+    }
+
+    fn apply_developer_device_result(
+        &mut self,
+        result: Result<Vec<DeveloperDeviceOption>, AppError>,
+        team_id: String,
+        cx: &mut Context<Self>,
+    ) {
+        self.developer_devices_loading = false;
+        self.developer_devices_team_id = Some(team_id);
+        match result {
+            Ok(devices) => self.developer_devices = devices,
+            Err(error) => self.developer_devices_error = Some(error.user_message().into()),
+        }
+        cx.notify();
+    }
+
+    fn load_developer_devices(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if !matches!(self.mode, SettingsMode::Team) {
+            return;
+        }
+        let Some(team_id) = self.current_developer_team_id(cx) else {
+            self.developer_devices_request_generation =
+                self.developer_devices_request_generation.wrapping_add(1);
+            self.developer_devices.clear();
+            self.developer_devices_team_id = None;
+            self.developer_devices_loading = false;
+            self.developer_devices_error = None;
+            cx.notify();
+            return;
+        };
+        if self.developer_devices_loading
+            && self.developer_devices_team_id.as_deref() == Some(team_id.as_str())
+        {
+            return;
+        }
+        if self.developer_devices_loading {
+            self.developer_devices_request_generation =
+                self.developer_devices_request_generation.wrapping_add(1);
+            self.developer_devices_loading = false;
+            self.developer_devices.clear();
+            self.developer_devices_team_id = Some(team_id.clone());
+        }
+        let developer_context = match self.selected_developer_context(cx) {
+            Ok(context) => context,
+            Err(error) => {
+                self.developer_devices_request_generation =
+                    self.developer_devices_request_generation.wrapping_add(1);
+                self.developer_devices.clear();
+                self.developer_devices_team_id = Some(team_id);
+                self.developer_devices_loading = false;
+                self.developer_devices_error = Some(error.into());
+                cx.notify();
+                return;
+            }
+        };
+
+        let task_generation = self.task_generation();
+        let task_mode = self.task_mode();
+        let device_request_generation = self.begin_developer_device_request(&team_id);
+        self.developer_devices.clear();
+        let team_id_for_operation = team_id.clone();
+        cx.spawn_in(window, async move |settings, cx| {
+            let result = cx
+                .background_spawn(async move {
+                    app_effects::list_developer_devices(developer_context, team_id_for_operation)
+                        .await
+                })
+                .await;
+            let _ = settings.update_in(cx, |settings, _, cx| {
+                if !settings.accepts_developer_device_result(
+                    task_generation,
+                    &task_mode,
+                    device_request_generation,
+                    &team_id,
+                    cx,
+                ) {
+                    return;
+                }
+                settings.apply_developer_device_result(result, team_id, cx);
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+
+    fn set_developer_device_add_popover(
+        &mut self,
+        open: bool,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        window.focus(&self.focus_handle, cx);
+        if self.developer_devices_loading || self.team_refreshing {
+            return;
+        }
+        if !open {
+            self.developer_device_add_form = None;
+            cx.notify();
+            return;
+        }
+        let selected_device = self
+            .team_snapshot(cx)
+            .and_then(|snapshot| snapshot.selected_device);
+        let Some(team_id) = self.current_developer_team_id(cx) else {
+            self.developer_devices_error = Some("No developer team is selected.".into());
+            cx.notify();
+            return;
+        };
+        let (default_name, default_udid) = developer_device_form_defaults(selected_device.as_ref());
+        let name = cx.new(|cx| {
+            InputState::new(window, cx)
+                .default_value(default_name)
+                .placeholder("Development iPhone")
+                .clean_on_escape()
+        });
+        let udid = cx.new(|cx| {
+            InputState::new(window, cx)
+                .default_value(default_udid)
+                .placeholder("0000000000000000000000000000000000000000")
+                .clean_on_escape()
+        });
+        self.developer_device_add_form = Some(DeveloperDeviceAddForm {
+            team_id,
+            name: name.clone(),
+            udid,
+        });
+        self.developer_devices_error = None;
+        name.update(cx, |name, cx| name.focus(window, cx));
+        cx.notify();
+    }
+
+    fn cancel_developer_device_add(
+        &mut self,
+        _: &ClickEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        window.focus(&self.focus_handle, cx);
+        self.developer_device_add_form = None;
+        cx.notify();
+    }
+
+    fn submit_developer_device_add(
+        &mut self,
+        _: &ClickEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        window.focus(&self.focus_handle, cx);
+        if self.developer_devices_loading || self.team_refreshing {
+            return;
+        }
+        let Some(form) = self.developer_device_add_form.clone() else {
+            return;
+        };
+        if self.current_developer_team_id(cx).as_deref() != Some(form.team_id.as_str()) {
+            self.developer_device_add_form = None;
+            self.developer_devices_error =
+                Some("The selected developer team changed. Add the device again.".into());
+            cx.notify();
+            return;
+        }
+        let name = form.name.read(cx).value().trim().to_string();
+        let udid = form.udid.read(cx).value().trim().to_string();
+        if name.is_empty() {
+            self.developer_devices_error = Some("Enter a device name.".into());
+            cx.notify();
+            return;
+        }
+        if udid.is_empty() {
+            self.developer_devices_error = Some("Enter a device UDID.".into());
+            cx.notify();
+            return;
+        }
+        let developer_context = match self.selected_developer_context(cx) {
+            Ok(context) => context,
+            Err(error) => {
+                self.developer_devices_error = Some(error.into());
+                cx.notify();
+                return;
+            }
+        };
+
+        let team_id = form.team_id;
+        let task_generation = self.task_generation();
+        let task_mode = self.task_mode();
+        let device_request_generation = self.begin_developer_device_request(&team_id);
+        self.developer_device_add_form = None;
+        let team_id_for_operation = team_id.clone();
+        cx.spawn_in(window, async move |settings, cx| {
+            let result = cx
+                .background_spawn(async move {
+                    app_effects::add_developer_device(
+                        developer_context,
+                        team_id_for_operation,
+                        name,
+                        udid,
+                    )
+                    .await
+                })
+                .await;
+            let _ = settings.update_in(cx, |settings, _, cx| {
+                if !settings.accepts_developer_device_result(
+                    task_generation,
+                    &task_mode,
+                    device_request_generation,
+                    &team_id,
+                    cx,
+                ) {
+                    return;
+                }
+                settings.apply_developer_device_result(result, team_id, cx);
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+
+    fn remove_developer_device(
+        &mut self,
+        device_id: String,
+        _: &ClickEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        window.focus(&self.focus_handle, cx);
+        if self.developer_devices_loading || self.team_refreshing {
+            return;
+        }
+        let Some(team_id) = self.current_developer_team_id(cx) else {
+            self.developer_devices_error = Some("No developer team is selected.".into());
+            cx.notify();
+            return;
+        };
+        if device_id.trim().is_empty() {
+            self.developer_devices_error =
+                Some("The selected device has no portal identifier.".into());
+            cx.notify();
+            return;
+        }
+        let developer_context = match self.selected_developer_context(cx) {
+            Ok(context) => context,
+            Err(error) => {
+                self.developer_devices_error = Some(error.into());
+                cx.notify();
+                return;
+            }
+        };
+
+        let task_generation = self.task_generation();
+        let task_mode = self.task_mode();
+        let device_request_generation = self.begin_developer_device_request(&team_id);
+        let team_id_for_operation = team_id.clone();
+        cx.spawn_in(window, async move |settings, cx| {
+            let result = cx
+                .background_spawn(async move {
+                    app_effects::delete_developer_device(
+                        developer_context,
+                        team_id_for_operation,
+                        device_id,
+                    )
+                    .await
+                })
+                .await;
+            let _ = settings.update_in(cx, |settings, _, cx| {
+                if !settings.accepts_developer_device_result(
+                    task_generation,
+                    &task_mode,
+                    device_request_generation,
+                    &team_id,
+                    cx,
+                ) {
+                    return;
+                }
+                settings.apply_developer_device_result(result, team_id, cx);
+            });
+        })
+        .detach();
         cx.notify();
     }
 
@@ -1238,6 +1597,11 @@ impl SettingsWindow {
         self.app_id_picker_open = false;
         self.app_id_add_form = None;
         self.app_id_edit_form = None;
+        self.developer_device_add_form = None;
+        self.developer_devices_request_generation =
+            self.developer_devices_request_generation.wrapping_add(1);
+        self.developer_devices_loading = false;
+        self.developer_devices_error = None;
         self.team_refreshing = true;
         self.team_refresh_error = None;
         self.certificate_error = None;
@@ -3062,6 +3426,7 @@ mod tests {
                 "16.0",
                 vec![SupportedDeviceFamily::IPhone],
             ),
+            nested_bundles: Vec::new(),
             path: format!("/tmp/{name}.ipa"),
             icon_path: None,
             icon_override_path: None,
@@ -3092,6 +3457,7 @@ mod tests {
                 serial_number: "SERIAL".to_string(),
                 machine_name: "Mac".to_string(),
                 private_key_available: true,
+                certificate_fingerprint: Some("certificate-fingerprint".to_string()),
                 public_key_fingerprint: Some("fingerprint".to_string()),
             }],
         }
@@ -3166,6 +3532,26 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn developer_device_form_uses_selected_device_defaults() {
+        let device = DeviceOption {
+            name: "Development iPhone".to_string(),
+            model: "iPhone".to_string(),
+            os: "18.0".to_string(),
+            udid: "00008110-001234567890001E".to_string(),
+            connection: "USB".to_string(),
+        };
+
+        assert_eq!(
+            developer_device_form_defaults(Some(&device)),
+            (device.name.clone(), device.udid.clone())
+        );
+        assert_eq!(
+            developer_device_form_defaults(None),
+            (String::new(), String::new())
+        );
+    }
+
     #[test]
     fn settings_snapshots_are_derived_from_latest_parent_state() {
         let mut state = sample_state();
@@ -3208,7 +3594,7 @@ impl Render for SettingsWindow {
         let theme_preference = self.theme_preference(cx);
         sync_window_theme(window, cx, theme_preference);
 
-        if self.adi_operation.is_some() || self.team_refreshing {
+        if self.adi_operation.is_some() || self.team_refreshing || self.developer_devices_loading {
             self.spinner_turns = (self.spinner_turns + 0.035) % 1.;
             window.request_animation_frame();
         } else {
@@ -3231,6 +3617,10 @@ impl Render for SettingsWindow {
         let app_settings_error = self.app_settings_error.clone();
         let app_id_add_form = self.app_id_add_form.clone();
         let app_id_edit_form = self.app_id_edit_form.clone();
+        let developer_device_add_form = self.developer_device_add_form.clone();
+        let developer_devices = self.developer_devices.clone();
+        let developer_devices_loading = self.developer_devices_loading;
+        let developer_devices_error = self.developer_devices_error.clone();
         let selected_entitlement = self.selected_entitlement;
         let entitlement_edit = self.entitlement_edit.clone();
         let entitlement_type_picker_open = self.entitlement_type_picker_open;
@@ -3257,6 +3647,10 @@ impl Render for SettingsWindow {
                     app_id_picker_open,
                     app_id_add_form: app_id_add_form.as_ref(),
                     app_id_edit_form: app_id_edit_form.as_ref(),
+                    developer_devices: &developer_devices,
+                    developer_devices_loading,
+                    developer_device_add_form: developer_device_add_form.as_ref(),
+                    developer_devices_error,
                     team_refreshing,
                     team_refresh_error,
                     certificate_error,

super-sideloader/src/ui/settings/app_view.rs

View file @ 65cd6c1

@@ -70,11 +70,14 @@ pub(super) fn render(props: AppViewProps<'_>, cx: &mut Context<SettingsWindow>)
                                     app_detail_edit,
                                     cx,
                                 ))
-                                .child(app_detail_row(
+                                .child(app_detail_row_with_display_value(
                                     AppMetadataField::BundleId,
                                     app,
                                     true,
                                     app_detail_edit,
+                                    crate::app::entitlements::effective_bundle_identifier_for_app(
+                                        app, team_id,
+                                    ),
                                     cx,
                                 ))
                                 .child(app_detail_row(
@@ -210,9 +213,34 @@ fn app_detail_row(
     editable: bool,
     edit: Option<&AppDetailEdit>,
     cx: &mut Context<SettingsWindow>,
+) -> gpui::Div {
+    app_detail_row_inner(field, app, editable, edit, None, cx)
+}
+
+fn app_detail_row_with_display_value(
+    field: AppMetadataField,
+    app: &AppOption,
+    editable: bool,
+    edit: Option<&AppDetailEdit>,
+    display_value: String,
+    cx: &mut Context<SettingsWindow>,
+) -> gpui::Div {
+    app_detail_row_inner(field, app, editable, edit, Some(display_value), cx)
+}
+
+fn app_detail_row_inner(
+    field: AppMetadataField,
+    app: &AppOption,
+    editable: bool,
+    edit: Option<&AppDetailEdit>,
+    display_value: Option<String>,
+    cx: &mut Context<SettingsWindow>,
 ) -> gpui::Div {
     let is_editing = edit.is_some_and(|edit| edit.field() == field);
     let changed = app.field_is_overridden(field);
+    let effective_changed = display_value
+        .as_deref()
+        .is_some_and(|value| value != app.field_display_value(field));
 
     div()
         .min_w_0()
@@ -241,9 +269,13 @@ fn app_detail_row(
                     .min_w_0()
                     .flex_1()
                     .text_sm()
-                    .text_color(rgb(if changed { 0x173f45 } else { 0x405057 }))
+                    .text_color(rgb(if changed || effective_changed {
+                        0x173f45
+                    } else {
+                        0x405057
+                    }))
                     .text_ellipsis()
-                    .child(app.field_display_value(field))
+                    .child(display_value.unwrap_or_else(|| app.field_display_value(field)))
             },
         )
         .when(editable, |this| {

super-sideloader/src/ui/settings/developer_view.rs

View file @ 65cd6c1

@@ -14,6 +14,10 @@ pub(super) struct DeveloperViewProps<'a> {
     pub(super) app_id_picker_open: bool,
     pub(super) app_id_add_form: Option<&'a AppIdAddForm>,
     pub(super) app_id_edit_form: Option<&'a AppIdEditForm>,
+    pub(super) developer_devices: &'a [DeveloperDeviceOption],
+    pub(super) developer_devices_loading: bool,
+    pub(super) developer_device_add_form: Option<&'a DeveloperDeviceAddForm>,
+    pub(super) developer_devices_error: Option<SharedString>,
     pub(super) team_refreshing: bool,
     pub(super) team_refresh_error: Option<SharedString>,
     pub(super) certificate_error: Option<SharedString>,
@@ -34,6 +38,10 @@ pub(super) fn render(props: DeveloperViewProps<'_>, cx: &mut Context<SettingsWin
         app_id_picker_open,
         app_id_add_form,
         app_id_edit_form,
+        developer_devices,
+        developer_devices_loading,
+        developer_device_add_form,
+        developer_devices_error,
         team_refreshing,
         team_refresh_error,
         certificate_error,
@@ -69,6 +77,17 @@ pub(super) fn render(props: DeveloperViewProps<'_>, cx: &mut Context<SettingsWin
         },
         cx,
     ));
+    content = content.child(developer_device_section(
+        DeveloperDeviceSectionProps {
+            team,
+            devices: developer_devices,
+            loading: developer_devices_loading,
+            team_refreshing,
+            add_form: developer_device_add_form,
+            operation_error: developer_devices_error,
+        },
+        cx,
+    ));
     content = content.child(developer_logout_button(cx));
 
     settings_window_shell()
@@ -493,14 +512,11 @@ fn missing_private_key_warning(
                         .text_xs()
                         .font_weight(FontWeight::SEMIBOLD)
                         .text_color(rgb(0x7a5613))
-                        .child("Private key missing"),
+                        .child("Managed private key missing"),
                 )
-                .child(
-                    div()
-                        .text_xs()
-                        .text_color(rgb(0x7a6a50))
-                        .child("Import the matching private key to use this certificate."),
-                ),
+                .child(div().text_xs().text_color(rgb(0x7a6a50)).child(
+                    "Import the matching PEM key for Super Sideloader to use this certificate.",
+                )),
         )
         .child(
             surface_button("import-certificate-key")
@@ -1117,6 +1133,257 @@ fn app_id_icon_button(
         .child(icon_button_surface(icon, 0xebf1f0, 0xdfe8e6, 0x53666d))
 }
 
+struct DeveloperDeviceSectionProps<'a> {
+    team: Option<&'a TeamOption>,
+    devices: &'a [DeveloperDeviceOption],
+    loading: bool,
+    team_refreshing: bool,
+    add_form: Option<&'a DeveloperDeviceAddForm>,
+    operation_error: Option<SharedString>,
+}
+
+fn developer_device_section(
+    props: DeveloperDeviceSectionProps<'_>,
+    cx: &mut Context<SettingsWindow>,
+) -> gpui::Div {
+    let DeveloperDeviceSectionProps {
+        team,
+        devices,
+        loading,
+        team_refreshing,
+        add_form,
+        operation_error,
+    } = props;
+    let disabled = team.is_none() || loading || team_refreshing;
+
+    developer_settings_section(
+        "Devices",
+        "Registered development devices available to provisioning profiles.",
+        div()
+            .flex()
+            .flex_col()
+            .gap_3()
+            .child(
+                div()
+                    .flex()
+                    .items_center()
+                    .justify_between()
+                    .gap_3()
+                    .child(
+                        div()
+                            .text_xs()
+                            .text_color(rgb(0x6a7a81))
+                            .child(match devices.len() {
+                                0 => "No devices".to_string(),
+                                1 => "1 registered device".to_string(),
+                                count => format!("{count} registered devices"),
+                            }),
+                    )
+                    .child(developer_device_add_button(disabled, add_form, cx)),
+            )
+            .when(loading, |this| {
+                this.child(
+                    div()
+                        .rounded_md()
+                        .border_1()
+                        .border_color(rgb(0xd8e0df))
+                        .bg(rgb(0xf6f9f9))
+                        .p_3()
+                        .text_xs()
+                        .text_color(rgb(0x6a7a81))
+                        .child("Loading registered devices..."),
+                )
+            })
+            .when(!loading && team.is_some() && devices.is_empty(), |this| {
+                this.child(empty_state(
+                    "No development devices are registered for this team.",
+                ))
+            })
+            .when(!loading && team.is_some(), |this| {
+                this.children(
+                    devices
+                        .iter()
+                        .enumerate()
+                        .map(|(index, device)| developer_device_row(device, index, disabled, cx)),
+                )
+            })
+            .when(team.is_none(), |this| {
+                this.child(disabled_select_placeholder(
+                    "No developer team",
+                    "Load a developer team first.",
+                    "Device management unavailable",
+                ))
+            })
+            .when_some(operation_error, |this, error| {
+                this.child(refresh_error(error))
+            }),
+    )
+}
+
+fn developer_device_add_button(
+    disabled: bool,
+    form: Option<&DeveloperDeviceAddForm>,
+    cx: &mut Context<SettingsWindow>,
+) -> AnyElement {
+    let trigger = surface_button("begin-developer-device-add")
+        .h_7()
+        .child(action_button_surface(
+            "Add Device",
+            0xebf1f0,
+            0xdfe8e6,
+            0x53666d,
+            Some(lucide_icon_tinted("icons/plus.svg", 0x53666d)),
+        ));
+
+    if disabled {
+        return trigger.opacity(0.45).tab_stop(false).into_any_element();
+    }
+
+    floating_select_popover(
+        "developer-device-add-popover-scroll",
+        trigger.cursor_pointer(),
+        form.is_some(),
+        cx.listener(|this, open: &bool, window, cx| {
+            this.set_developer_device_add_popover(*open, window, cx);
+        }),
+        FloatingPopoverLayout {
+            width: 420.,
+            max_height: 260.,
+            offset_y: 36.,
+        },
+        developer_device_add_popover(form, cx),
+    )
+    .into_any_element()
+}
+
+fn developer_device_add_popover(
+    form: Option<&DeveloperDeviceAddForm>,
+    cx: &mut Context<SettingsWindow>,
+) -> impl IntoElement {
+    let Some(form) = form else {
+        return div()
+            .p_3()
+            .text_xs()
+            .text_color(rgb(0x6a7a81))
+            .child("Preparing device...");
+    };
+
+    div()
+        .p_3()
+        .flex()
+        .flex_col()
+        .gap_3()
+        .child(
+            div()
+                .flex()
+                .flex_col()
+                .gap_1()
+                .child(settings_label("Name"))
+                .child(Input::new(&form.name).small()),
+        )
+        .child(
+            div()
+                .flex()
+                .flex_col()
+                .gap_1()
+                .child(settings_label("UDID"))
+                .child(Input::new(&form.udid).small()),
+        )
+        .child(
+            div()
+                .flex()
+                .items_center()
+                .justify_end()
+                .gap_2()
+                .child(
+                    surface_button("cancel-developer-device-add")
+                        .h_7()
+                        .cursor_pointer()
+                        .on_click(cx.listener(SettingsWindow::cancel_developer_device_add))
+                        .child(action_button_surface(
+                            "Cancel",
+                            0xebf1f0,
+                            0xdfe8e6,
+                            0x53666d,
+                            None::<gpui::Div>,
+                        )),
+                )
+                .child(
+                    surface_button("confirm-developer-device-add")
+                        .h_7()
+                        .cursor_pointer()
+                        .on_click(cx.listener(SettingsWindow::submit_developer_device_add))
+                        .child(primary_action_button_surface(
+                            "Register",
+                            Some(lucide_icon_tinted("icons/plus.svg", 0xffffff)),
+                        )),
+                ),
+        )
+}
+
+fn developer_device_row(
+    device: &DeveloperDeviceOption,
+    index: usize,
+    disabled: bool,
+    cx: &mut Context<SettingsWindow>,
+) -> impl IntoElement {
+    let device_id = device.id.clone();
+    div()
+        .min_w_0()
+        .p_3()
+        .rounded_md()
+        .border_1()
+        .border_color(rgb(0xd8e0df))
+        .bg(rgb(0xffffff))
+        .flex()
+        .items_center()
+        .justify_between()
+        .gap_3()
+        .child(
+            div()
+                .min_w_0()
+                .flex_1()
+                .flex()
+                .flex_col()
+                .gap_0p5()
+                .child(
+                    div()
+                        .text_xs()
+                        .font_weight(FontWeight::SEMIBOLD)
+                        .text_color(rgb(0x24333a))
+                        .whitespace_normal()
+                        .child(device.name.clone()),
+                )
+                .child(
+                    div()
+                        .text_xs()
+                        .text_color(rgb(0x6a7a81))
+                        .whitespace_normal()
+                        .child(device.udid.clone()),
+                ),
+        )
+        .child(
+            surface_button(("remove-developer-device", index))
+                .flex_none()
+                .w_7()
+                .h_7()
+                .when(disabled, |this| this.opacity(0.45).tab_stop(false))
+                .when(!disabled, |this| {
+                    this.cursor_pointer().on_click(cx.listener(
+                        move |settings, event, window, cx| {
+                            settings.remove_developer_device(device_id.clone(), event, window, cx)
+                        },
+                    ))
+                })
+                .child(icon_button_surface(
+                    "icons/trash-2.svg",
+                    0xf4e9e7,
+                    0xfff7f6,
+                    0x7d3430,
+                )),
+        )
+}
+
 fn settings_app_id_row(app_id: &AppIdOption, index: usize, selected: bool) -> Button {
     select_option_button(
         ("app-id-row", index),


...	...	@@ -3544,7 +3544,9 @@ version = "0.1.64"
3544	3544	source = "registry+https://github.com/rust-lang/crates.io-index"
3545	3545	checksum = "48e95040e91503e7425835843e5e985ab1ea440db9b965972021e7b845c2a6ae"
3546	3546	dependencies = [
	3547	+ "async_zip",
3547	3548	"base64",
	3549	+ "chrono",
3548	3550	"futures",
3549	3551	"libc",
3550	3552	"plist",
...	...	@@ -7084,12 +7086,15 @@ dependencies = [
7084	7086	"adi",
7085	7087	"adid-proxy",
7086	7088	"android-coreadi",
	7089	+ "apple-codesign",
7087	7090	"async_zip",
7088	7091	"chrono",
7089	7092	"core-foundation 0.10.0",
	7093	+ "crc32fast",
7090	7094	"directories",
7091	7095	"dlopen2",
7092	7096	"env_logger",
	7097	+ "flate2",
7093	7098	"futures",
7094	7099	"futures-lite 2.6.1",
7095	7100	"gpui",
...	...	@@ -7097,20 +7102,24 @@ dependencies = [
7097	7102	"gpui_platform",
7098	7103	"grandslam",
7099	7104	"idevice",
	7105	+ "image",
7100	7106	"keyring",
7101	7107	"libc",
7102	7108	"library-coreadi",
7103	7109	"log",
7104	7110	"ouroboros",
	7111	+ "pem-rfc7468",
7105	7112	"plist",
7106	7113	"rand 0.10.2",
7107	7114	"reqwest",
7108	7115	"serde",
7109	7116	"sha1 0.11.0",
	7117	+ "tempfile",
7110	7118	"thiserror 2.0.18",
7111	7119	"tokio",
7112	7120	"toml 0.8.23",
7113	7121	"uuid",
	7122	+ "walkdir",
7114	7123	"xcode",
7115	7124	]
7116	7125

...	...	@@ -5,10 +5,17 @@ edition = "2024"
5	5
6	6	[dependencies]
7	7	plist.workspace = true
8		-
9		-tokio.workspace = true
10		-lief = "0.17"
	8	+thiserror.workspace = true
11	9	sha1.workspace = true
12	10	sha2.workspace = true
13		-futures = "0.3.31"
14		-log = "0.4.28"
	11	+byteorder = "1.5"
	12	+cms = { version = "0.2.3", features = ["builder", "rsa", "sha2"] }
	13	+const-oid = { version = "0.9.6", features = ["db"] }
	14	+der = { version = "0.7.10", features = ["alloc", "derive", "std"] }
	15	+memmap2 = "0.9"
	16	+pem-rfc7468 = { version = "0.7", features = ["alloc"] }
	17	+rayon = "1.12"
	18	+rsa = { version = "0.9.9", features = ["sha2"] }
	19	+sha2_010 = { package = "sha2", version = "0.10" }
	20	+spki = "0.7.3"
	21	+x509-cert = "0.2.5"

...	...	@@ -1,126 +1,216 @@
1		-use futures::future::join_all;
2		-use futures::{FutureExt, future::BoxFuture};
3		-use log::warn;
4		-use plist::{Dictionary, Value};
5		-use sha1::Digest as _;
6		-use sha2::Digest as _;
	1	+use apple_codesign::{
	2	+ BundleSigningSettings, CodeSignError, ProvisioningProfile, Result, RustCryptoCmsSigner,
	3	+ sign_bundle,
	4	+};
	5	+use std::collections::BTreeMap;
	6	+use std::ffi::OsString;
7	7	use std::fs;
8	8	use std::path::{Path, PathBuf};
9		-use tokio::task::{block_in_place, spawn_blocking};
10		-
11		-struct Bundle {
12		- path: PathBuf,
13		-}
14		-
15		-impl Bundle {
16		- async fn code_resources(&self) -> Dictionary {
17		- struct CodeResourceFile {
18		- path: PathBuf,
19		- sha1: Vec<u8>,
20		- sha256: Vec<u8>,
21		- }
22		-
23		- async fn hash_file(relative_path: PathBuf, path: PathBuf) -> CodeResourceFile {
24		- let file_data = fs::read(&path).unwrap(); // FIXME unwrap
25		- let file_data2 = file_data.clone();
26		- let sha1 = spawn_blocking(move \|\| sha1::Sha1::digest(&file_data)[..].into());
27		- let sha256 = spawn_blocking(move \|\| sha2::Sha256::digest(&file_data2)[..].into());
28		- CodeResourceFile {
29		- path: relative_path,
30		- sha1: sha1.await.unwrap(),
31		- sha256: sha256.await.unwrap(),
32		- }
33		- }
34		-
35		- fn resources_for_directory(
36		- root: &Path,
37		- directory: PathBuf,
38		- ) -> Vec<BoxFuture<'static, CodeResourceFile>> {
39		- let mut output = Vec::new();
40		- let mut subfolders = Vec::new();
41		- if let Ok(read_dir) = fs::read_dir(directory) {
42		- for entry in read_dir {
43		- if let Ok(entry) = entry {
44		- let metadata = entry.metadata().expect("metadata call failed");
45		- let path = entry.path();
46		- if metadata.is_file() {
47		- if let Ok(relative_path) = entry.path().strip_prefix(root) {
48		- // TODO check rules
49		- output.push(hash_file(relative_path.to_path_buf(), path).boxed());
50		- } else {
51		- warn!("Skipping {:?} as its prefix is not correct", entry.path());
52		- }
53		- } else if metadata.is_dir() {
54		- subfolders.push(resources_for_directory(root, path));
55		- }
	9	+
	10	+fn main() -> Result<()> {
	11	+ let Some(args) = CliArgs::parse()? else {
	12	+ print_usage();
	13	+ return Ok(());
	14	+ };
	15	+
	16	+ let mobileprovision = read_file(&args.mobileprovision)?;
	17	+ let profile = ProvisioningProfile::parse(&mobileprovision)?;
	18	+ let private_key = read_der_or_pem(&args.private_key, &["PRIVATE KEY", "RSA PRIVATE KEY"])?;
	19	+ let certificate = read_der_or_pem(&args.certificate, &["CERTIFICATE"])?;
	20	+ let mut certificate_chain =
	21	+ Vec::with_capacity(args.certificate_chain.len() + profile.certificate_chain_der().len());
	22	+
	23	+ for certificate in &args.certificate_chain {
	24	+ certificate_chain.push(read_der_or_pem(certificate, &["CERTIFICATE"])?);
	25	+ }
	26	+ certificate_chain.extend(profile.certificate_chain_der().iter().cloned());
	27	+
	28	+ let signer = RustCryptoCmsSigner::from_der(
	29	+ &private_key,
	30	+ &certificate,
	31	+ certificate_chain.iter().map(Vec::as_slice),
	32	+ )?;
	33	+
	34	+ let team_id = args
	35	+ .team_id
	36	+ .as_deref()
	37	+ .unwrap_or_else(\|\| profile.team_id())
	38	+ .to_string();
	39	+ let mut settings =
	40	+ BundleSigningSettings::new(team_id, profile.entitlements().clone(), Some(&signer));
	41	+ settings.embedded_mobileprovision = Some(&mobileprovision);
	42	+ let nested_profiles = args
	43	+ .profiles_by_bundle_id
	44	+ .iter()
	45	+ .map(\|(bundle_id, path)\| {
	46	+ let data = read_file(path)?;
	47	+ let profile = ProvisioningProfile::parse(&data)?;
	48	+ let entitlements = profile.entitlements().clone();
	49	+ Ok((bundle_id.clone(), data, entitlements))
	50	+ })
	51	+ .collect::<Result<Vec<_>>>()?;
	52	+ settings.embedded_mobileprovisions_by_bundle_id = nested_profiles
	53	+ .iter()
	54	+ .map(\|(bundle_id, data, _)\| (bundle_id.clone(), data.as_slice()))
	55	+ .collect::<BTreeMap<_, _>>();
	56	+ settings.entitlements_by_bundle_id = nested_profiles
	57	+ .iter()
	58	+ .map(\|(bundle_id, _, entitlements)\| (bundle_id.clone(), entitlements.clone()))
	59	+ .collect();
	60	+ if let Some(reservation) = args.cms_blob_reservation {
	61	+ settings.cms_blob_reservation = reservation;
	62	+ }
	63	+
	64	+ sign_bundle(args.bundle, &settings)
	65	+}
	66	+
	67	+#[derive(Debug)]
	68	+struct CliArgs {
	69	+ bundle: PathBuf,
	70	+ certificate: PathBuf,
	71	+ private_key: PathBuf,
	72	+ mobileprovision: PathBuf,
	73	+ certificate_chain: Vec<PathBuf>,
	74	+ profiles_by_bundle_id: Vec<(String, PathBuf)>,
	75	+ team_id: Option<String>,
	76	+ cms_blob_reservation: Option<usize>,
	77	+}
	78	+
	79	+impl CliArgs {
	80	+ fn parse() -> Result<Option<Self>> {
	81	+ let raw_args: Vec<OsString> = std::env::args_os().skip(1).collect();
	82	+ if raw_args.is_empty() \|\| raw_args.iter().any(\|arg\| arg == "-h" \|\| arg == "--help") {
	83	+ return Ok(None);
	84	+ }
	85	+
	86	+ let mut bundle = None;
	87	+ let mut certificate = None;
	88	+ let mut private_key = None;
	89	+ let mut mobileprovision = None;
	90	+ let mut certificate_chain = Vec::new();
	91	+ let mut profiles_by_bundle_id = Vec::new();
	92	+ let mut team_id = None;
	93	+ let mut cms_blob_reservation = None;
	94	+
	95	+ let mut args = raw_args.into_iter();
	96	+ while let Some(arg) = args.next() {
	97	+ match arg.to_string_lossy().as_ref() {
	98	+ "--bundle" \| "-b" => set_path_arg(&mut bundle, "--bundle", args.next())?,
	99	+ "--certificate" \| "--cert" \| "-c" => {
	100	+ set_path_arg(&mut certificate, "--certificate", args.next())?
	101	+ }
	102	+ "--private-key" \| "--key" \| "-k" => {
	103	+ set_path_arg(&mut private_key, "--private-key", args.next())?
	104	+ }
	105	+ "--mobileprovision" \| "--profile" \| "-m" => {
	106	+ set_path_arg(&mut mobileprovision, "--mobileprovision", args.next())?
	107	+ }
	108	+ "--chain" => certificate_chain.push(next_path_arg("--chain", args.next())?),
	109	+ "--profile-for" => profiles_by_bundle_id.push(next_profile_arg(args.next())?),
	110	+ "--team-id" => {
	111	+ team_id = Some(next_string_arg("--team-id", args.next())?);
	112	+ }
	113	+ "--cms-reservation" => {
	114	+ let value = next_string_arg("--cms-reservation", args.next())?;
	115	+ cms_blob_reservation = Some(value.parse().map_err(\|_\| {
	116	+ CodeSignError::Argument(format!(
	117	+ "--cms-reservation must be a byte count, got {value}"
	118	+ ))
	119	+ })?);
	120	+ }
	121	+ value if value.starts_with('-') => {
	122	+ return Err(CodeSignError::Argument(format!("unknown argument {value}")));
	123	+ }
	124	+ _ if bundle.is_none() => {
	125	+ bundle = Some(PathBuf::from(arg));
	126	+ }
	127	+ value => {
	128	+ return Err(CodeSignError::Argument(format!(
	129	+ "unexpected positional argument {value}"
	130	+ )));
	131	+ }
	132	+ }
	133	+ }
	134	+
	135	+ Ok(Some(Self {
	136	+ bundle: required_path(bundle, "--bundle")?,
	137	+ certificate: required_path(certificate, "--certificate")?,
	138	+ private_key: required_path(private_key, "--private-key")?,
	139	+ mobileprovision: required_path(mobileprovision, "--mobileprovision")?,
	140	+ certificate_chain,
	141	+ profiles_by_bundle_id,
	142	+ team_id,
	143	+ cms_blob_reservation,
	144	+ }))
	145	+ }
56	146	}
	147	+
	148	+fn next_profile_arg(value: Option<OsString>) -> Result<(String, PathBuf)> {
	149	+ let value = next_string_arg("--profile-for", value)?;
	150	+ let (bundle_id, path) = value.split_once('=').ok_or_else(\|\| {
	151	+ CodeSignError::Argument("--profile-for requires BUNDLE_IDENTIFIER=PROFILE_PATH".to_string())
	152	+ })?;
	153	+ if bundle_id.trim().is_empty() \|\| path.trim().is_empty() {
	154	+ return Err(CodeSignError::Argument(
	155	+ "--profile-for requires non-empty bundle identifier and path".to_string(),
	156	+ ));
57	157	}
	158	+ Ok((bundle_id.to_string(), PathBuf::from(path)))
58	159	}
59	160
60		- for subfolder in subfolders {
61		- let data = subfolder;
62		- output.extend(data);
	161	+fn set_path_arg(slot: &mut Option<PathBuf>, name: &str, value: Option<OsString>) -> Result<()> {
	162	+ if slot.is_some() {
	163	+ return Err(CodeSignError::Argument(format!(
	164	+ "{name} was provided twice"
	165	+ )));
63	166	}
64		- output
	167	+ *slot = Some(next_path_arg(name, value)?);
	168	+ Ok(())
65	169	}
66	170
67		- let path_buf = self.path.to_path_buf();
68		- let resources = resources_for_directory(&self.path, path_buf);
69		-
70		- let rules = Dictionary::new();
71		- let rules2 = Dictionary::new();
72		-
73		- let (files, files2) = {
74		- let mut files = Dictionary::new();
75		- let mut files2 = Dictionary::new();
76		-
77		- for res in resources {
78		- let CodeResourceFile { path, sha1, sha256 } = res.await;
79		-
80		- let path = path.to_string_lossy().into_owned();
81		-
82		- let sha1: Vec<u8> = sha1.into();
83		- let sha256: Vec<u8> = sha256.into();
84		-
85		- files.insert(path.clone(), Value::Data(sha1.clone()));
86		-
87		- let mut file2 = Dictionary::new();
88		- file2.insert("hash".to_string(), Value::Data(sha1));
89		- file2.insert("hash2".to_string(), Value::Data(sha256));
90		-
91		- files2.insert(path, Value::Dictionary(file2));
	171	+fn next_path_arg(name: &str, value: Option<OsString>) -> Result<PathBuf> {
	172	+ value
	173	+ .map(PathBuf::from)
	174	+ .ok_or_else(\|\| CodeSignError::Argument(format!("{name} requires a value")))
92	175	}
93	176
94		- (files, files2)
95		- };
96		-
97		- let code_resources = {
98		- let mut code_resources = Dictionary::new();
99		- code_resources.insert("files".to_string(), Value::Dictionary(files));
100		- code_resources.insert("files2".to_string(), Value::Dictionary(files2));
101		- code_resources.insert("rules".to_string(), Value::Dictionary(rules));
102		- code_resources.insert("rules2".to_string(), Value::Dictionary(rules2));
	177	+fn next_string_arg(name: &str, value: Option<OsString>) -> Result<String> {
	178	+ let value = value.ok_or_else(\|\| CodeSignError::Argument(format!("{name} requires a value")))?;
	179	+ value
	180	+ .into_string()
	181	+ .map_err(\|_\| CodeSignError::Argument(format!("{name} must be valid UTF-8")))
	182	+}
103	183
104		- code_resources
105		- };
	184	+fn required_path(value: Option<PathBuf>, name: &str) -> Result<PathBuf> {
	185	+ value.ok_or_else(\|\| CodeSignError::Argument(format!("missing required {name}")))
	186	+}
106	187
107		- code_resources
	188	+fn read_file(path: &Path) -> Result<Vec<u8>> {
	189	+ fs::read(path).map_err(\|source\| CodeSignError::Io {
	190	+ path: path.to_path_buf(),
	191	+ source,
	192	+ })
108	193	}
109	194
110		- async fn sign(&self) {
111		- let code_resources = self.code_resources().await;
	195	+fn read_der_or_pem(path: &Path, allowed_labels: &[&str]) -> Result<Vec<u8>> {
	196	+ let data = read_file(path)?;
	197	+ if !data.starts_with(b"-----BEGIN ") {
	198	+ return Ok(data);
	199	+ }
112	200
113		- let mut data = Vec::<u8>::new();
114		- plist::to_writer_xml(&mut data, &code_resources).expect("TODO: panic message");
115		- println!("{}", String::from_utf8(data).unwrap());
	201	+ let (label, der) = pem_rfc7468::decode_vec(&data)
	202	+ .map_err(\|err\| CodeSignError::Argument(format!("failed to decode PEM {path:?}: {err}")))?;
	203	+ if allowed_labels.contains(&label) {
	204	+ Ok(der)
	205	+ } else {
	206	+ Err(CodeSignError::Argument(format!(
	207	+ "unsupported PEM label {label:?} in {path:?}; expected one of {allowed_labels:?}"
	208	+ )))
116	209	}
117	210	}
118	211
119		-#[tokio::main]
120		-async fn main() {
121		- Bundle {
122		- path: "/home/dadoum/Téléchargements/YouTube.app/".into(),
123		- }
124		- .sign()
125		- .await;
	212	+fn print_usage() {
	213	+ eprintln!(
	214	+ "usage: apple-codesign --bundle Bundle.app --certificate signer.cer --private-key signer.key --mobileprovision profile.mobileprovision [--profile-for BUNDLE_IDENTIFIER=PROFILE_PATH ...] [--chain wwdr.cer ...] [--team-id TEAMID] [--cms-reservation BYTES]"
	215	+ );
126	216	}

...	...	@@ -6,28 +6,35 @@ edition = "2021"
6	6	[dependencies]
7	7	adi.workspace = true
8	8	android-coreadi.workspace = true
9		-async_zip = { version = "0.0.18", features = ["deflate", "tokio-fs"] }
	9	+apple-codesign = { path = "../apple-codesign-quick" }
	10	+async_zip = { version = "0.0.18", features = ["deflate", "tokio", "tokio-fs"] }
10	11	chrono = { version = "0.4.42", default-features = false, features = ["clock"] }
	12	+crc32fast = "1.5"
11	13	directories = "6.0.0"
12	14	env_logger = "0.11.8"
	15	+flate2 = "1.1"
13	16	futures-lite = "2.6.1"
14	17	grandslam.workspace = true
15	18	gpui = { package = "gpui", git = "https://github.com/gpui-ce/gpui-ce" }
16	19	gpui-component = { git = "https://github.com/longbridge/gpui-component", rev = "277f220a6196572116a8fd84fba6c36187094cab" }
17	20	gpui_platform = { git = "https://github.com/gpui-ce/gpui-ce", features = ["font-kit", "x11", "wayland", "runtime_shaders"] }
18		-idevice = { version = "0.1.64", features = ["usbmuxd"] }
	21	+idevice = { version = "0.1.64", features = ["afc", "installation_proxy", "usbmuxd"] }
	22	+image = { version = "0.25", default-features = false, features = ["png"] }
19	23	futures = "0.3"
20	24	keyring = { version = "3", features = ["apple-native", "windows-native", "sync-secret-service"] }
21	25	log = "0.4.33"
22	26	plist.workspace = true
	27	+pem-rfc7468 = { version = "0.7", features = ["alloc"] }
23	28	rand = "0.10.2"
24	29	reqwest = { workspace = true, features = ["blocking"] }
25	30	serde = { version = "1.0.228", features = ["derive"] }
26	31	sha1.workspace = true
27	32	thiserror.workspace = true
	33	+tempfile = "3.27"
28	34	toml = "0.8.23"
29		-tokio = { workspace = true, features = ["io-util", "net", "time"] }
	35	+tokio = { workspace = true, features = ["fs", "io-util", "net", "time"] }
30	36	uuid = { version = "1.19", features = ["v4"] }
	37	+walkdir = "2.5"
31	38	xcode.workspace = true
32	39
33	40	[target.'cfg(target_os = "macos")'.dependencies]

...	...	@@ -4,23 +4,56 @@ pub(crate) fn effective_entitlements_for_app(
4	4	app: &AppOption,
5	5	team_id: &str,
6	6	) -> Vec<AppEntitlement> {
	7	+ let bundle_id = effective_bundle_identifier_for_app(app, team_id);
7	8	effective_entitlements(
8	9	app.entitlements_source,
9	10	&app.entitlements,
10	11	app.entitlement_overrides.as_deref(),
11		- app.bundle_id(),
	12	+ &bundle_id,
12	13	team_id,
13	14	)
14	15	}
15	16
	17	+pub(crate) fn effective_bundle_identifier_for_app(app: &AppOption, team_id: &str) -> String {
	18	+ effective_bundle_identifier(app.bundle_id(), team_id)
	19	+}
	20	+
	21	+pub(crate) fn effective_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
	22	+ let team_id = team_id.trim();
	23	+ if team_id.is_empty()
	24	+ \|\| bundle_id
	25	+ .strip_suffix(team_id)
	26	+ .is_some_and(\|prefix\| prefix.ends_with('.'))
	27	+ {
	28	+ bundle_id.to_string()
	29	+ } else {
	30	+ format!("{bundle_id}.{team_id}")
	31	+ }
	32	+}
	33	+
	34	+pub(crate) fn effective_nested_bundle_identifier(
	35	+ original_root_bundle_id: &str,
	36	+ root_bundle_id: &str,
	37	+ nested_bundle_id: &str,
	38	+ team_id: &str,
	39	+) -> String {
	40	+ let effective_root = effective_bundle_identifier(root_bundle_id, team_id);
	41	+ nested_bundle_id
	42	+ .strip_prefix(original_root_bundle_id)
	43	+ .filter(\|suffix\| suffix.starts_with('.'))
	44	+ .map(\|suffix\| format!("{effective_root}{suffix}"))
	45	+ .unwrap_or_else(\|\| effective_bundle_identifier(nested_bundle_id, team_id))
	46	+}
	47	+
16	48	pub(crate) fn default_effective_entitlements_for_app(
17	49	app: &AppOption,
18	50	team_id: &str,
19	51	) -> Vec<AppEntitlement> {
	52	+ let bundle_id = effective_bundle_identifier_for_app(app, team_id);
20	53	default_effective_entitlements(
21	54	app.entitlements_source,
22	55	&app.entitlements,
23		- app.bundle_id(),
	56	+ &bundle_id,
24	57	team_id,
25	58	)
26	59	}
...	...	@@ -93,11 +126,8 @@ fn team_adjusted_entitlement(
93	126	let mut entitlement = entitlement.clone();
94	127	match entitlement.key.as_str() {
95	128	"application-identifier" => {
96		- entitlement.value = EntitlementValue::String(team_prefixed_identifier(
97		- &entitlement.value.edit_text(),
98		- bundle_id,
99		- team_id,
100		- ));
	129	+ entitlement.value =
	130	+ EntitlementValue::String(team_prefixed_bundle_identifier(bundle_id, team_id));
101	131	}
102	132	"com.apple.developer.team-identifier" => {
103	133	entitlement.value = EntitlementValue::String(team_id.to_string());
...	...	@@ -151,9 +181,13 @@ fn team_prefixed_identifier(value: &str, bundle_id: &str, team_id: &str) -> Stri
151	181	team_prefixed_bundle_identifier(suffix, team_id)
152	182	}
153	183
154		-fn team_prefixed_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
	184	+pub(crate) fn team_prefixed_bundle_identifier(bundle_id: &str, team_id: &str) -> String {
155	185	let team_id = team_id.trim();
156		- if team_id.is_empty() {
	186	+ if team_id.is_empty()
	187	+ \|\| bundle_id
	188	+ .strip_prefix(team_id)
	189	+ .is_some_and(\|suffix\| suffix.starts_with('.'))
	190	+ {
157	191	bundle_id.to_string()
158	192	} else {
159	193	format!("{team_id}.{bundle_id}")
...	...	@@ -190,6 +224,48 @@ mod tests {
190	224	assert!(!text.contains("TEAMID"));
191	225	}
192	226
	227	+ #[test]
	228	+ fn team_prefixed_bundle_identifier_is_idempotent() {
	229	+ assert_eq!(
	230	+ team_prefixed_bundle_identifier("com.example.app", "TEAM123"),
	231	+ "TEAM123.com.example.app"
	232	+ );
	233	+ assert_eq!(
	234	+ team_prefixed_bundle_identifier("TEAM123.com.example.app", "TEAM123"),
	235	+ "TEAM123.com.example.app"
	236	+ );
	237	+ }
	238	+
	239	+ #[test]
	240	+ fn effective_bundle_identifiers_match_sideloader_layout() {
	241	+ assert_eq!(
	242	+ effective_bundle_identifier("com.example.app", "TEAM123"),
	243	+ "com.example.app.TEAM123"
	244	+ );
	245	+ assert_eq!(
	246	+ effective_bundle_identifier("com.example.app.TEAM123", "TEAM123"),
	247	+ "com.example.app.TEAM123"
	248	+ );
	249	+ assert_eq!(
	250	+ effective_nested_bundle_identifier(
	251	+ "com.example.app",
	252	+ "com.example.app",
	253	+ "com.example.app.widget",
	254	+ "TEAM123"
	255	+ ),
	256	+ "com.example.app.TEAM123.widget"
	257	+ );
	258	+ assert_eq!(
	259	+ effective_nested_bundle_identifier(
	260	+ "com.example.app",
	261	+ "altcom.example.app",
	262	+ "com.example.app.SubApp.Extension",
	263	+ "TEAM123"
	264	+ ),
	265	+ "altcom.example.app.TEAM123.SubApp.Extension"
	266	+ );
	267	+ }
	268	+
193	269	#[test]
194	270	fn embedded_entitlements_are_adjusted_for_selected_team() {
195	271	let entitlements = default_effective_entitlements(
...	...	@@ -212,7 +288,7 @@ mod tests {
212	288
213	289	assert_eq!(
214	290	entitlements[0].value,
215		- EntitlementValue::String("TEAM123.com.old.app".into())
	291	+ EntitlementValue::String("TEAM123.com.example.app".into())
216	292	);
217	293	assert_eq!(
218	294	entitlements[1].value,
...	...	@@ -232,6 +308,7 @@ mod tests {
232	308	"16.0",
233	309	vec![SupportedDeviceFamily::IPhone],
234	310	),
	311	+ nested_bundles: Vec::new(),
235	312	path: "/tmp/Example.ipa".to_string(),
236	313	icon_path: None,
237	314	icon_override_path: None,
...	...	@@ -250,7 +327,7 @@ mod tests {
250	327	app.entitlements_source,
251	328	&app.entitlements,
252	329	app.entitlement_overrides.as_deref(),
253		- app.bundle_id(),
	330	+ "com.example.app.TEAM123",
254	331	"TEAM123",
255	332	)
256	333	);
...	...	@@ -259,9 +336,13 @@ mod tests {
259	336	default_effective_entitlements(
260	337	app.entitlements_source,
261	338	&app.entitlements,
262		- app.bundle_id(),
	339	+ "com.example.app.TEAM123",
263	340	"TEAM123",
264	341	)
265	342	);
	343	+ assert_eq!(
	344	+ effective_entitlements_for_app(&app, "TEAM123")[0].value,
	345	+ EntitlementValue::String("TEAM123.com.example.app.TEAM123".into())
	346	+ );
266	347	}
267	348	}

...	...	@@ -29,15 +29,23 @@ pub(crate) struct DevelopmentCertificateOption {
29	29	pub(crate) serial_number: String,
30	30	pub(crate) machine_name: String,
31	31	pub(crate) private_key_available: bool,
	32	+ pub(crate) certificate_fingerprint: Option<String>,
32	33	pub(crate) public_key_fingerprint: Option<String>,
33	34	}
34	35
	36	+#[derive(Clone, Debug, Eq, PartialEq)]
	37	+pub(crate) struct DeveloperDeviceOption {
	38	+ pub(crate) id: String,
	39	+ pub(crate) name: String,
	40	+ pub(crate) udid: String,
	41	+}
	42	+
35	43	impl DevelopmentCertificateOption {
36	44	pub(crate) fn private_key_status(&self) -> &'static str {
37	45	if self.private_key_available {
38		- "Private key available"
	46	+ "Managed private key available"
39	47	} else {
40		- "Private key missing"
	48	+ "Managed private key missing"
41	49	}
42	50	}
43	51
...	...	@@ -428,6 +436,7 @@ pub(crate) enum EntitlementsSource {
428	436	#[derive(Clone, Debug)]
429	437	pub(crate) struct AppOption {
430	438	pub(crate) metadata: AppMetadata,
	439	+ pub(crate) nested_bundles: Vec<NestedBundleOption>,
431	440	pub(crate) path: String,
432	441	pub(crate) icon_path: Option<String>,
433	442	pub(crate) icon_override_path: Option<String>,
...	...	@@ -437,6 +446,12 @@ pub(crate) struct AppOption {
437	446	pub(crate) patches: Vec<PatchOption>,
438	447	}
439	448
	449	+#[derive(Clone, Debug, Eq, PartialEq)]
	450	+pub(crate) struct NestedBundleOption {
	451	+ pub(crate) name: String,
	452	+ pub(crate) bundle_id: String,
	453	+}
	454	+
440	455	impl AppOption {
441	456	pub(crate) fn name(&self) -> &String {
442	457	self.metadata.name.value()
...	...	@@ -446,6 +461,10 @@ impl AppOption {
446	461	self.metadata.bundle_id.value()
447	462	}
448	463
	464	+ pub(crate) fn original_bundle_id(&self) -> &String {
	465	+ &self.metadata.bundle_id.default
	466	+ }
	467	+
449	468	pub(crate) fn version(&self) -> &String {
450	469	self.metadata.version.value()
451	470	}
...	...	@@ -626,9 +645,17 @@ pub(crate) enum SideloadPhase {
626	645	#[derive(Clone, Debug)]
627	646	pub(crate) enum SideloadOperation {
628	647	Idle,
629		- Running { phase: SideloadPhase, progress: f32 },
630		- Finished,
631		- Failed { message: String },
	648	+ Running {
	649	+ phase: SideloadPhase,
	650	+ progress: f32,
	651	+ detail: String,
	652	+ },
	653	+ Finished {
	654	+ message: String,
	655	+ },
	656	+ Failed {
	657	+ message: String,
	658	+ },
632	659	}
633	660
634	661	impl SideloadOperation {
...	...	@@ -640,7 +667,7 @@ impl SideloadOperation {
640	667	match self {
641	668	Self::Idle => 0.,
642	669	Self::Running { progress, .. } => progress.clamp(0., 1.),
643		- Self::Finished => 1.,
	670	+ Self::Finished { .. } => 1.,
644	671	Self::Failed { .. } => 0.,
645	672	}
646	673	}

...	...	@@ -311,6 +311,7 @@ mod tests {
311	311	"16.0",
312	312	vec![SupportedDeviceFamily::IPhone],
313	313	),
	314	+ nested_bundles: Vec::new(),
314	315	path: "/tmp/App.ipa".to_string(),
315	316	icon_path: None,
316	317	icon_override_path: None,

...	...	@@ -125,6 +125,7 @@ mod tests {
125	125	"16.0",
126	126	vec![SupportedDeviceFamily::IPhone],
127	127	),
	128	+ nested_bundles: Vec::new(),
128	129	path: path.to_string(),
129	130	icon_path: None,
130	131	icon_override_path: None,

...	...	@@ -579,6 +579,7 @@ mod tests {
579	579	serial_number: serial_number.to_string(),
580	580	machine_name: "Mac".to_string(),
581	581	private_key_available: true,
	582	+ certificate_fingerprint: Some(format!("certificate-fingerprint-{serial_number}")),
582	583	public_key_fingerprint: Some(format!("fingerprint-{serial_number}")),
583	584	}
584	585	}

...	...	@@ -1,13 +1,14 @@
1	1	use crate::app::models::{
2	2	AccountOption, AdiBackendAvailability, AdiBackendDetail, AdiBackendKind, AdiBackendOption,
3	3	AdiProvisioningState, AdiRepairAction, AppEntitlement, AppIdCapabilityOption, AppIdOption,
4		- AppMetadata, AppOption, DevelopmentCertificateOption, DeviceOption, EntitlementValue,
5		- EntitlementsSource, MachineIdentity, PatchOption, SupportedDeviceFamily, TeamOption,
	4	+ AppMetadata, AppOption, DeveloperDeviceOption, DevelopmentCertificateOption, DeviceOption,
	5	+ EntitlementValue, EntitlementsSource, MachineIdentity, NestedBundleOption, PatchOption,
	6	+ SupportedDeviceFamily, TeamOption,
6	7	};
7	8	use crate::domain::{
8	9	adi as domain_adi, device as domain_device, identity as domain_identity, ipa as domain_ipa,
9	10	DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate,
10		- DeveloperTeam,
	11	+ DeveloperDevice, DeveloperTeam,
11	12	};
12	13
13	14	pub(crate) fn account_option(account: DeveloperAccount) -> AccountOption {
...	...	@@ -93,6 +94,14 @@ pub(crate) fn app_option(app: domain_ipa::IpaApp) -> AppOption {
93	94	.map(supported_device_family)
94	95	.collect(),
95	96	),
	97	+ nested_bundles: app
	98	+ .nested_bundles
	99	+ .into_iter()
	100	+ .map(\|bundle\| NestedBundleOption {
	101	+ name: bundle.name,
	102	+ bundle_id: bundle.bundle_id,
	103	+ })
	104	+ .collect(),
96	105	path: app.path,
97	106	icon_path: app.icon_path,
98	107	icon_override_path: None,
...	...	@@ -114,6 +123,19 @@ pub(crate) fn device_options(devices: Vec<domain_device::Device>) -> Vec<DeviceO
114	123	devices.into_iter().map(device_option).collect()
115	124	}
116	125
	126	+pub(crate) fn developer_device_options(
	127	+ devices: Vec<DeveloperDevice>,
	128	+) -> Vec<DeveloperDeviceOption> {
	129	+ devices
	130	+ .into_iter()
	131	+ .map(\|device\| DeveloperDeviceOption {
	132	+ id: device.id,
	133	+ name: device.name,
	134	+ udid: device.udid,
	135	+ })
	136	+ .collect()
	137	+}
	138	+
117	139	pub(crate) fn domain_patch(patch: PatchOption) -> domain_ipa::Patch {
118	140	domain_ipa::Patch {
119	141	name: patch.name,
...	...	@@ -121,6 +143,35 @@ pub(crate) fn domain_patch(patch: PatchOption) -> domain_ipa::Patch {
121	143	}
122	144	}
123	145
	146	+pub(crate) fn domain_app_metadata(app: &AppOption) -> domain_ipa::AppMetadata {
	147	+ domain_ipa::AppMetadata {
	148	+ name: app.name().to_string(),
	149	+ bundle_id: app.bundle_id().to_string(),
	150	+ version: app.version().to_string(),
	151	+ build: app.build().to_string(),
	152	+ executable: app.metadata.executable.value().to_string(),
	153	+ minimum_os: app.metadata.minimum_os.value().to_string(),
	154	+ supported_devices: app
	155	+ .supported_devices()
	156	+ .iter()
	157	+ .copied()
	158	+ .map(domain_supported_device_family)
	159	+ .collect(),
	160	+ }
	161	+}
	162	+
	163	+pub(crate) fn domain_app_entitlements(
	164	+ entitlements: &[AppEntitlement],
	165	+) -> Vec<domain_ipa::AppEntitlement> {
	166	+ entitlements
	167	+ .iter()
	168	+ .map(\|entitlement\| domain_ipa::AppEntitlement {
	169	+ key: entitlement.key.clone(),
	170	+ value: domain_entitlement_value(&entitlement.value),
	171	+ })
	172	+ .collect()
	173	+}
	174	+
124	175	fn team_option(team: DeveloperTeam) -> TeamOption {
125	176	TeamOption {
126	177	name: team.name,
...	...	@@ -171,6 +222,7 @@ fn certificate_option(certificate: DeveloperCertificate) -> DevelopmentCertifica
171	222	serial_number: certificate.serial_number,
172	223	machine_name: certificate.machine_name,
173	224	private_key_available: certificate.private_key_available,
	225	+ certificate_fingerprint: certificate.certificate_fingerprint,
174	226	public_key_fingerprint: certificate.public_key_fingerprint,
175	227	}
176	228	}
...	...	@@ -230,6 +282,18 @@ fn supported_device_family(family: domain_ipa::SupportedDeviceFamily) -> Support
230	282	}
231	283	}
232	284
	285	+fn domain_supported_device_family(
	286	+ family: SupportedDeviceFamily,
	287	+) -> domain_ipa::SupportedDeviceFamily {
	288	+ match family {
	289	+ SupportedDeviceFamily::IPhone => domain_ipa::SupportedDeviceFamily::IPhone,
	290	+ SupportedDeviceFamily::IPad => domain_ipa::SupportedDeviceFamily::IPad,
	291	+ SupportedDeviceFamily::AppleTv => domain_ipa::SupportedDeviceFamily::AppleTv,
	292	+ SupportedDeviceFamily::AppleWatch => domain_ipa::SupportedDeviceFamily::AppleWatch,
	293	+ SupportedDeviceFamily::Mac => domain_ipa::SupportedDeviceFamily::Mac,
	294	+ }
	295	+}
	296	+
233	297	fn app_entitlement(entitlement: domain_ipa::AppEntitlement) -> AppEntitlement {
234	298	AppEntitlement {
235	299	key: entitlement.key,
...	...	@@ -259,6 +323,28 @@ fn entitlement_value(value: domain_ipa::EntitlementValue) -> EntitlementValue {
259	323	}
260	324	}
261	325
	326	+fn domain_entitlement_value(value: &EntitlementValue) -> domain_ipa::EntitlementValue {
	327	+ match value {
	328	+ EntitlementValue::String(value) => domain_ipa::EntitlementValue::String(value.clone()),
	329	+ EntitlementValue::Boolean(value) => domain_ipa::EntitlementValue::Boolean(*value),
	330	+ EntitlementValue::Integer(value) => domain_ipa::EntitlementValue::Integer(*value),
	331	+ EntitlementValue::Number(value) => domain_ipa::EntitlementValue::Number(*value),
	332	+ EntitlementValue::Array(values) => domain_ipa::EntitlementValue::Array(
	333	+ values.iter().map(domain_entitlement_value).collect(),
	334	+ ),
	335	+ EntitlementValue::Dictionary(values) => domain_ipa::EntitlementValue::Dictionary(
	336	+ values
	337	+ .iter()
	338	+ .map(\|(key, value)\| (key.clone(), domain_entitlement_value(value)))
	339	+ .collect(),
	340	+ ),
	341	+ EntitlementValue::Data(value) => domain_ipa::EntitlementValue::Data(value.clone()),
	342	+ EntitlementValue::Date(value) => domain_ipa::EntitlementValue::Date(value.clone()),
	343	+ EntitlementValue::Uid(value) => domain_ipa::EntitlementValue::Uid(*value),
	344	+ EntitlementValue::Unknown(value) => domain_ipa::EntitlementValue::Unknown(value.clone()),
	345	+ }
	346	+}
	347	+
262	348	fn entitlements_source(source: domain_ipa::EntitlementsSource) -> EntitlementsSource {
263	349	match source {
264	350	domain_ipa::EntitlementsSource::Embedded => EntitlementsSource::Embedded,
...	...	@@ -313,6 +399,7 @@ mod tests {
313	399	serial_number: "SERIAL".to_string(),
314	400	machine_name: "Mac".to_string(),
315	401	private_key_available: true,
	402	+ certificate_fingerprint: Some("certificate-fingerprint".to_string()),
316	403	public_key_fingerprint: Some("fingerprint".to_string()),
317	404	}],
318	405	}],
...	...	@@ -377,6 +464,19 @@ mod tests {
377	464	assert_eq!(options[0].connection, "USB");
378	465	}
379	466
	467	+ #[test]
	468	+ fn developer_device_maps_to_settings_option() {
	469	+ let options = developer_device_options(vec![DeveloperDevice {
	470	+ id: "portal-device-id".to_string(),
	471	+ name: "Development iPhone".to_string(),
	472	+ udid: "0000000000000000000000000000000000000000".to_string(),
	473	+ }]);
	474	+
	475	+ assert_eq!(options[0].id, "portal-device-id");
	476	+ assert_eq!(options[0].name, "Development iPhone");
	477	+ assert_eq!(options[0].udid.len(), 40);
	478	+ }
	479	+
380	480	#[test]
381	481	fn ipa_app_maps_to_ui_app_option_at_app_boundary() {
382	482	let option = app_option(domain_ipa::IpaApp {
...	...	@@ -392,6 +492,10 @@ mod tests {
392	492	domain_ipa::SupportedDeviceFamily::IPad,
393	493	],
394	494	},
	495	+ nested_bundles: vec![domain_ipa::NestedBundle {
	496	+ name: "Widget".to_string(),
	497	+ bundle_id: "com.example.app.Widget".to_string(),
	498	+ }],
395	499	path: "/tmp/Example.ipa".to_string(),
396	500	icon_path: Some("/tmp/icon.png".to_string()),
397	501	entitlements: vec![domain_ipa::AppEntitlement {
...	...	@@ -407,6 +511,7 @@ mod tests {
407	511
408	512	assert_eq!(option.name(), "Example");
409	513	assert_eq!(option.bundle_id(), "com.example.app");
	514	+ assert_eq!(option.nested_bundles[0].bundle_id, "com.example.app.Widget");
410	515	assert_eq!(
411	516	option.supported_devices(),
412	517	&[SupportedDeviceFamily::IPhone, SupportedDeviceFamily::IPad]

...	...	@@ -1,12 +1,14 @@
1	1	pub(crate) use crate::backend::developer::cache::load_cached_account_options;
2	2	pub(crate) use crate::backend::developer::repository::{
3		- add_developer_app_id, create_developer_certificate, delete_account_cache,
4		- delete_developer_app_id, developer_secondary_action_not_supported,
	3	+ add_developer_app_id, add_developer_device, create_developer_certificate, delete_account_cache,
	4	+ delete_developer_app_id, delete_developer_device, developer_secondary_action_not_supported,
5	5	download_developer_provisioning_profile, import_developer_certificate_private_key,
6		- login_developer_account, refresh_developer_account, revoke_developer_certificate,
7		- update_developer_app_id, DeveloperAccountRefreshRequest, DeveloperAppIdAddRequest,
8		- DeveloperAppIdCapabilityUpdate, DeveloperAppIdDeleteRequest, DeveloperAppIdUpdateRequest,
9		- DeveloperCertificateCreateRequest, DeveloperCertificatePrivateKeyImportRequest,
10		- DeveloperCertificateRevokeRequest, DeveloperLoginOutcome, DeveloperLoginRequest,
11		- DeveloperProvisioningProfileDownloadRequest, DownloadedProvisioningProfile,
	6	+ list_developer_devices, login_developer_account, refresh_developer_account,
	7	+ revoke_developer_certificate, update_developer_app_id, DeveloperAccountRefreshRequest,
	8	+ DeveloperAppIdAddRequest, DeveloperAppIdCapabilityUpdate, DeveloperAppIdDeleteRequest,
	9	+ DeveloperAppIdUpdateRequest, DeveloperCertificateCreateRequest,
	10	+ DeveloperCertificatePrivateKeyImportRequest, DeveloperCertificateRevokeRequest,
	11	+ DeveloperDeviceAddRequest, DeveloperDeviceDeleteRequest, DeveloperDeviceListRequest,
	12	+ DeveloperLoginOutcome, DeveloperLoginRequest, DeveloperProvisioningProfileDownloadRequest,
	13	+ DownloadedProvisioningProfile,
12	14	};

...	...	@@ -91,6 +91,8 @@ pub(crate) struct CachedDevelopmentCertificate {
91	91	pub(crate) machine_name: String,
92	92	pub(crate) private_key_available: bool,
93	93	#[serde(default, skip_serializing_if = "Option::is_none")]
	94	+ pub(crate) certificate_fingerprint: Option<String>,
	95	+ #[serde(default, skip_serializing_if = "Option::is_none")]
94	96	pub(crate) public_key_fingerprint: Option<String>,
95	97	}
96	98
...	...	@@ -199,6 +201,7 @@ impl From<CachedDevelopmentCertificate> for DeveloperCertificate {
199	201	serial_number: certificate.serial_number,
200	202	machine_name: certificate.machine_name,
201	203	private_key_available: certificate.private_key_available,
	204	+ certificate_fingerprint: certificate.certificate_fingerprint,
202	205	public_key_fingerprint: certificate.public_key_fingerprint,
203	206	}
204	207	}
...	...	@@ -440,6 +443,7 @@ mod tests {
440	443	serial_number: id.to_string(),
441	444	machine_name: "Machine".to_string(),
442	445	private_key_available: false,
	446	+ certificate_fingerprint: None,
443	447	public_key_fingerprint: None,
444	448	}],
445	449	}
...	...	@@ -471,4 +475,21 @@ mod tests {
471	475	assert_eq!(account.teams.len(), 2);
472	476	assert_eq!(account.teams[1].id, "TEAM2");
473	477	}
	478	+
	479	+ #[test]
	480	+ fn old_certificate_cache_entries_need_a_certificate_refresh() {
	481	+ let certificate: CachedDevelopmentCertificate = toml::from_str(
	482	+ r#"
	483	+id = "cert-id"
	484	+name = "Apple Development"
	485	+serial_number = "serial"
	486	+machine_name = "Mac"
	487	+private_key_available = true
	488	+public_key_fingerprint = "0123456789012345678901234567890123456789"
	489	+"#,
	490	+ )
	491	+ .unwrap();
	492	+
	493	+ assert_eq!(certificate.certificate_fingerprint, None);
	494	+ }
474	495	}

...	...	@@ -6,6 +6,9 @@ use std::path::{Path, PathBuf};
6	6	use std::process::{Command, Stdio};
7	7	use uuid::Uuid;
8	8
	9	+#[cfg(unix)]
	10	+use std::os::unix::fs::PermissionsExt;
	11	+
9	12	#[derive(Clone, Debug)]
10	13	pub(crate) struct GeneratedCertificateSigningRequest {
11	14	pub(crate) machine_id: String,
...	...	@@ -15,6 +18,11 @@ pub(crate) struct GeneratedCertificateSigningRequest {
15	18	pub(crate) private_key_pem: Vec<u8>,
16	19	}
17	20
	21	+pub(crate) struct AppManagedSigningMaterial {
	22	+ pub(crate) private_key_pem: Vec<u8>,
	23	+ pub(crate) certificate_der: Vec<u8>,
	24	+}
	25	+
18	26	pub(crate) fn generate_development_certificate_signing_request(
19	27	) -> BackendResult<GeneratedCertificateSigningRequest> {
20	28	let machine_id = Uuid::new_v4().to_string().to_uppercase();
...	...	@@ -124,29 +132,50 @@ pub(crate) fn app_managed_private_key_fingerprints() -> Vec<String> {
124	132	.collect()
125	133	}
126	134
127		-#[cfg(target_os = "macos")]
128		-pub(crate) fn local_code_signing_identity_fingerprints() -> Vec<String> {
129		- let output = match Command::new("security")
130		- .args(["find-identity", "-v", "-p", "codesigning"])
131		- .output()
132		- {
133		- Ok(output) if output.status.success() => output,
134		- _ => return Vec::new(),
135		- };
136		-
137		- String::from_utf8_lossy(&output.stdout)
138		- .split_whitespace()
139		- .filter_map(\|part\| {
140		- let fingerprint = part.trim();
141		- (fingerprint.len() == 40 && fingerprint.bytes().all(\|byte\| byte.is_ascii_hexdigit()))
142		- .then(\|\| fingerprint.to_ascii_uppercase())
	135	+pub(crate) fn save_app_managed_certificate(
	136	+ fingerprint: &str,
	137	+ certificate_der: &[u8],
	138	+) -> BackendResult<()> {
	139	+ let certificates_dir = signing_certificates_dir()?;
	140	+ fs::create_dir_all(&certificates_dir).map_err(\|source\| BackendError::Io {
	141	+ action: "Create signing certificate folder",
	142	+ path: certificates_dir.clone(),
	143	+ source,
	144	+ })?;
	145	+ let certificate_path = certificates_dir.join(format!("{}.der", safe_fingerprint(fingerprint)?));
	146	+ fs::write(&certificate_path, certificate_der).map_err(\|source\| BackendError::Io {
	147	+ action: "Save signing certificate",
	148	+ path: certificate_path,
	149	+ source,
143	150	})
144		- .collect()
145	151	}
146	152
147		-#[cfg(not(target_os = "macos"))]
148		-pub(crate) fn local_code_signing_identity_fingerprints() -> Vec<String> {
149		- Vec::new()
	153	+pub(crate) fn load_app_managed_signing_material(
	154	+ certificate_fingerprint: &str,
	155	+ public_key_fingerprint: &str,
	156	+) -> BackendResult<AppManagedSigningMaterial> {
	157	+ let certificate_path = signing_certificates_dir()?.join(format!(
	158	+ "{}.der",
	159	+ safe_fingerprint(certificate_fingerprint)?
	160	+ ));
	161	+ let certificate_der = read_signing_resource(
	162	+ &certificate_path,
	163	+ "Read signing certificate",
	164	+ "The selected certificate data is not cached. Refresh Developer Settings, then try signing again.",
	165	+ )?;
	166	+
	167	+ let private_key_path =
	168	+ certificate_keys_dir()?.join(format!("{}.pem", safe_fingerprint(public_key_fingerprint)?));
	169	+ let private_key_pem = read_signing_resource(
	170	+ &private_key_path,
	171	+ "Read certificate private key",
	172	+ "The selected certificate has no Super Sideloader managed private key. Create a certificate or import its matching PEM key in Developer Settings.",
	173	+ )?;
	174	+
	175	+ Ok(AppManagedSigningMaterial {
	176	+ private_key_pem,
	177	+ certificate_der,
	178	+ })
150	179	}
151	180
152	181	fn public_key_der_from_private_key(key_path: &Path) -> BackendResult<Vec<u8>> {
...	...	@@ -205,14 +234,60 @@ pub(crate) fn save_app_managed_private_key(
205	234	path: keys_dir.clone(),
206	235	source,
207	236	})?;
208		- let key_path = keys_dir.join(format!("{fingerprint}.pem"));
	237	+ let key_path = keys_dir.join(format!("{}.pem", safe_fingerprint(fingerprint)?));
209	238	fs::write(&key_path, private_key_pem).map_err(\|source\| BackendError::Io {
210	239	action: "Save certificate private key",
211		- path: key_path,
	240	+ path: key_path.clone(),
212	241	source,
	242	+ })?;
	243	+ secure_private_key_file(&key_path)
	244	+}
	245	+
	246	+#[cfg(unix)]
	247	+fn secure_private_key_file(path: &Path) -> BackendResult<()> {
	248	+ fs::set_permissions(path, fs::Permissions::from_mode(0o600)).map_err(\|source\| {
	249	+ BackendError::Io {
	250	+ action: "Secure certificate private key",
	251	+ path: path.to_path_buf(),
	252	+ source,
	253	+ }
	254	+ })
	255	+}
	256	+
	257	+#[cfg(not(unix))]
	258	+fn secure_private_key_file(_: &Path) -> BackendResult<()> {
	259	+ Ok(())
	260	+}
	261	+
	262	+fn read_signing_resource(
	263	+ path: &Path,
	264	+ action: &'static str,
	265	+ missing_message: &str,
	266	+) -> BackendResult<Vec<u8>> {
	267	+ fs::read(path).map_err(\|source\| {
	268	+ if source.kind() == std::io::ErrorKind::NotFound {
	269	+ BackendError::Message(missing_message.to_string())
	270	+ } else {
	271	+ BackendError::Io {
	272	+ action,
	273	+ path: path.to_path_buf(),
	274	+ source,
	275	+ }
	276	+ }
213	277	})
214	278	}
215	279
	280	+fn safe_fingerprint(fingerprint: &str) -> BackendResult<String> {
	281	+ let fingerprint = fingerprint.trim().to_ascii_uppercase();
	282	+ if fingerprint.len() == 40 && fingerprint.bytes().all(\|byte\| byte.is_ascii_hexdigit()) {
	283	+ Ok(fingerprint)
	284	+ } else {
	285	+ Err(BackendError::Cache(
	286	+ "Signing certificate cache contains an invalid fingerprint.".to_string(),
	287	+ ))
	288	+ }
	289	+}
	290	+
216	291	fn certificate_keys_dir() -> BackendResult<PathBuf> {
217	292	app_data_dir()
218	293	.map(\|path\| path.join("certificates").join("keys"))
...	...	@@ -221,6 +296,14 @@ fn certificate_keys_dir() -> BackendResult<PathBuf> {
221	296	})
222	297	}
223	298
	299	+fn signing_certificates_dir() -> BackendResult<PathBuf> {
	300	+ app_data_dir()
	301	+ .map(\|path\| path.join("certificates").join("certificates"))
	302	+ .ok_or_else(\|\| {
	303	+ BackendError::Unsupported("The application data folder is not available.".to_string())
	304	+ })
	305	+}
	306	+
224	307	fn certificate_temp_dir() -> BackendResult<PathBuf> {
225	308	app_data_dir()
226	309	.map(\|path\| path.join("certificates").join("tmp"))

...	...	@@ -1,12 +1,43 @@
1	1	use crate::backend::{BackendError, BackendResult};
2	2	use grandslam::{AuthToken, Token};
3	3	use serde::{Deserialize, Serialize};
	4	+use std::collections::HashMap;
	5	+use std::sync::{Mutex, MutexGuard, OnceLock};
4	6	use std::time::{SystemTime, UNIX_EPOCH};
5	7
6	8	const KEYCHAIN_SESSION_VERSION: u32 = 1;
7	9	const KEYRING_SERVICE: &str = "com.Dadoum.Super-Sideloader";
8	10	const TOKEN_EXPIRY_GRACE_MILLIS: u64 = 5 * 60 * 1000;
9	11
	12	+type KeychainResult<T> = Result<T, String>;
	13	+type SessionCache = HashMap<String, CachedKeychainLookup>;
	14	+type SessionCacheGuard = MutexGuard<'static, SessionCache>;
	15	+
	16	+static SESSION_CACHE: OnceLock<Mutex<SessionCache>> = OnceLock::new();
	17	+
	18	+#[derive(Clone, Debug)]
	19	+struct CachedKeychainSession {
	20	+ encoded_contents: String,
	21	+ session: DeveloperAccountKeychainSession,
	22	+}
	23	+
	24	+#[derive(Clone, Debug)]
	25	+enum CachedKeychainLookup {
	26	+ Session(CachedKeychainSession),
	27	+ Missing,
	28	+ Failed(String),
	29	+}
	30	+
	31	+impl CachedKeychainLookup {
	32	+ fn result(&self) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
	33	+ match self {
	34	+ Self::Session(cached) => Ok(Some(cached.session.clone())),
	35	+ Self::Missing => Ok(None),
	36	+ Self::Failed(error) => Err(BackendError::Keychain(error.clone())),
	37	+ }
	38	+ }
	39	+}
	40	+
10	41	#[derive(Clone, Debug, Deserialize, Serialize)]
11	42	pub(crate) struct DeveloperAccountKeychainSession {
12	43	pub(crate) version: u32,
...	...	@@ -34,44 +65,83 @@ pub(crate) fn save_keychain_session(
34	65	account_id: &str,
35	66	session: &DeveloperAccountKeychainSession,
36	67	) -> BackendResult<()> {
37		- let contents = toml::to_string(session).map_err(\|error\| {
38		- BackendError::Keychain(format!(
39		- "Failed to encode account keychain payload: {error}"
40		- ))
41		- })?;
42		- keyring_entry(account_id)?
	68	+ let contents = encode_keychain_session(session).map_err(BackendError::Keychain)?;
	69	+ let mut cache = lock_session_cache()?;
	70	+ if matches!(
	71	+ cache.get(account_id),
	72	+ Some(CachedKeychainLookup::Session(cached))
	73	+ if cached.encoded_contents == contents
	74	+ ) {
	75	+ return Ok(());
	76	+ }
	77	+
	78	+ keyring_entry(account_id)
	79	+ .map_err(BackendError::Keychain)?
43	80	.set_password(&contents)
44	81	.map_err(\|error\| {
45	82	BackendError::Keychain(format!(
46	83	"Failed to save account session to the system keychain: {error}"
47	84	))
48		- })
	85	+ })?;
	86	+ cache_keychain_session_locked(&mut cache, account_id, session.clone(), contents);
	87	+ Ok(())
49	88	}
50	89
51	90	pub(crate) fn load_keychain_session(
52	91	account_id: &str,
53	92	) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
54		- let contents = match keyring_entry(account_id)?.get_password() {
55		- Ok(contents) => contents,
56		- Err(keyring::Error::NoEntry) => return Ok(None),
57		- Err(error) => {
58		- return Err(BackendError::Keychain(format!(
	93	+ load_keychain_session_once(account_id, \|\| {
	94	+ let entry = keyring_entry(account_id)?;
	95	+ match entry.get_password() {
	96	+ Ok(contents) => Ok(Some(contents)),
	97	+ Err(keyring::Error::NoEntry) => Ok(None),
	98	+ Err(error) => Err(format!(
59	99	"Failed to read account session from the system keychain: {error}"
60		- )));
	100	+ )),
	101	+ }
	102	+ })
61	103	}
	104	+
	105	+fn load_keychain_session_once(
	106	+ account_id: &str,
	107	+ read: impl FnOnce() -> KeychainResult<Option<String>>,
	108	+) -> BackendResult<Option<DeveloperAccountKeychainSession>> {
	109	+ let mut cache = lock_session_cache()?;
	110	+ if let Some(cached) = cache.get(account_id) {
	111	+ return cached.result();
	112	+ }
	113	+
	114	+ let lookup = match read() {
	115	+ Ok(Some(contents)) => match decode_keychain_session(&contents) {
	116	+ Ok(session) => CachedKeychainLookup::Session(session),
	117	+ Err(error) => CachedKeychainLookup::Failed(error),
	118	+ },
	119	+ Ok(None) => CachedKeychainLookup::Missing,
	120	+ Err(error) => CachedKeychainLookup::Failed(error),
62	121	};
63		- let mut session: DeveloperAccountKeychainSession =
64		- toml::from_str(&contents).map_err(\|error\| {
65		- BackendError::Keychain(format!(
66		- "Failed to decode account keychain payload: {error}"
67		- ))
68		- })?;
69		- session.version = KEYCHAIN_SESSION_VERSION;
70		- Ok(Some(session))
	122	+ let result = lookup.result();
	123	+ cache.insert(account_id.to_string(), lookup);
	124	+ result
	125	+}
	126	+
	127	+pub(crate) fn cache_keychain_session(
	128	+ account_id: &str,
	129	+ session: &DeveloperAccountKeychainSession,
	130	+) -> BackendResult<()> {
	131	+ let contents = encode_keychain_session(session).map_err(BackendError::Keychain)?;
	132	+ let mut cache = lock_session_cache()?;
	133	+ cache_keychain_session_locked(&mut cache, account_id, session.clone(), contents);
	134	+ Ok(())
71	135	}
72	136
73	137	pub(crate) fn delete_keychain_session(account_id: &str) -> BackendResult<()> {
74		- match keyring_entry(account_id)?.delete_credential() {
	138	+ let mut cache = lock_session_cache()?;
	139	+ cache.remove(account_id);
	140	+
	141	+ match keyring_entry(account_id)
	142	+ .map_err(BackendError::Keychain)?
	143	+ .delete_credential()
	144	+ {
75	145	Ok(()) \| Err(keyring::Error::NoEntry) => Ok(()),
76	146	Err(error) => Err(BackendError::Keychain(format!(
77	147	"Failed to remove account session from the system keychain: {error}"
...	...	@@ -103,15 +173,86 @@ pub(crate) fn current_epoch_millis() -> u64 {
103	173	.unwrap_or(0)
104	174	}
105	175
106		-fn keyring_entry(account_id: &str) -> BackendResult<keyring::Entry> {
107		- keyring::Entry::new(keyring_service(), &keyring_account_name(account_id)).map_err(\|error\| {
108		- BackendError::Keychain(format!("Failed to access the system keychain: {error}"))
	176	+fn keyring_entry(account_id: &str) -> KeychainResult<keyring::Entry> {
	177	+ keyring::Entry::new(keyring_service(), &keyring_account_name(account_id))
	178	+ .map_err(\|error\| format!("Failed to access the system keychain: {error}"))
	179	+}
	180	+
	181	+fn encode_keychain_session(session: &DeveloperAccountKeychainSession) -> KeychainResult<String> {
	182	+ toml::to_string(session)
	183	+ .map_err(\|error\| format!("Failed to encode account keychain payload: {error}"))
	184	+}
	185	+
	186	+fn decode_keychain_session(contents: &str) -> KeychainResult<CachedKeychainSession> {
	187	+ let mut session: DeveloperAccountKeychainSession = toml::from_str(contents)
	188	+ .map_err(\|error\| format!("Failed to decode account keychain payload: {error}"))?;
	189	+ session.version = KEYCHAIN_SESSION_VERSION;
	190	+ let encoded_contents = encode_keychain_session(&session)?;
	191	+ Ok(CachedKeychainSession {
	192	+ encoded_contents,
	193	+ session,
109	194	})
110	195	}
111	196
	197	+fn session_cache() -> &'static Mutex<SessionCache> {
	198	+ SESSION_CACHE.get_or_init(\|\| Mutex::new(HashMap::new()))
	199	+}
	200	+
	201	+fn lock_session_cache() -> BackendResult<SessionCacheGuard> {
	202	+ session_cache().lock().map_err(\|_\| {
	203	+ BackendError::Keychain("Failed to lock account keychain session cache.".to_string())
	204	+ })
	205	+}
	206	+
	207	+fn cache_keychain_session_locked(
	208	+ cache: &mut SessionCache,
	209	+ account_id: &str,
	210	+ session: DeveloperAccountKeychainSession,
	211	+ encoded_contents: String,
	212	+) {
	213	+ cache.insert(
	214	+ account_id.to_string(),
	215	+ CachedKeychainLookup::Session(CachedKeychainSession {
	216	+ encoded_contents,
	217	+ session,
	218	+ }),
	219	+ );
	220	+}
	221	+
112	222	#[cfg(test)]
113	223	mod tests {
114	224	use super::*;
	225	+ use std::cell::Cell;
	226	+ use std::sync::atomic::{AtomicUsize, Ordering};
	227	+ use std::sync::{Arc, Barrier};
	228	+ use std::thread;
	229	+ use std::time::Duration;
	230	+
	231	+ fn test_account_id(label: &str) -> String {
	232	+ format!("{label}-{}-{}", std::process::id(), current_epoch_millis())
	233	+ }
	234	+
	235	+ fn test_session() -> DeveloperAccountKeychainSession {
	236	+ DeveloperAccountKeychainSession::new(
	237	+ AuthToken {
	238	+ alt_dsid: "alt-dsid".to_string(),
	239	+ idms_token: "idms-token".to_string(),
	240	+ session_key: vec![1, 2, 3],
	241	+ cookie: vec![4, 5, 6],
	242	+ identity_token: "identity-token".to_string(),
	243	+ },
	244	+ Token {
	245	+ duration: 3600,
	246	+ expiry_epoch_millis: current_epoch_millis() + 3_600_000,
	247	+ token: "heartbeat-token".to_string(),
	248	+ },
	249	+ Token {
	250	+ duration: 3600,
	251	+ expiry_epoch_millis: current_epoch_millis() + 3_600_000,
	252	+ token: "xcode-token".to_string(),
	253	+ },
	254	+ )
	255	+ }
115	256
116	257	#[test]
117	258	fn zero_expiry_is_treated_as_unknown_not_expired() {
...	...	@@ -122,4 +263,93 @@ mod tests {
122	263	fn near_expiry_is_detected() {
123	264	assert!(token_is_near_expiry(current_epoch_millis() + 1));
124	265	}
	266	+
	267	+ #[test]
	268	+ fn concurrent_successful_lookups_read_the_keychain_once() {
	269	+ let account_id = Arc::new(test_account_id("concurrent-session"));
	270	+ let contents = Arc::new(encode_keychain_session(&test_session()).unwrap());
	271	+ let reads = Arc::new(AtomicUsize::new(0));
	272	+ let barrier = Arc::new(Barrier::new(2));
	273	+
	274	+ let handles = (0..2)
	275	+ .map(\|_\| {
	276	+ let account_id = Arc::clone(&account_id);
	277	+ let contents = Arc::clone(&contents);
	278	+ let reads = Arc::clone(&reads);
	279	+ let barrier = Arc::clone(&barrier);
	280	+ thread::spawn(move \|\| {
	281	+ barrier.wait();
	282	+ load_keychain_session_once(&account_id, \|\| {
	283	+ reads.fetch_add(1, Ordering::SeqCst);
	284	+ thread::sleep(Duration::from_millis(25));
	285	+ Ok(Some(contents.as_ref().clone()))
	286	+ })
	287	+ .unwrap()
	288	+ .unwrap()
	289	+ })
	290	+ })
	291	+ .collect::<Vec<_>>();
	292	+
	293	+ for handle in handles {
	294	+ assert_eq!(handle.join().unwrap().auth_token.idms_token, "idms-token");
	295	+ }
	296	+ assert_eq!(reads.load(Ordering::SeqCst), 1);
	297	+ }
	298	+
	299	+ #[test]
	300	+ fn missing_keychain_session_is_memoized() {
	301	+ let account_id = test_account_id("missing-session");
	302	+ let reads = Cell::new(0);
	303	+
	304	+ for _ in 0..2 {
	305	+ let loaded = load_keychain_session_once(&account_id, \|\| {
	306	+ reads.set(reads.get() + 1);
	307	+ Ok(None)
	308	+ })
	309	+ .unwrap();
	310	+ assert!(loaded.is_none());
	311	+ }
	312	+
	313	+ assert_eq!(reads.get(), 1);
	314	+ }
	315	+
	316	+ #[test]
	317	+ fn malformed_keychain_session_is_memoized() {
	318	+ let account_id = test_account_id("malformed-session");
	319	+ let reads = Cell::new(0);
	320	+
	321	+ for _ in 0..2 {
	322	+ let error = load_keychain_session_once(&account_id, \|\| {
	323	+ reads.set(reads.get() + 1);
	324	+ Ok(Some("not valid TOML".to_string()))
	325	+ })
	326	+ .unwrap_err();
	327	+ assert!(error
	328	+ .user_message()
	329	+ .contains("decode account keychain payload"));
	330	+ }
	331	+
	332	+ assert_eq!(reads.get(), 1);
	333	+ }
	334	+
	335	+ #[test]
	336	+ fn failed_keychain_lookup_is_memoized_and_can_be_replaced() {
	337	+ let account_id = test_account_id("failed-session");
	338	+ let reads = Cell::new(0);
	339	+
	340	+ for _ in 0..2 {
	341	+ let error = load_keychain_session_once(&account_id, \|\| {
	342	+ reads.set(reads.get() + 1);
	343	+ Err("Keychain access was denied.".to_string())
	344	+ })
	345	+ .unwrap_err();
	346	+ assert!(error.user_message().contains("access was denied"));
	347	+ }
	348	+ assert_eq!(reads.get(), 1);
	349	+
	350	+ let session = test_session();
	351	+ cache_keychain_session(&account_id, &session).unwrap();
	352	+ let loaded = load_keychain_session(&account_id).unwrap().unwrap();
	353	+ assert_eq!(loaded.auth_token.idms_token, session.auth_token.idms_token);
	354	+ }
125	355	}

...	...	@@ -7,17 +7,17 @@ use crate::backend::developer::cache::{
7	7	use crate::backend::developer::certificates::{
8	8	app_managed_private_key_fingerprints, certificate_fingerprint,
9	9	certificate_public_key_fingerprint, generate_development_certificate_signing_request,
10		- import_app_managed_private_key, local_code_signing_identity_fingerprints,
11		- save_app_managed_private_key, GeneratedCertificateSigningRequest,
	10	+ import_app_managed_private_key, save_app_managed_certificate, save_app_managed_private_key,
	11	+ GeneratedCertificateSigningRequest,
12	12	};
13	13	use crate::backend::developer::client::{with_developer_session, DeveloperSessionConfig};
14	14	use crate::backend::developer::keychain::{
15		- delete_keychain_session, load_keychain_session, save_keychain_session, token_is_near_expiry,
16		- DeveloperAccountKeychainSession,
	15	+ cache_keychain_session, delete_keychain_session, load_keychain_session, save_keychain_session,
	16	+ token_is_near_expiry, DeveloperAccountKeychainSession,
17	17	};
18	18	use crate::backend::runtime as backend_runtime;
19	19	use crate::backend::{BackendError, BackendResult};
20		-use crate::domain::{AdiBackendKind, DeveloperAccount, MachineIdentity};
	20	+use crate::domain::{AdiBackendKind, DeveloperAccount, DeveloperDevice, MachineIdentity};
21	21	use chrono::{DateTime, Local};
22	22	use grandslam::http_session::AnisetteHTTPSession;
23	23	use grandslam::{AuthOutcome, AuthenticatedHTTPSession, Token};
...	...	@@ -25,11 +25,11 @@ use plist::{Dictionary, Value};
25	25	use std::path::PathBuf;
26	26	use std::time::{Duration, UNIX_EPOCH};
27	27	use xcode::{
28		- AddAppIdAction, AppIdFeature, DeleteAppIdAction, DeveloperTeam,
29		- DownloadTeamProvisioningProfileAction, IOSRequest, ListAllDevelopmentCertsAction,
30		- ListAppIdsAction, ListTeamsAction, RevokeDevelopmentCertAction, SubmitDevelopmentCsrAction,
31		- UpdateAppIdAction, ViewDeveloperAction, XcodeSession, XCODE_BUNDLE_INFORMATION,
32		- XCODE_TOKEN_IDENTIFIER,
	28	+ AddAppIdAction, AddDeviceAction, AppIdFeature, DeleteAppIdAction, DeleteDeviceAction,
	29	+ DeveloperTeam, DownloadTeamProvisioningProfileAction, IOSRequest,
	30	+ ListAllDevelopmentCertsAction, ListAppIdsAction, ListDevicesAction, ListTeamsAction,
	31	+ RevokeDevelopmentCertAction, SubmitDevelopmentCsrAction, UpdateAppIdAction,
	32	+ ViewDeveloperAction, XcodeSession, XCODE_BUNDLE_INFORMATION, XCODE_TOKEN_IDENTIFIER,
33	33	};
34	34
35	35	const HEARTBEAT_TOKEN_IDENTIFIER: &str = "com.apple.gs.idms.hb";
...	...	@@ -139,6 +139,39 @@ pub(crate) struct DeveloperProvisioningProfileDownloadRequest {
139	139	pub(crate) android_adi_identifier: String,
140	140	}
141	141
	142	+#[derive(Clone, Debug)]
	143	+pub(crate) struct DeveloperDeviceListRequest {
	144	+ pub(crate) account_id: String,
	145	+ pub(crate) email: String,
	146	+ pub(crate) team_id: String,
	147	+ pub(crate) adi_backend: AdiBackendKind,
	148	+ pub(crate) machine_identity: MachineIdentity,
	149	+ pub(crate) android_adi_identifier: String,
	150	+}
	151	+
	152	+#[derive(Clone, Debug)]
	153	+pub(crate) struct DeveloperDeviceAddRequest {
	154	+ pub(crate) account_id: String,
	155	+ pub(crate) email: String,
	156	+ pub(crate) team_id: String,
	157	+ pub(crate) name: String,
	158	+ pub(crate) udid: String,
	159	+ pub(crate) adi_backend: AdiBackendKind,
	160	+ pub(crate) machine_identity: MachineIdentity,
	161	+ pub(crate) android_adi_identifier: String,
	162	+}
	163	+
	164	+#[derive(Clone, Debug)]
	165	+pub(crate) struct DeveloperDeviceDeleteRequest {
	166	+ pub(crate) account_id: String,
	167	+ pub(crate) email: String,
	168	+ pub(crate) team_id: String,
	169	+ pub(crate) device_id: String,
	170	+ pub(crate) adi_backend: AdiBackendKind,
	171	+ pub(crate) machine_identity: MachineIdentity,
	172	+ pub(crate) android_adi_identifier: String,
	173	+}
	174	+
142	175	#[derive(Clone, Debug)]
143	176	pub(crate) struct DownloadedProvisioningProfile {
144	177	pub(crate) name: String,
...	...	@@ -350,6 +383,70 @@ pub(crate) async fn download_developer_provisioning_profile(
350	383	.await?
351	384	}
352	385
	386	+pub(crate) async fn list_developer_devices(
	387	+ request: DeveloperDeviceListRequest,
	388	+) -> BackendResult<Vec<DeveloperDevice>> {
	389	+ let account = refresh_account_seed(&request.account_id, &request.email);
	390	+ let session = validated_keychain_session(&account)?;
	391	+
	392	+ backend_runtime::run("developer device list", move \|\| async move {
	393	+ let account_id = account.id.clone();
	394	+ let result = with_developer_session(
	395	+ session_config(
	396	+ request.adi_backend,
	397	+ request.machine_identity,
	398	+ request.android_adi_identifier,
	399	+ ),
	400	+ session,
	401	+ \|xcode_session\| {
	402	+ Box::pin(
	403	+ async move { fetch_developer_devices(xcode_session, &request.team_id).await },
	404	+ )
	405	+ },
	406	+ )
	407	+ .await?;
	408	+
	409	+ save_keychain_session(&account_id, &result.keychain_session)?;
	410	+ Ok(result.value)
	411	+ })
	412	+ .await?
	413	+}
	414	+
	415	+pub(crate) async fn add_developer_device(
	416	+ request: DeveloperDeviceAddRequest,
	417	+) -> BackendResult<Vec<DeveloperDevice>> {
	418	+ mutate_developer_devices(
	419	+ request.account_id,
	420	+ request.email,
	421	+ request.adi_backend,
	422	+ request.machine_identity,
	423	+ request.android_adi_identifier,
	424	+ request.team_id,
	425	+ DeveloperDeviceOperation::Add {
	426	+ name: request.name,
	427	+ udid: request.udid,
	428	+ },
	429	+ )
	430	+ .await
	431	+}
	432	+
	433	+pub(crate) async fn delete_developer_device(
	434	+ request: DeveloperDeviceDeleteRequest,
	435	+) -> BackendResult<Vec<DeveloperDevice>> {
	436	+ mutate_developer_devices(
	437	+ request.account_id,
	438	+ request.email,
	439	+ request.adi_backend,
	440	+ request.machine_identity,
	441	+ request.android_adi_identifier,
	442	+ request.team_id,
	443	+ DeveloperDeviceOperation::Delete {
	444	+ device_id: request.device_id,
	445	+ },
	446	+ )
	447	+ .await
	448	+}
	449	+
353	450	pub(crate) async fn login_developer_account(
354	451	request: DeveloperLoginRequest,
355	452	) -> BackendResult<DeveloperLoginOutcome> {
...	...	@@ -392,6 +489,11 @@ enum DeveloperTeamOperation {
392	489	},
393	490	}
394	491
	492	+enum DeveloperDeviceOperation {
	493	+ Add { name: String, udid: String },
	494	+ Delete { device_id: String },
	495	+}
	496	+
395	497	async fn mutate_team_resources(
396	498	account_id: &str,
397	499	email: &str,
...	...	@@ -570,6 +672,129 @@ async fn perform_team_operation(
570	672	}
571	673	}
572	674
	675	+async fn mutate_developer_devices(
	676	+ account_id: String,
	677	+ email: String,
	678	+ adi_backend: AdiBackendKind,
	679	+ machine_identity: MachineIdentity,
	680	+ android_adi_identifier: String,
	681	+ team_id: String,
	682	+ operation: DeveloperDeviceOperation,
	683	+) -> BackendResult<Vec<DeveloperDevice>> {
	684	+ let account = refresh_account_seed(&account_id, &email);
	685	+ let session = validated_keychain_session(&account)?;
	686	+
	687	+ backend_runtime::run("developer device update", move \|\| async move {
	688	+ let account_id = account.id.clone();
	689	+ let result = with_developer_session(
	690	+ session_config(adi_backend, machine_identity, android_adi_identifier),
	691	+ session,
	692	+ \|xcode_session\| {
	693	+ Box::pin(async move {
	694	+ perform_device_operation(xcode_session, &team_id, operation).await?;
	695	+ fetch_developer_devices(xcode_session, &team_id).await
	696	+ })
	697	+ },
	698	+ )
	699	+ .await?;
	700	+
	701	+ save_keychain_session(&account_id, &result.keychain_session)?;
	702	+ Ok(result.value)
	703	+ })
	704	+ .await?
	705	+}
	706	+
	707	+async fn perform_device_operation(
	708	+ xcode_session: &XcodeSession<'_, '_>,
	709	+ team_id: &str,
	710	+ operation: DeveloperDeviceOperation,
	711	+) -> BackendResult<()> {
	712	+ match operation {
	713	+ DeveloperDeviceOperation::Add { name, udid } => {
	714	+ if name.trim().is_empty() {
	715	+ return Err(BackendError::Message(
	716	+ "Enter a device name before registering it.".to_string(),
	717	+ ));
	718	+ }
	719	+ if udid.trim().is_empty() {
	720	+ return Err(BackendError::Message(
	721	+ "Enter a device UDID before registering it.".to_string(),
	722	+ ));
	723	+ }
	724	+ xcode_session
	725	+ .perform_developer_action(IOSRequest::new(AddDeviceAction {
	726	+ team_id: team_id.into(),
	727	+ name,
	728	+ device_number: udid,
	729	+ }))
	730	+ .await
	731	+ .map_err(\|error\| {
	732	+ BackendError::Network(format!("Failed to register device: {error}"))
	733	+ })?
	734	+ .map_err(\|error\| {
	735	+ BackendError::AppleAuth(format!(
	736	+ "Failed to parse device registration response: {error}"
	737	+ ))
	738	+ })?;
	739	+ }
	740	+ DeveloperDeviceOperation::Delete { device_id } => {
	741	+ xcode_session
	742	+ .perform_developer_action(IOSRequest::new(DeleteDeviceAction {
	743	+ team_id: team_id.into(),
	744	+ device_id,
	745	+ }))
	746	+ .await
	747	+ .map_err(\|error\| {
	748	+ BackendError::Network(format!("Failed to remove device: {error}"))
	749	+ })?
	750	+ .map_err(\|error\| {
	751	+ BackendError::AppleAuth(format!(
	752	+ "Failed to parse device removal response: {error}"
	753	+ ))
	754	+ })?;
	755	+ }
	756	+ }
	757	+ Ok(())
	758	+}
	759	+
	760	+async fn fetch_developer_devices(
	761	+ xcode_session: &XcodeSession<'_, '_>,
	762	+ team_id: &str,
	763	+) -> BackendResult<Vec<DeveloperDevice>> {
	764	+ let mut devices = xcode_session
	765	+ .perform_developer_action(IOSRequest::new(ListDevicesAction {
	766	+ team_id: team_id.into(),
	767	+ }))
	768	+ .await
	769	+ .map_err(\|error\| {
	770	+ BackendError::Network(format!("Failed to fetch registered devices: {error}"))
	771	+ })?
	772	+ .map_err(\|error\| {
	773	+ BackendError::AppleAuth(format!(
	774	+ "Failed to parse registered devices response: {error}"
	775	+ ))
	776	+ })?
	777	+ .devices
	778	+ .into_iter()
	779	+ .map(\|device\| DeveloperDevice {
	780	+ id: device.device_id,
	781	+ name: device.name,
	782	+ udid: device.device_number,
	783	+ })
	784	+ .collect::<Vec<_>>();
	785	+ sort_developer_devices(&mut devices);
	786	+ Ok(devices)
	787	+}
	788	+
	789	+fn sort_developer_devices(devices: &mut [DeveloperDevice]) {
	790	+ devices.sort_by(\|left, right\| {
	791	+ left.name
	792	+ .to_ascii_lowercase()
	793	+ .cmp(&right.name.to_ascii_lowercase())
	794	+ .then_with(\|\| left.udid.cmp(&right.udid))
	795	+ });
	796	+}
	797	+
573	798	async fn refresh_cached_team_only(
574	799	account_id: &str,
575	800	email: &str,
...	...	@@ -762,6 +987,8 @@ async fn login_developer_account_async(
762	987	}
763	988	return Err(error);
764	989	}
	990	+ } else {
	991	+ cache_keychain_session(&account_cache.id, &keychain_session)?;
765	992	}
766	993
767	994	Ok(DeveloperLoginOutcome::SignedIn(account_cache.into()))
...	...	@@ -847,7 +1074,6 @@ async fn fetch_team_resources(
847	1074	team: CachedDeveloperTeam,
848	1075	xcode_session: &XcodeSession<'_, '_>,
849	1076	) -> BackendResult<CachedDeveloperTeam> {
850		- let local_identity_fingerprints = local_code_signing_identity_fingerprints();
851	1077	let app_managed_key_fingerprints = app_managed_private_key_fingerprints();
852	1078	let certificates = xcode_session
853	1079	.perform_developer_action(IOSRequest::new(ListAllDevelopmentCertsAction {
...	...	@@ -868,27 +1094,26 @@ async fn fetch_team_resources(
868	1094	})?
869	1095	.certificates
870	1096	.into_iter()
871		- .map(\|certificate\| {
	1097	+ .map(\|certificate\| -> BackendResult<_> {
872	1098	let fingerprint = certificate_fingerprint(&certificate.cert_content);
873	1099	let public_key_fingerprint =
874	1100	certificate_public_key_fingerprint(&certificate.cert_content);
875		- CachedDevelopmentCertificate {
	1101	+ save_app_managed_certificate(&fingerprint, &certificate.cert_content)?;
	1102	+ Ok(CachedDevelopmentCertificate {
876	1103	id: certificate.certificate_id,
877	1104	name: certificate.name,
878	1105	serial_number: certificate.serial_number,
879	1106	machine_name: certificate.machine_name,
880		- private_key_available: local_identity_fingerprints
881		- .iter()
882		- .any(\|identity\| identity == &fingerprint)
883		- \|\| public_key_fingerprint.as_ref().is_some_and(\|fingerprint\| {
	1107	+ private_key_available: public_key_fingerprint.as_ref().is_some_and(\|fingerprint\| {
884	1108	app_managed_key_fingerprints
885	1109	.iter()
886	1110	.any(\|candidate\| candidate == fingerprint)
887	1111	}),
	1112	+ certificate_fingerprint: Some(fingerprint),
888	1113	public_key_fingerprint,
889		- }
890	1114	})
891		- .collect();
	1115	+ })
	1116	+ .collect::<BackendResult<Vec<_>>>()?;
892	1117
893	1118	let app_id_response = xcode_session
894	1119	.perform_developer_action(IOSRequest::new(ListAppIdsAction {
...	...	@@ -1188,4 +1413,35 @@ mod tests {
1188	1413	assert_eq!(seed.id, "TEAM");
1189	1414	assert_eq!(seed.role, "Individual");
1190	1415	}
	1416	+
	1417	+ #[test]
	1418	+ fn developer_devices_are_sorted_by_name_then_udid() {
	1419	+ let mut devices = vec![
	1420	+ DeveloperDevice {
	1421	+ id: "3".into(),
	1422	+ name: "iPhone".into(),
	1423	+ udid: "B".into(),
	1424	+ },
	1425	+ DeveloperDevice {
	1426	+ id: "1".into(),
	1427	+ name: "iPad".into(),
	1428	+ udid: "Z".into(),
	1429	+ },
	1430	+ DeveloperDevice {
	1431	+ id: "2".into(),
	1432	+ name: "iphone".into(),
	1433	+ udid: "A".into(),
	1434	+ },
	1435	+ ];
	1436	+
	1437	+ sort_developer_devices(&mut devices);
	1438	+
	1439	+ assert_eq!(
	1440	+ devices
	1441	+ .into_iter()
	1442	+ .map(\|device\| device.id)
	1443	+ .collect::<Vec<_>>(),
	1444	+ vec!["1", "2", "3"]
	1445	+ );
	1446	+ }
1191	1447	}

...	...	@@ -1,6 +1,7 @@
1	1	use crate::backend::developer::accounts;
	2	+use crate::backend::developer::certificates::{self, AppManagedSigningMaterial};
2	3	use crate::backend::BackendResult;
3		-use crate::domain::{AdiBackendKind, DeveloperAccount, MachineIdentity};
	4	+use crate::domain::{AdiBackendKind, DeveloperAccount, DeveloperDevice, MachineIdentity};
4	5	use std::path::PathBuf;
5	6
6	7	#[derive(Clone, Debug)]
...	...	@@ -66,6 +67,13 @@ pub(crate) fn delete_account_cache(account_id: &str) -> BackendResult<()> {
66	67	accounts::delete_account_cache(account_id)
67	68	}
68	69
	70	+pub(crate) fn load_signing_material(
	71	+ certificate_fingerprint: &str,
	72	+ public_key_fingerprint: &str,
	73	+) -> BackendResult<AppManagedSigningMaterial> {
	74	+ certificates::load_app_managed_signing_material(certificate_fingerprint, public_key_fingerprint)
	75	+}
	76	+
69	77	pub(crate) async fn login(request: DeveloperLoginRequest) -> BackendResult<DeveloperLoginOutcome> {
70	78	accounts::login_developer_account(accounts::DeveloperLoginRequest {
71	79	email: request.email,
...	...	@@ -154,6 +162,60 @@ pub(crate) async fn delete_app_id(
154	162	.await
155	163	}
156	164
	165	+pub(crate) async fn list_developer_devices(
	166	+ context: DeveloperSessionContext,
	167	+ team_id: String,
	168	+) -> BackendResult<Vec<DeveloperDevice>> {
	169	+ let request = context.refresh_request();
	170	+ accounts::list_developer_devices(accounts::DeveloperDeviceListRequest {
	171	+ account_id: request.account_id,
	172	+ email: request.email,
	173	+ team_id,
	174	+ adi_backend: request.adi_backend,
	175	+ machine_identity: request.machine_identity,
	176	+ android_adi_identifier: request.android_adi_identifier,
	177	+ })
	178	+ .await
	179	+}
	180	+
	181	+pub(crate) async fn add_developer_device(
	182	+ context: DeveloperSessionContext,
	183	+ team_id: String,
	184	+ name: String,
	185	+ udid: String,
	186	+) -> BackendResult<Vec<DeveloperDevice>> {
	187	+ let request = context.refresh_request();
	188	+ accounts::add_developer_device(accounts::DeveloperDeviceAddRequest {
	189	+ account_id: request.account_id,
	190	+ email: request.email,
	191	+ team_id,
	192	+ name,
	193	+ udid,
	194	+ adi_backend: request.adi_backend,
	195	+ machine_identity: request.machine_identity,
	196	+ android_adi_identifier: request.android_adi_identifier,
	197	+ })
	198	+ .await
	199	+}
	200	+
	201	+pub(crate) async fn delete_developer_device(
	202	+ context: DeveloperSessionContext,
	203	+ team_id: String,
	204	+ device_id: String,
	205	+) -> BackendResult<Vec<DeveloperDevice>> {
	206	+ let request = context.refresh_request();
	207	+ accounts::delete_developer_device(accounts::DeveloperDeviceDeleteRequest {
	208	+ account_id: request.account_id,
	209	+ email: request.email,
	210	+ team_id,
	211	+ device_id,
	212	+ adi_backend: request.adi_backend,
	213	+ machine_identity: request.machine_identity,
	214	+ android_adi_identifier: request.android_adi_identifier,
	215	+ })
	216	+ .await
	217	+}
	218	+
157	219	pub(crate) async fn create_certificate(
158	220	context: DeveloperSessionContext,
159	221	team_id: String,

...	...	@@ -1,13 +1,22 @@
	1	+use crate::backend::ipa::SignedAppBundle;
1	2	use crate::backend::{runtime as backend_runtime, BackendError, BackendResult};
2		-use crate::domain::{Device, DeviceWatchEvent};
	3	+use crate::domain::{Device, DeviceInstallProgress, DeviceWatchEvent};
3	4	use futures::{channel::mpsc::UnboundedSender, StreamExt};
4	5	use idevice::{
	6	+ afc::{opcode::AfcFopenMode, AfcClient},
5	7	provider::UsbmuxdProvider,
	8	+ services::installation_proxy::InstallationProxyClient,
6	9	services::lockdown::LockdownClient,
7	10	usbmuxd::{Connection, UsbmuxdAddr, UsbmuxdDevice},
8	11	IdeviceService,
9	12	};
10	13	use plist::Value;
	14	+use std::path::{Component, Path, PathBuf};
	15	+use std::sync::{Arc, Mutex};
	16	+use tokio::io::{AsyncReadExt, AsyncWriteExt};
	17	+use walkdir::WalkDir;
	18	+
	19	+const APP_UPLOAD_BUFFER_SIZE: usize = 1024 * 1024;
11	20
12	21	pub(crate) async fn discover_devices() -> BackendResult<Vec<Device>> {
13	22	backend_runtime::run_send("device discovery", discover_devices_async()).await?
...	...	@@ -19,6 +28,327 @@ pub(crate) async fn watch_device_changes(
19	28	backend_runtime::run("device watcher", move \|\| watch_device_changes_async(sender)).await?
20	29	}
21	30
	31	+pub(crate) async fn install_app(
	32	+ udid: String,
	33	+ signed_app: SignedAppBundle,
	34	+ progress: impl FnMut(DeviceInstallProgress) + Send + 'static,
	35	+) -> BackendResult<()> {
	36	+ backend_runtime::run_send(
	37	+ "app installation",
	38	+ install_app_async(udid, signed_app, progress),
	39	+ )
	40	+ .await?
	41	+}
	42	+
	43	+async fn install_app_async(
	44	+ udid: String,
	45	+ signed_app: SignedAppBundle,
	46	+ progress: impl FnMut(DeviceInstallProgress) + Send + 'static,
	47	+) -> BackendResult<()> {
	48	+ let progress = Arc::new(Mutex::new(progress));
	49	+ report_install_progress(&progress, DeviceInstallProgress::Connecting);
	50	+
	51	+ let provider = provider_for_udid(&udid).await?;
	52	+ let app_path = signed_app.path().to_path_buf();
	53	+ let upload_plan = app_upload_plan(&app_path)?;
	54	+
	55	+ let mut afc = AfcClient::connect(&provider).await.map_err(\|error\| {
	56	+ BackendError::DeviceInstall(format!("Unable to open AFC on {udid}: {error}"))
	57	+ })?;
	58	+ if afc.get_file_info("PublicStaging").await.is_err() {
	59	+ afc.mk_dir("PublicStaging").await.map_err(\|error\| {
	60	+ BackendError::DeviceInstall(format!(
	61	+ "Unable to create the device staging directory: {error}"
	62	+ ))
	63	+ })?;
	64	+ }
	65	+
	66	+ let app_folder_name = app_path
	67	+ .file_name()
	68	+ .and_then(\|name\| name.to_str())
	69	+ .filter(\|name\| name.ends_with(".app"))
	70	+ .ok_or_else(\|\| {
	71	+ BackendError::DeviceInstall(format!(
	72	+ "Signed app path {} does not end in an .app folder.",
	73	+ app_path.display()
	74	+ ))
	75	+ })?;
	76	+ let remote_path = format!("PublicStaging/{app_folder_name}");
	77	+ if afc.get_file_info(&remote_path).await.is_ok() {
	78	+ afc.remove_all(&remote_path).await.map_err(\|error\| {
	79	+ BackendError::DeviceInstall(format!(
	80	+ "Unable to replace the existing staged app folder: {error}"
	81	+ ))
	82	+ })?;
	83	+ }
	84	+ afc.mk_dir(&remote_path).await.map_err(\|error\| {
	85	+ BackendError::DeviceInstall(format!("Unable to create the staged app folder: {error}"))
	86	+ })?;
	87	+ if let Err(error) = upload_app_bundle(&mut afc, &remote_path, &upload_plan, &progress).await {
	88	+ remove_staged_app(&mut afc, &remote_path).await;
	89	+ return Err(error);
	90	+ }
	91	+
	92	+ let mut options = plist::Dictionary::new();
	93	+ options.insert(
	94	+ "PackageType".to_string(),
	95	+ Value::String("Developer".to_string()),
	96	+ );
	97	+ let mut installer = match InstallationProxyClient::connect(&provider).await {
	98	+ Ok(installer) => installer,
	99	+ Err(error) => {
	100	+ remove_staged_app(&mut afc, &remote_path).await;
	101	+ return Err(BackendError::DeviceInstall(format!(
	102	+ "Unable to open InstallationProxy on {udid}: {error}"
	103	+ )));
	104	+ }
	105	+ };
	106	+ let install_progress = Arc::clone(&progress);
	107	+ let result = installer
	108	+ .install_with_callback(
	109	+ remote_path.clone(),
	110	+ Some(Value::Dictionary(options)),
	111	+ move \|(percent, progress)\| async move {
	112	+ report_install_progress(&progress, DeviceInstallProgress::Installing { percent });
	113	+ },
	114	+ install_progress,
	115	+ )
	116	+ .await;
	117	+
	118	+ report_install_progress(&progress, DeviceInstallProgress::Finalizing);
	119	+ remove_staged_app(&mut afc, &remote_path).await;
	120	+ drop(signed_app);
	121	+
	122	+ result.map_err(\|error\| {
	123	+ BackendError::DeviceInstall(format!("Unable to install the app on {udid}: {error}"))
	124	+ })
	125	+}
	126	+
	127	+struct AppUploadPlan {
	128	+ entries: Vec<AppUploadEntry>,
	129	+ total_bytes: u64,
	130	+ total_files: usize,
	131	+}
	132	+
	133	+struct AppUploadEntry {
	134	+ local_path: PathBuf,
	135	+ relative_path: String,
	136	+ is_directory: bool,
	137	+}
	138	+
	139	+fn app_upload_plan(app_path: &Path) -> BackendResult<AppUploadPlan> {
	140	+ let mut entries = Vec::new();
	141	+ let mut total_bytes = 0_u64;
	142	+ let mut total_files = 0_usize;
	143	+
	144	+ for entry in WalkDir::new(app_path).min_depth(1).sort_by_file_name() {
	145	+ let entry = entry.map_err(\|error\| {
	146	+ BackendError::DeviceInstall(format!("Unable to inspect signed app files: {error}"))
	147	+ })?;
	148	+ let relative = entry.path().strip_prefix(app_path).map_err(\|error\| {
	149	+ BackendError::DeviceInstall(format!("Unable to stage signed app path: {error}"))
	150	+ })?;
	151	+ let relative_path = device_relative_path(relative)?;
	152	+ let file_type = entry.file_type();
	153	+ if file_type.is_dir() {
	154	+ entries.push(AppUploadEntry {
	155	+ local_path: entry.into_path(),
	156	+ relative_path,
	157	+ is_directory: true,
	158	+ });
	159	+ } else if file_type.is_file() {
	160	+ let metadata = entry.metadata().map_err(\|error\| {
	161	+ BackendError::DeviceInstall(format!(
	162	+ "Unable to inspect {}: {error}",
	163	+ entry.path().display()
	164	+ ))
	165	+ })?;
	166	+ total_bytes = total_bytes.saturating_add(metadata.len());
	167	+ total_files += 1;
	168	+ entries.push(AppUploadEntry {
	169	+ local_path: entry.into_path(),
	170	+ relative_path,
	171	+ is_directory: false,
	172	+ });
	173	+ } else {
	174	+ return Err(BackendError::DeviceInstall(format!(
	175	+ "Signed app contains unsupported file {}.",
	176	+ entry.path().display()
	177	+ )));
	178	+ }
	179	+ }
	180	+
	181	+ Ok(AppUploadPlan {
	182	+ entries,
	183	+ total_bytes,
	184	+ total_files,
	185	+ })
	186	+}
	187	+
	188	+fn device_relative_path(path: &Path) -> BackendResult<String> {
	189	+ let mut parts = Vec::new();
	190	+ for component in path.components() {
	191	+ let Component::Normal(component) = component else {
	192	+ return Err(BackendError::DeviceInstall(format!(
	193	+ "Signed app contains unsafe path {}.",
	194	+ path.display()
	195	+ )));
	196	+ };
	197	+ parts.push(component.to_string_lossy().into_owned());
	198	+ }
	199	+ if parts.is_empty() {
	200	+ return Err(BackendError::DeviceInstall(
	201	+ "Signed app contains an empty relative path.".to_string(),
	202	+ ));
	203	+ }
	204	+ Ok(parts.join("/"))
	205	+}
	206	+
	207	+async fn upload_app_bundle<P>(
	208	+ afc: &mut AfcClient,
	209	+ remote_root: &str,
	210	+ plan: &AppUploadPlan,
	211	+ progress: &Arc<Mutex<P>>,
	212	+) -> BackendResult<()>
	213	+where
	214	+ P: FnMut(DeviceInstallProgress),
	215	+{
	216	+ let mut transferred_bytes = 0_u64;
	217	+ let mut completed_files = 0_usize;
	218	+ report_install_progress(
	219	+ progress,
	220	+ DeviceInstallProgress::Uploading {
	221	+ transferred_bytes,
	222	+ total_bytes: plan.total_bytes,
	223	+ completed_files,
	224	+ total_files: plan.total_files,
	225	+ },
	226	+ );
	227	+
	228	+ for entry in &plan.entries {
	229	+ let remote_path = format!("{remote_root}/{}", entry.relative_path);
	230	+ if entry.is_directory {
	231	+ afc.mk_dir(&remote_path).await.map_err(\|error\| {
	232	+ BackendError::DeviceInstall(format!(
	233	+ "Unable to create staged folder {remote_path}: {error}"
	234	+ ))
	235	+ })?;
	236	+ continue;
	237	+ }
	238	+
	239	+ let mut source = tokio::fs::File::open(&entry.local_path)
	240	+ .await
	241	+ .map_err(\|error\| {
	242	+ BackendError::DeviceInstall(format!(
	243	+ "Unable to open signed app file {}: {error}",
	244	+ entry.local_path.display()
	245	+ ))
	246	+ })?;
	247	+ let mut destination =
	248	+ afc.open(&remote_path, AfcFopenMode::WrOnly)
	249	+ .await
	250	+ .map_err(\|error\| {
	251	+ BackendError::DeviceInstall(format!(
	252	+ "Unable to stage app file {remote_path}: {error}"
	253	+ ))
	254	+ })?;
	255	+ let mut buffer = vec![0; APP_UPLOAD_BUFFER_SIZE];
	256	+ let upload_result = async {
	257	+ loop {
	258	+ let read = source.read(&mut buffer).await.map_err(\|error\| {
	259	+ BackendError::DeviceInstall(format!(
	260	+ "Unable to read signed app file {}: {error}",
	261	+ entry.local_path.display()
	262	+ ))
	263	+ })?;
	264	+ if read == 0 {
	265	+ return Ok(());
	266	+ }
	267	+ destination
	268	+ .write_all(&buffer[..read])
	269	+ .await
	270	+ .map_err(\|error\| {
	271	+ BackendError::DeviceInstall(format!(
	272	+ "Unable to upload app file {remote_path}: {error}"
	273	+ ))
	274	+ })?;
	275	+ transferred_bytes = transferred_bytes.saturating_add(read as u64);
	276	+ report_install_progress(
	277	+ progress,
	278	+ DeviceInstallProgress::Uploading {
	279	+ transferred_bytes,
	280	+ total_bytes: plan.total_bytes,
	281	+ completed_files,
	282	+ total_files: plan.total_files,
	283	+ },
	284	+ );
	285	+ }
	286	+ }
	287	+ .await;
	288	+ let close_result = destination.close().await.map_err(\|error\| {
	289	+ BackendError::DeviceInstall(format!("Unable to finish app file {remote_path}: {error}"))
	290	+ });
	291	+ upload_result.and(close_result)?;
	292	+ completed_files += 1;
	293	+ report_install_progress(
	294	+ progress,
	295	+ DeviceInstallProgress::Uploading {
	296	+ transferred_bytes,
	297	+ total_bytes: plan.total_bytes,
	298	+ completed_files,
	299	+ total_files: plan.total_files,
	300	+ },
	301	+ );
	302	+ }
	303	+
	304	+ Ok(())
	305	+}
	306	+
	307	+async fn remove_staged_app(afc: &mut AfcClient, remote_path: &str) {
	308	+ if let Err(error) = afc.remove_all(remote_path).await {
	309	+ log::warn!("Unable to remove staged app {remote_path}: {error}");
	310	+ }
	311	+}
	312	+
	313	+async fn provider_for_udid(udid: &str) -> BackendResult<UsbmuxdProvider> {
	314	+ let addr = UsbmuxdAddr::from_env_var().map_err(\|error\| {
	315	+ BackendError::DeviceInstall(format!("Invalid usbmuxd address: {error}"))
	316	+ })?;
	317	+ let mut usbmuxd = addr.connect(100).await.map_err(\|error\| {
	318	+ BackendError::DeviceInstall(format!("Unable to connect to usbmuxd: {error}"))
	319	+ })?;
	320	+ let device = usbmuxd
	321	+ .get_devices()
	322	+ .await
	323	+ .map_err(\|error\| {
	324	+ BackendError::DeviceInstall(format!("Unable to list connected devices: {error}"))
	325	+ })?
	326	+ .into_iter()
	327	+ .find(\|device\| device.udid == udid)
	328	+ .ok_or_else(\|\| {
	329	+ BackendError::DeviceInstall(format!(
	330	+ "Device {udid} is no longer connected. Reconnect it and try again."
	331	+ ))
	332	+ })?;
	333	+
	334	+ Ok(UsbmuxdProvider {
	335	+ addr,
	336	+ tag: 101,
	337	+ udid: device.udid,
	338	+ device_id: device.device_id,
	339	+ label: "super-sideloader.install".to_string(),
	340	+ })
	341	+}
	342	+
	343	+fn report_install_progress<P>(progress: &Arc<Mutex<P>>, event: DeviceInstallProgress)
	344	+where
	345	+ P: FnMut(DeviceInstallProgress),
	346	+{
	347	+ if let Ok(mut progress) = progress.lock() {
	348	+ progress(event);
	349	+ }
	350	+}
	351	+
22	352	async fn watch_device_changes_async(
23	353	sender: UnboundedSender<DeviceWatchEvent>,
24	354	) -> BackendResult<()> {
...	...	@@ -139,3 +469,31 @@ fn os_name(device_class: Option<&str>, model: &str) -> &'static str {
139	469	_ => "iOS",
140	470	}
141	471	}
	472	+
	473	+#[cfg(test)]
	474	+mod tests {
	475	+ use super::*;
	476	+ use std::fs;
	477	+
	478	+ #[test]
	479	+ fn app_upload_plan_counts_files_bytes_and_device_paths() {
	480	+ let temp = tempfile::tempdir().unwrap();
	481	+ let app = temp.path().join("Example.app");
	482	+ let plug_in = app.join("PlugIns").join("Widget.appex");
	483	+ fs::create_dir_all(&plug_in).unwrap();
	484	+ fs::write(app.join("Info.plist"), b"plist").unwrap();
	485	+ fs::write(plug_in.join("Widget"), b"executable").unwrap();
	486	+
	487	+ let plan = app_upload_plan(&app).unwrap();
	488	+
	489	+ assert_eq!(plan.total_files, 2);
	490	+ assert_eq!(plan.total_bytes, 15);
	491	+ assert!(plan.entries.iter().any(\|entry\| {
	492	+ entry.relative_path == "PlugIns/Widget.appex/Widget" && !entry.is_directory
	493	+ }));
	494	+ assert_eq!(
	495	+ device_relative_path(Path::new("Frameworks/Example.framework/Example")).unwrap(),
	496	+ "Frameworks/Example.framework/Example"
	497	+ );
	498	+ }
	499	+}

...	...	@@ -36,6 +36,8 @@ pub(crate) enum BackendError {
36	36	Adi(String),
37	37	#[error("Device discovery failed: {0}")]
38	38	DeviceDiscovery(String),
	39	+ #[error("Device installation failed: {0}")]
	40	+ DeviceInstall(String),
39	41	#[error("Cache operation failed: {0}")]
40	42	Cache(String),
41	43	#[error("Preferences operation failed: {0}")]
...	...	@@ -112,6 +114,7 @@ mod tests {
112	114	BackendError::AppleAuth("invalid password".to_string()).user_message(),
113	115	BackendError::Adi("not provisioned".to_string()).user_message(),
114	116	BackendError::DeviceDiscovery("usbmuxd stopped".to_string()).user_message(),
	117	+ BackendError::DeviceInstall("verification failed".to_string()).user_message(),
115	118	BackendError::Cache("cache corrupt".to_string()).user_message(),
116	119	BackendError::Preferences("settings corrupt".to_string()).user_message(),
117	120	BackendError::Unsupported("not on this platform".to_string()).user_message(),

...	...	@@ -2,6 +2,7 @@ pub(crate) mod adi;
2	2	pub(crate) mod adi_service;
3	3	pub(crate) mod device;
4	4	pub(crate) mod error;
	5	+mod icon;
5	6	pub(crate) mod ipa;
6	7	pub(crate) mod paths;
7	8	pub(crate) mod preferences;

...	...	@@ -44,5 +44,13 @@ pub(crate) struct DeveloperCertificate {
44	44	pub(crate) serial_number: String,
45	45	pub(crate) machine_name: String,
46	46	pub(crate) private_key_available: bool,
	47	+ pub(crate) certificate_fingerprint: Option<String>,
47	48	pub(crate) public_key_fingerprint: Option<String>,
48	49	}
	50	+
	51	+#[derive(Clone, Debug, Eq, PartialEq)]
	52	+pub(crate) struct DeveloperDevice {
	53	+ pub(crate) id: String,
	54	+ pub(crate) name: String,
	55	+ pub(crate) udid: String,
	56	+}

...	...	@@ -37,6 +37,12 @@ pub(crate) struct AppMetadata {
37	37	pub(crate) supported_devices: Vec<SupportedDeviceFamily>,
38	38	}
39	39
	40	+#[derive(Clone, Debug, Eq, PartialEq)]
	41	+pub(crate) struct NestedBundle {
	42	+ pub(crate) name: String,
	43	+ pub(crate) bundle_id: String,
	44	+}
	45	+
40	46	#[derive(Clone, Debug, PartialEq)]
41	47	pub(crate) struct AppEntitlement {
42	48	pub(crate) key: String,
...	...	@@ -66,6 +72,7 @@ pub(crate) enum EntitlementsSource {
66	72	#[derive(Clone, Debug, PartialEq)]
67	73	pub(crate) struct IpaApp {
68	74	pub(crate) metadata: AppMetadata,
	75	+ pub(crate) nested_bundles: Vec<NestedBundle>,
69	76	pub(crate) path: String,
70	77	pub(crate) icon_path: Option<String>,
71	78	pub(crate) entitlements: Vec<AppEntitlement>,

...	...	@@ -6,7 +6,8 @@ pub(crate) mod ipa;
6	6
7	7	pub(crate) use adi::*;
8	8	pub(crate) use developer::{
9		- DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate, DeveloperTeam,
	9	+ DeveloperAccount, DeveloperAppId, DeveloperAppIdCapability, DeveloperCertificate,
	10	+ DeveloperDevice, DeveloperTeam,
10	11	};
11	12	pub(crate) use device::*;
12	13	pub(crate) use identity::*;

...	...	@@ -8,8 +8,8 @@ use crate::app::effects::{
8	8	};
9	9	use crate::app::models::{
10	10	AccountOption, AdiBackendKind, AdiBackendOption, AdiProvisioningState, AppEntitlement,
11		- AppIdOption, AppMetadataField, AppOption, DevelopmentCertificateOption, EntitlementValue,
12		- MachineIdentity, SupportedDeviceFamily, TeamOption,
	11	+ AppIdOption, AppMetadataField, AppOption, DeveloperDeviceOption, DevelopmentCertificateOption,
	12	+ DeviceOption, EntitlementValue, MachineIdentity, SupportedDeviceFamily, TeamOption,
13	13	};
14	14	use crate::app::preferences::ThemePreference;
15	15	use crate::app::state::SideloaderState;
...	...	@@ -62,6 +62,7 @@ struct TeamSettingsSnapshot {
62	62	selected_certificate: usize,
63	63	auto_app_id: bool,
64	64	selected_app_id: usize,
	65	+ selected_device: Option<DeviceOption>,
65	66	}
66	67
67	68	#[derive(Clone)]
...	...	@@ -108,6 +109,12 @@ pub(crate) struct SettingsWindow {
108	109	app_detail_edit: Option<AppDetailEdit>,
109	110	app_id_add_form: Option<AppIdAddForm>,
110	111	app_id_edit_form: Option<AppIdEditForm>,
	112	+ developer_device_add_form: Option<DeveloperDeviceAddForm>,
	113	+ developer_devices: Vec<DeveloperDeviceOption>,
	114	+ developer_devices_team_id: Option<String>,
	115	+ developer_devices_loading: bool,
	116	+ developer_devices_error: Option<SharedString>,
	117	+ developer_devices_request_generation: u64,
111	118	selected_entitlement: Option<usize>,
112	119	entitlement_edit: Option<EntitlementEdit>,
113	120	entitlement_type_picker_open: bool,
...	...	@@ -313,6 +320,13 @@ struct AppIdEditForm {
313	320	capabilities: Vec<AppIdCapabilityEdit>,
314	321	}
315	322
	323	+#[derive(Clone)]
	324	+struct DeveloperDeviceAddForm {
	325	+ team_id: String,
	326	+ name: Entity<InputState>,
	327	+ udid: Entity<InputState>,
	328	+}
	329	+
316	330	#[derive(Clone)]
317	331	struct AppIdCapabilityEdit {
318	332	key: String,
...	...	@@ -460,6 +474,12 @@ fn settings_task_is_current(
460	474	current_generation == task_generation && current_mode == expected_mode
461	475	}
462	476
	477	+fn developer_device_form_defaults(selected_device: Option<&DeviceOption>) -> (String, String) {
	478	+ selected_device
	479	+ .map(\|device\| (device.name.clone(), device.udid.clone()))
	480	+ .unwrap_or_default()
	481	+}
	482	+
463	483	impl SettingsSnapshot {
464	484	fn from_state(mode: &SettingsMode, state: &SideloaderState) -> Option<Self> {
465	485	match mode {
...	...	@@ -483,6 +503,7 @@ impl SettingsSnapshot {
483	503	selected_certificate: state.selected_certificate,
484	504	auto_app_id: state.auto_app_id,
485	505	selected_app_id: state.selected_app_id,
	506	+ selected_device: state.selected_device().cloned(),
486	507	}))
487	508	}
488	509	SettingsMode::AppSettings { app_index } => {
...	...	@@ -520,7 +541,13 @@ impl SettingsWindow {
520	541	) -> Self {
521	542	let focus_handle = cx.focus_handle();
522	543	window.focus(&focus_handle, cx);
523		- cx.defer_in(window, \|_, _, cx\| cx.notify());
	544	+ cx.defer_in(window, \|settings, window, cx\| {
	545	+ if matches!(settings.mode, SettingsMode::Team) {
	546	+ settings.load_developer_devices(window, cx);
	547	+ } else {
	548	+ cx.notify();
	549	+ }
	550	+ });
524	551	cx.observe_window_appearance(window, \|settings, window, cx\| {
525	552	sync_window_theme(window, cx, settings.theme_preference);
526	553	cx.notify();
...	...	@@ -545,6 +572,12 @@ impl SettingsWindow {
545	572	app_detail_edit: None,
546	573	app_id_add_form: None,
547	574	app_id_edit_form: None,
	575	+ developer_device_add_form: None,
	576	+ developer_devices: Vec::new(),
	577	+ developer_devices_team_id: None,
	578	+ developer_devices_loading: false,
	579	+ developer_devices_error: None,
	580	+ developer_devices_request_generation: 0,
548	581	selected_entitlement: None,
549	582	entitlement_edit: None,
550	583	entitlement_type_picker_open: false,
...	...	@@ -858,6 +891,13 @@ impl SettingsWindow {
858	891	self.app_detail_edit = None;
859	892	self.app_id_add_form = None;
860	893	self.app_id_edit_form = None;
	894	+ self.developer_device_add_form = None;
	895	+ self.developer_devices.clear();
	896	+ self.developer_devices_team_id = None;
	897	+ self.developer_devices_loading = false;
	898	+ self.developer_devices_error = None;
	899	+ self.developer_devices_request_generation =
	900	+ self.developer_devices_request_generation.wrapping_add(1);
861	901	self.selected_entitlement = None;
862	902	self.entitlement_edit = None;
863	903	self.entitlement_type_picker_open = false;
...	...	@@ -871,6 +911,9 @@ impl SettingsWindow {
871	911	window.set_window_title(title);
872	912	window.activate_window();
873	913	window.focus(&self.focus_handle, cx);
	914	+ if matches!(self.mode, SettingsMode::Team) {
	915	+ self.load_developer_devices(window, cx);
	916	+ }
874	917	cx.defer_in(window, \|_, _, cx\| cx.notify());
875	918	cx.notify();
876	919	}
...	...	@@ -1058,7 +1101,7 @@ impl SettingsWindow {
1058	1101	&mut self,
1059	1102	index: usize,
1060	1103	_: &ClickEvent,
1061		- _: &mut Window,
	1104	+ window: &mut Window,
1062	1105	cx: &mut Context<Self>,
1063	1106	) {
1064	1107	let Some(snapshot) = self.team_snapshot(cx) else {
...	...	@@ -1074,7 +1117,323 @@ impl SettingsWindow {
1074	1117	self.app_id_picker_open = false;
1075	1118	self.app_id_add_form = None;
1076	1119	self.app_id_edit_form = None;
1077		- let _ = self.dispatch_parent_action(SettingsParentAction::SelectTeam(index), cx);
	1120	+ self.developer_device_add_form = None;
	1121	+ if self
	1122	+ .dispatch_parent_action(SettingsParentAction::SelectTeam(index), cx)
	1123	+ .is_ok()
	1124	+ {
	1125	+ self.load_developer_devices(window, cx);
	1126	+ }
	1127	+ cx.notify();
	1128	+ }
	1129	+
	1130	+ fn current_developer_team_id(&self, cx: &mut Context<Self>) -> Option<String> {
	1131	+ let snapshot = self.team_snapshot(cx)?;
	1132	+ snapshot
	1133	+ .teams
	1134	+ .get(snapshot.selected_team)
	1135	+ .map(\|team\| team.identifier.clone())
	1136	+ }
	1137	+
	1138	+ fn accepts_developer_device_result(
	1139	+ &self,
	1140	+ task_generation: u64,
	1141	+ task_mode: &SettingsMode,
	1142	+ device_request_generation: u64,
	1143	+ team_id: &str,
	1144	+ cx: &mut Context<Self>,
	1145	+ ) -> bool {
	1146	+ self.accepts_task_result(task_generation, task_mode)
	1147	+ && self.developer_devices_request_generation == device_request_generation
	1148	+ && self.current_developer_team_id(cx).as_deref() == Some(team_id)
	1149	+ }
	1150	+
	1151	+ fn begin_developer_device_request(&mut self, team_id: &str) -> u64 {
	1152	+ self.developer_devices_request_generation =
	1153	+ self.developer_devices_request_generation.wrapping_add(1);
	1154	+ self.developer_devices_team_id = Some(team_id.to_string());
	1155	+ self.developer_devices_loading = true;
	1156	+ self.developer_devices_error = None;
	1157	+ self.developer_devices_request_generation
	1158	+ }
	1159	+
	1160	+ fn apply_developer_device_result(
	1161	+ &mut self,
	1162	+ result: Result<Vec<DeveloperDeviceOption>, AppError>,
	1163	+ team_id: String,
	1164	+ cx: &mut Context<Self>,
	1165	+ ) {
	1166	+ self.developer_devices_loading = false;
	1167	+ self.developer_devices_team_id = Some(team_id);
	1168	+ match result {
	1169	+ Ok(devices) => self.developer_devices = devices,
	1170	+ Err(error) => self.developer_devices_error = Some(error.user_message().into()),
	1171	+ }
	1172	+ cx.notify();
	1173	+ }
	1174	+
	1175	+ fn load_developer_devices(&mut self, window: &mut Window, cx: &mut Context<Self>) {
	1176	+ if !matches!(self.mode, SettingsMode::Team) {
	1177	+ return;
	1178	+ }
	1179	+ let Some(team_id) = self.current_developer_team_id(cx) else {
	1180	+ self.developer_devices_request_generation =
	1181	+ self.developer_devices_request_generation.wrapping_add(1);
	1182	+ self.developer_devices.clear();
	1183	+ self.developer_devices_team_id = None;
	1184	+ self.developer_devices_loading = false;
	1185	+ self.developer_devices_error = None;
	1186	+ cx.notify();
	1187	+ return;
	1188	+ };
	1189	+ if self.developer_devices_loading
	1190	+ && self.developer_devices_team_id.as_deref() == Some(team_id.as_str())
	1191	+ {
	1192	+ return;
	1193	+ }
	1194	+ if self.developer_devices_loading {
	1195	+ self.developer_devices_request_generation =
	1196	+ self.developer_devices_request_generation.wrapping_add(1);
	1197	+ self.developer_devices_loading = false;
	1198	+ self.developer_devices.clear();
	1199	+ self.developer_devices_team_id = Some(team_id.clone());
	1200	+ }
	1201	+ let developer_context = match self.selected_developer_context(cx) {
	1202	+ Ok(context) => context,
	1203	+ Err(error) => {
	1204	+ self.developer_devices_request_generation =
	1205	+ self.developer_devices_request_generation.wrapping_add(1);
	1206	+ self.developer_devices.clear();
	1207	+ self.developer_devices_team_id = Some(team_id);
	1208	+ self.developer_devices_loading = false;
	1209	+ self.developer_devices_error = Some(error.into());
	1210	+ cx.notify();
	1211	+ return;
	1212	+ }
	1213	+ };
	1214	+
	1215	+ let task_generation = self.task_generation();
	1216	+ let task_mode = self.task_mode();
	1217	+ let device_request_generation = self.begin_developer_device_request(&team_id);
	1218	+ self.developer_devices.clear();
	1219	+ let team_id_for_operation = team_id.clone();
	1220	+ cx.spawn_in(window, async move \|settings, cx\| {
	1221	+ let result = cx
	1222	+ .background_spawn(async move {
	1223	+ app_effects::list_developer_devices(developer_context, team_id_for_operation)
	1224	+ .await
	1225	+ })
	1226	+ .await;
	1227	+ let _ = settings.update_in(cx, \|settings, _, cx\| {
	1228	+ if !settings.accepts_developer_device_result(
	1229	+ task_generation,
	1230	+ &task_mode,
	1231	+ device_request_generation,
	1232	+ &team_id,
	1233	+ cx,
	1234	+ ) {
	1235	+ return;
	1236	+ }
	1237	+ settings.apply_developer_device_result(result, team_id, cx);
	1238	+ });
	1239	+ })
	1240	+ .detach();
	1241	+ cx.notify();
	1242	+ }
	1243	+
	1244	+ fn set_developer_device_add_popover(
	1245	+ &mut self,
	1246	+ open: bool,
	1247	+ window: &mut Window,
	1248	+ cx: &mut Context<Self>,
	1249	+ ) {
	1250	+ window.focus(&self.focus_handle, cx);
	1251	+ if self.developer_devices_loading \|\| self.team_refreshing {
	1252	+ return;
	1253	+ }
	1254	+ if !open {
	1255	+ self.developer_device_add_form = None;
	1256	+ cx.notify();
	1257	+ return;
	1258	+ }
	1259	+ let selected_device = self
	1260	+ .team_snapshot(cx)
	1261	+ .and_then(\|snapshot\| snapshot.selected_device);
	1262	+ let Some(team_id) = self.current_developer_team_id(cx) else {
	1263	+ self.developer_devices_error = Some("No developer team is selected.".into());
	1264	+ cx.notify();
	1265	+ return;
	1266	+ };
	1267	+ let (default_name, default_udid) = developer_device_form_defaults(selected_device.as_ref());
	1268	+ let name = cx.new(\|cx\| {
	1269	+ InputState::new(window, cx)
	1270	+ .default_value(default_name)
	1271	+ .placeholder("Development iPhone")
	1272	+ .clean_on_escape()
	1273	+ });
	1274	+ let udid = cx.new(\|cx\| {
	1275	+ InputState::new(window, cx)
	1276	+ .default_value(default_udid)
	1277	+ .placeholder("0000000000000000000000000000000000000000")
	1278	+ .clean_on_escape()
	1279	+ });
	1280	+ self.developer_device_add_form = Some(DeveloperDeviceAddForm {
	1281	+ team_id,
	1282	+ name: name.clone(),
	1283	+ udid,
	1284	+ });
	1285	+ self.developer_devices_error = None;
	1286	+ name.update(cx, \|name, cx\| name.focus(window, cx));
	1287	+ cx.notify();
	1288	+ }
	1289	+
	1290	+ fn cancel_developer_device_add(
	1291	+ &mut self,
	1292	+ _: &ClickEvent,
	1293	+ window: &mut Window,
	1294	+ cx: &mut Context<Self>,
	1295	+ ) {
	1296	+ window.focus(&self.focus_handle, cx);
	1297	+ self.developer_device_add_form = None;
	1298	+ cx.notify();
	1299	+ }
	1300	+
	1301	+ fn submit_developer_device_add(
	1302	+ &mut self,
	1303	+ _: &ClickEvent,
	1304	+ window: &mut Window,
	1305	+ cx: &mut Context<Self>,
	1306	+ ) {
	1307	+ window.focus(&self.focus_handle, cx);
	1308	+ if self.developer_devices_loading \|\| self.team_refreshing {
	1309	+ return;
	1310	+ }
	1311	+ let Some(form) = self.developer_device_add_form.clone() else {
	1312	+ return;
	1313	+ };
	1314	+ if self.current_developer_team_id(cx).as_deref() != Some(form.team_id.as_str()) {
	1315	+ self.developer_device_add_form = None;
	1316	+ self.developer_devices_error =
	1317	+ Some("The selected developer team changed. Add the device again.".into());
	1318	+ cx.notify();
	1319	+ return;
	1320	+ }
	1321	+ let name = form.name.read(cx).value().trim().to_string();
	1322	+ let udid = form.udid.read(cx).value().trim().to_string();
	1323	+ if name.is_empty() {
	1324	+ self.developer_devices_error = Some("Enter a device name.".into());
	1325	+ cx.notify();
	1326	+ return;
	1327	+ }
	1328	+ if udid.is_empty() {
	1329	+ self.developer_devices_error = Some("Enter a device UDID.".into());
	1330	+ cx.notify();
	1331	+ return;
	1332	+ }
	1333	+ let developer_context = match self.selected_developer_context(cx) {
	1334	+ Ok(context) => context,
	1335	+ Err(error) => {
	1336	+ self.developer_devices_error = Some(error.into());
	1337	+ cx.notify();
	1338	+ return;
	1339	+ }
	1340	+ };
	1341	+
	1342	+ let team_id = form.team_id;
	1343	+ let task_generation = self.task_generation();
	1344	+ let task_mode = self.task_mode();
	1345	+ let device_request_generation = self.begin_developer_device_request(&team_id);
	1346	+ self.developer_device_add_form = None;
	1347	+ let team_id_for_operation = team_id.clone();
	1348	+ cx.spawn_in(window, async move \|settings, cx\| {
	1349	+ let result = cx
	1350	+ .background_spawn(async move {
	1351	+ app_effects::add_developer_device(
	1352	+ developer_context,
	1353	+ team_id_for_operation,
	1354	+ name,
	1355	+ udid,
	1356	+ )
	1357	+ .await
	1358	+ })
	1359	+ .await;
	1360	+ let _ = settings.update_in(cx, \|settings, _, cx\| {
	1361	+ if !settings.accepts_developer_device_result(
	1362	+ task_generation,
	1363	+ &task_mode,
	1364	+ device_request_generation,
	1365	+ &team_id,
	1366	+ cx,
	1367	+ ) {
	1368	+ return;
	1369	+ }
	1370	+ settings.apply_developer_device_result(result, team_id, cx);
	1371	+ });
	1372	+ })
	1373	+ .detach();
	1374	+ cx.notify();
	1375	+ }
	1376	+
	1377	+ fn remove_developer_device(
	1378	+ &mut self,
	1379	+ device_id: String,
	1380	+ _: &ClickEvent,
	1381	+ window: &mut Window,
	1382	+ cx: &mut Context<Self>,
	1383	+ ) {
	1384	+ window.focus(&self.focus_handle, cx);
	1385	+ if self.developer_devices_loading \|\| self.team_refreshing {
	1386	+ return;
	1387	+ }
	1388	+ let Some(team_id) = self.current_developer_team_id(cx) else {
	1389	+ self.developer_devices_error = Some("No developer team is selected.".into());
	1390	+ cx.notify();
	1391	+ return;
	1392	+ };
	1393	+ if device_id.trim().is_empty() {
	1394	+ self.developer_devices_error =
	1395	+ Some("The selected device has no portal identifier.".into());
	1396	+ cx.notify();
	1397	+ return;
	1398	+ }
	1399	+ let developer_context = match self.selected_developer_context(cx) {
	1400	+ Ok(context) => context,
	1401	+ Err(error) => {
	1402	+ self.developer_devices_error = Some(error.into());
	1403	+ cx.notify();
	1404	+ return;
	1405	+ }
	1406	+ };
	1407	+
	1408	+ let task_generation = self.task_generation();
	1409	+ let task_mode = self.task_mode();
	1410	+ let device_request_generation = self.begin_developer_device_request(&team_id);
	1411	+ let team_id_for_operation = team_id.clone();
	1412	+ cx.spawn_in(window, async move \|settings, cx\| {
	1413	+ let result = cx
	1414	+ .background_spawn(async move {
	1415	+ app_effects::delete_developer_device(
	1416	+ developer_context,
	1417	+ team_id_for_operation,
	1418	+ device_id,
	1419	+ )
	1420	+ .await
	1421	+ })
	1422	+ .await;
	1423	+ let _ = settings.update_in(cx, \|settings, _, cx\| {
	1424	+ if !settings.accepts_developer_device_result(
	1425	+ task_generation,
	1426	+ &task_mode,
	1427	+ device_request_generation,
	1428	+ &team_id,
	1429	+ cx,
	1430	+ ) {
	1431	+ return;
	1432	+ }
	1433	+ settings.apply_developer_device_result(result, team_id, cx);
	1434	+ });
	1435	+ })
	1436	+ .detach();
1078	1437	cx.notify();
1079	1438	}
1080	1439
...	...	@@ -1238,6 +1597,11 @@ impl SettingsWindow {
1238	1597	self.app_id_picker_open = false;
1239	1598	self.app_id_add_form = None;
1240	1599	self.app_id_edit_form = None;
	1600	+ self.developer_device_add_form = None;
	1601	+ self.developer_devices_request_generation =
	1602	+ self.developer_devices_request_generation.wrapping_add(1);
	1603	+ self.developer_devices_loading = false;
	1604	+ self.developer_devices_error = None;
1241	1605	self.team_refreshing = true;
1242	1606	self.team_refresh_error = None;
1243	1607	self.certificate_error = None;
...	...	@@ -3062,6 +3426,7 @@ mod tests {
3062	3426	"16.0",
3063	3427	vec![SupportedDeviceFamily::IPhone],
3064	3428	),
	3429	+ nested_bundles: Vec::new(),
3065	3430	path: format!("/tmp/{name}.ipa"),
3066	3431	icon_path: None,
3067	3432	icon_override_path: None,
...	...	@@ -3092,6 +3457,7 @@ mod tests {
3092	3457	serial_number: "SERIAL".to_string(),
3093	3458	machine_name: "Mac".to_string(),
3094	3459	private_key_available: true,
	3460	+ certificate_fingerprint: Some("certificate-fingerprint".to_string()),
3095	3461	public_key_fingerprint: Some("fingerprint".to_string()),
3096	3462	}],
3097	3463	}
...	...	@@ -3166,6 +3532,26 @@ mod tests {
3166	3532	));
3167	3533	}
3168	3534
	3535	+ #[test]
	3536	+ fn developer_device_form_uses_selected_device_defaults() {
	3537	+ let device = DeviceOption {
	3538	+ name: "Development iPhone".to_string(),
	3539	+ model: "iPhone".to_string(),
	3540	+ os: "18.0".to_string(),
	3541	+ udid: "00008110-001234567890001E".to_string(),
	3542	+ connection: "USB".to_string(),
	3543	+ };
	3544	+
	3545	+ assert_eq!(
	3546	+ developer_device_form_defaults(Some(&device)),
	3547	+ (device.name.clone(), device.udid.clone())
	3548	+ );
	3549	+ assert_eq!(
	3550	+ developer_device_form_defaults(None),
	3551	+ (String::new(), String::new())
	3552	+ );
	3553	+ }
	3554	+
3169	3555	#[test]
3170	3556	fn settings_snapshots_are_derived_from_latest_parent_state() {
3171	3557	let mut state = sample_state();
...	...	@@ -3208,7 +3594,7 @@ impl Render for SettingsWindow {
3208	3594	let theme_preference = self.theme_preference(cx);
3209	3595	sync_window_theme(window, cx, theme_preference);
3210	3596
3211		- if self.adi_operation.is_some() \|\| self.team_refreshing {
	3597	+ if self.adi_operation.is_some() \|\| self.team_refreshing \|\| self.developer_devices_loading {
3212	3598	self.spinner_turns = (self.spinner_turns + 0.035) % 1.;
3213	3599	window.request_animation_frame();
3214	3600	} else {
...	...	@@ -3231,6 +3617,10 @@ impl Render for SettingsWindow {
3231	3617	let app_settings_error = self.app_settings_error.clone();
3232	3618	let app_id_add_form = self.app_id_add_form.clone();
3233	3619	let app_id_edit_form = self.app_id_edit_form.clone();
	3620	+ let developer_device_add_form = self.developer_device_add_form.clone();
	3621	+ let developer_devices = self.developer_devices.clone();
	3622	+ let developer_devices_loading = self.developer_devices_loading;
	3623	+ let developer_devices_error = self.developer_devices_error.clone();
3234	3624	let selected_entitlement = self.selected_entitlement;
3235	3625	let entitlement_edit = self.entitlement_edit.clone();
3236	3626	let entitlement_type_picker_open = self.entitlement_type_picker_open;
...	...	@@ -3257,6 +3647,10 @@ impl Render for SettingsWindow {
3257	3647	app_id_picker_open,
3258	3648	app_id_add_form: app_id_add_form.as_ref(),
3259	3649	app_id_edit_form: app_id_edit_form.as_ref(),
	3650	+ developer_devices: &developer_devices,
	3651	+ developer_devices_loading,
	3652	+ developer_device_add_form: developer_device_add_form.as_ref(),
	3653	+ developer_devices_error,
3260	3654	team_refreshing,
3261	3655	team_refresh_error,
3262	3656	certificate_error,

...	...	@@ -70,11 +70,14 @@ pub(super) fn render(props: AppViewProps<'_>, cx: &mut Context<SettingsWindow>)
70	70	app_detail_edit,
71	71	cx,
72	72	))
73		- .child(app_detail_row(
	73	+ .child(app_detail_row_with_display_value(
74	74	AppMetadataField::BundleId,
75	75	app,
76	76	true,
77	77	app_detail_edit,
	78	+ crate::app::entitlements::effective_bundle_identifier_for_app(
	79	+ app, team_id,
	80	+ ),
78	81	cx,
79	82	))
80	83	.child(app_detail_row(
...	...	@@ -210,9 +213,34 @@ fn app_detail_row(
210	213	editable: bool,
211	214	edit: Option<&AppDetailEdit>,
212	215	cx: &mut Context<SettingsWindow>,
	216	+) -> gpui::Div {
	217	+ app_detail_row_inner(field, app, editable, edit, None, cx)
	218	+}
	219	+
	220	+fn app_detail_row_with_display_value(
	221	+ field: AppMetadataField,
	222	+ app: &AppOption,
	223	+ editable: bool,
	224	+ edit: Option<&AppDetailEdit>,
	225	+ display_value: String,
	226	+ cx: &mut Context<SettingsWindow>,
	227	+) -> gpui::Div {
	228	+ app_detail_row_inner(field, app, editable, edit, Some(display_value), cx)
	229	+}
	230	+
	231	+fn app_detail_row_inner(
	232	+ field: AppMetadataField,
	233	+ app: &AppOption,
	234	+ editable: bool,
	235	+ edit: Option<&AppDetailEdit>,
	236	+ display_value: Option<String>,
	237	+ cx: &mut Context<SettingsWindow>,
213	238	) -> gpui::Div {
214	239	let is_editing = edit.is_some_and(\|edit\| edit.field() == field);
215	240	let changed = app.field_is_overridden(field);
	241	+ let effective_changed = display_value
	242	+ .as_deref()
	243	+ .is_some_and(\|value\| value != app.field_display_value(field));
216	244
217	245	div()
218	246	.min_w_0()
...	...	@@ -241,9 +269,13 @@ fn app_detail_row(
241	269	.min_w_0()
242	270	.flex_1()
243	271	.text_sm()
244		- .text_color(rgb(if changed { 0x173f45 } else { 0x405057 }))
	272	+ .text_color(rgb(if changed \|\| effective_changed {
	273	+ 0x173f45
	274	+ } else {
	275	+ 0x405057
	276	+ }))
245	277	.text_ellipsis()
246		- .child(app.field_display_value(field))
	278	+ .child(display_value.unwrap_or_else(\|\| app.field_display_value(field)))
247	279	},
248	280	)
249	281	.when(editable, \|this\| {

...	...	@@ -14,6 +14,10 @@ pub(super) struct DeveloperViewProps<'a> {
14	14	pub(super) app_id_picker_open: bool,
15	15	pub(super) app_id_add_form: Option<&'a AppIdAddForm>,
16	16	pub(super) app_id_edit_form: Option<&'a AppIdEditForm>,
	17	+ pub(super) developer_devices: &'a [DeveloperDeviceOption],
	18	+ pub(super) developer_devices_loading: bool,
	19	+ pub(super) developer_device_add_form: Option<&'a DeveloperDeviceAddForm>,
	20	+ pub(super) developer_devices_error: Option<SharedString>,
17	21	pub(super) team_refreshing: bool,
18	22	pub(super) team_refresh_error: Option<SharedString>,
19	23	pub(super) certificate_error: Option<SharedString>,
...	...	@@ -34,6 +38,10 @@ pub(super) fn render(props: DeveloperViewProps<'_>, cx: &mut Context<SettingsWin
34	38	app_id_picker_open,
35	39	app_id_add_form,
36	40	app_id_edit_form,
	41	+ developer_devices,
	42	+ developer_devices_loading,
	43	+ developer_device_add_form,
	44	+ developer_devices_error,
37	45	team_refreshing,
38	46	team_refresh_error,
39	47	certificate_error,
...	...	@@ -69,6 +77,17 @@ pub(super) fn render(props: DeveloperViewProps<'_>, cx: &mut Context<SettingsWin
69	77	},
70	78	cx,
71	79	));
	80	+ content = content.child(developer_device_section(
	81	+ DeveloperDeviceSectionProps {
	82	+ team,
	83	+ devices: developer_devices,
	84	+ loading: developer_devices_loading,
	85	+ team_refreshing,
	86	+ add_form: developer_device_add_form,
	87	+ operation_error: developer_devices_error,
	88	+ },
	89	+ cx,
	90	+ ));
72	91	content = content.child(developer_logout_button(cx));
73	92
74	93	settings_window_shell()
...	...	@@ -493,14 +512,11 @@ fn missing_private_key_warning(
493	512	.text_xs()
494	513	.font_weight(FontWeight::SEMIBOLD)
495	514	.text_color(rgb(0x7a5613))
496		- .child("Private key missing"),
	515	+ .child("Managed private key missing"),
497	516	)
498		- .child(
499		- div()
500		- .text_xs()
501		- .text_color(rgb(0x7a6a50))
502		- .child("Import the matching private key to use this certificate."),
503		- ),
	517	+ .child(div().text_xs().text_color(rgb(0x7a6a50)).child(
	518	+ "Import the matching PEM key for Super Sideloader to use this certificate.",
	519	+ )),
504	520	)
505	521	.child(
506	522	surface_button("import-certificate-key")
...	...	@@ -1117,6 +1133,257 @@ fn app_id_icon_button(
1117	1133	.child(icon_button_surface(icon, 0xebf1f0, 0xdfe8e6, 0x53666d))
1118	1134	}
1119	1135
	1136	+struct DeveloperDeviceSectionProps<'a> {
	1137	+ team: Option<&'a TeamOption>,
	1138	+ devices: &'a [DeveloperDeviceOption],
	1139	+ loading: bool,
	1140	+ team_refreshing: bool,
	1141	+ add_form: Option<&'a DeveloperDeviceAddForm>,
	1142	+ operation_error: Option<SharedString>,
	1143	+}
	1144	+
	1145	+fn developer_device_section(
	1146	+ props: DeveloperDeviceSectionProps<'_>,
	1147	+ cx: &mut Context<SettingsWindow>,
	1148	+) -> gpui::Div {
	1149	+ let DeveloperDeviceSectionProps {
	1150	+ team,
	1151	+ devices,
	1152	+ loading,
	1153	+ team_refreshing,
	1154	+ add_form,
	1155	+ operation_error,
	1156	+ } = props;
	1157	+ let disabled = team.is_none() \|\| loading \|\| team_refreshing;
	1158	+
	1159	+ developer_settings_section(
	1160	+ "Devices",
	1161	+ "Registered development devices available to provisioning profiles.",
	1162	+ div()
	1163	+ .flex()
	1164	+ .flex_col()
	1165	+ .gap_3()
	1166	+ .child(
	1167	+ div()
	1168	+ .flex()
	1169	+ .items_center()
	1170	+ .justify_between()
	1171	+ .gap_3()
	1172	+ .child(
	1173	+ div()
	1174	+ .text_xs()
	1175	+ .text_color(rgb(0x6a7a81))
	1176	+ .child(match devices.len() {
	1177	+ 0 => "No devices".to_string(),
	1178	+ 1 => "1 registered device".to_string(),
	1179	+ count => format!("{count} registered devices"),
	1180	+ }),
	1181	+ )
	1182	+ .child(developer_device_add_button(disabled, add_form, cx)),
	1183	+ )
	1184	+ .when(loading, \|this\| {
	1185	+ this.child(
	1186	+ div()
	1187	+ .rounded_md()
	1188	+ .border_1()
	1189	+ .border_color(rgb(0xd8e0df))
	1190	+ .bg(rgb(0xf6f9f9))
	1191	+ .p_3()
	1192	+ .text_xs()
	1193	+ .text_color(rgb(0x6a7a81))
	1194	+ .child("Loading registered devices..."),
	1195	+ )
	1196	+ })
	1197	+ .when(!loading && team.is_some() && devices.is_empty(), \|this\| {
	1198	+ this.child(empty_state(
	1199	+ "No development devices are registered for this team.",
	1200	+ ))
	1201	+ })
	1202	+ .when(!loading && team.is_some(), \|this\| {
	1203	+ this.children(
	1204	+ devices
	1205	+ .iter()
	1206	+ .enumerate()
	1207	+ .map(\|(index, device)\| developer_device_row(device, index, disabled, cx)),
	1208	+ )
	1209	+ })
	1210	+ .when(team.is_none(), \|this\| {
	1211	+ this.child(disabled_select_placeholder(
	1212	+ "No developer team",
	1213	+ "Load a developer team first.",
	1214	+ "Device management unavailable",
	1215	+ ))
	1216	+ })
	1217	+ .when_some(operation_error, \|this, error\| {
	1218	+ this.child(refresh_error(error))
	1219	+ }),
	1220	+ )
	1221	+}
	1222	+
	1223	+fn developer_device_add_button(
	1224	+ disabled: bool,
	1225	+ form: Option<&DeveloperDeviceAddForm>,
	1226	+ cx: &mut Context<SettingsWindow>,
	1227	+) -> AnyElement {
	1228	+ let trigger = surface_button("begin-developer-device-add")
	1229	+ .h_7()
	1230	+ .child(action_button_surface(
	1231	+ "Add Device",
	1232	+ 0xebf1f0,
	1233	+ 0xdfe8e6,
	1234	+ 0x53666d,
	1235	+ Some(lucide_icon_tinted("icons/plus.svg", 0x53666d)),
	1236	+ ));
	1237	+
	1238	+ if disabled {
	1239	+ return trigger.opacity(0.45).tab_stop(false).into_any_element();
	1240	+ }
	1241	+
	1242	+ floating_select_popover(
	1243	+ "developer-device-add-popover-scroll",
	1244	+ trigger.cursor_pointer(),
	1245	+ form.is_some(),
	1246	+ cx.listener(\|this, open: &bool, window, cx\| {
	1247	+ this.set_developer_device_add_popover(*open, window, cx);
	1248	+ }),
	1249	+ FloatingPopoverLayout {
	1250	+ width: 420.,
	1251	+ max_height: 260.,
	1252	+ offset_y: 36.,
	1253	+ },
	1254	+ developer_device_add_popover(form, cx),
	1255	+ )
	1256	+ .into_any_element()
	1257	+}
	1258	+
	1259	+fn developer_device_add_popover(
	1260	+ form: Option<&DeveloperDeviceAddForm>,
	1261	+ cx: &mut Context<SettingsWindow>,
	1262	+) -> impl IntoElement {
	1263	+ let Some(form) = form else {
	1264	+ return div()
	1265	+ .p_3()
	1266	+ .text_xs()
	1267	+ .text_color(rgb(0x6a7a81))
	1268	+ .child("Preparing device...");
	1269	+ };
	1270	+
	1271	+ div()
	1272	+ .p_3()
	1273	+ .flex()
	1274	+ .flex_col()
	1275	+ .gap_3()
	1276	+ .child(
	1277	+ div()
	1278	+ .flex()
	1279	+ .flex_col()
	1280	+ .gap_1()
	1281	+ .child(settings_label("Name"))
	1282	+ .child(Input::new(&form.name).small()),
	1283	+ )
	1284	+ .child(
	1285	+ div()
	1286	+ .flex()
	1287	+ .flex_col()
	1288	+ .gap_1()
	1289	+ .child(settings_label("UDID"))
	1290	+ .child(Input::new(&form.udid).small()),
	1291	+ )
	1292	+ .child(
	1293	+ div()
	1294	+ .flex()
	1295	+ .items_center()
	1296	+ .justify_end()
	1297	+ .gap_2()
	1298	+ .child(
	1299	+ surface_button("cancel-developer-device-add")
	1300	+ .h_7()
	1301	+ .cursor_pointer()
	1302	+ .on_click(cx.listener(SettingsWindow::cancel_developer_device_add))
	1303	+ .child(action_button_surface(
	1304	+ "Cancel",
	1305	+ 0xebf1f0,
	1306	+ 0xdfe8e6,
	1307	+ 0x53666d,
	1308	+ None::<gpui::Div>,
	1309	+ )),
	1310	+ )
	1311	+ .child(
	1312	+ surface_button("confirm-developer-device-add")
	1313	+ .h_7()
	1314	+ .cursor_pointer()
	1315	+ .on_click(cx.listener(SettingsWindow::submit_developer_device_add))
	1316	+ .child(primary_action_button_surface(
	1317	+ "Register",
	1318	+ Some(lucide_icon_tinted("icons/plus.svg", 0xffffff)),
	1319	+ )),
	1320	+ ),
	1321	+ )
	1322	+}
	1323	+
	1324	+fn developer_device_row(
	1325	+ device: &DeveloperDeviceOption,
	1326	+ index: usize,
	1327	+ disabled: bool,
	1328	+ cx: &mut Context<SettingsWindow>,
	1329	+) -> impl IntoElement {
	1330	+ let device_id = device.id.clone();
	1331	+ div()
	1332	+ .min_w_0()
	1333	+ .p_3()
	1334	+ .rounded_md()
	1335	+ .border_1()
	1336	+ .border_color(rgb(0xd8e0df))
	1337	+ .bg(rgb(0xffffff))
	1338	+ .flex()
	1339	+ .items_center()
	1340	+ .justify_between()
	1341	+ .gap_3()
	1342	+ .child(
	1343	+ div()
	1344	+ .min_w_0()
	1345	+ .flex_1()
	1346	+ .flex()
	1347	+ .flex_col()
	1348	+ .gap_0p5()
	1349	+ .child(
	1350	+ div()
	1351	+ .text_xs()
	1352	+ .font_weight(FontWeight::SEMIBOLD)
	1353	+ .text_color(rgb(0x24333a))
	1354	+ .whitespace_normal()
	1355	+ .child(device.name.clone()),
	1356	+ )
	1357	+ .child(
	1358	+ div()
	1359	+ .text_xs()
	1360	+ .text_color(rgb(0x6a7a81))
	1361	+ .whitespace_normal()
	1362	+ .child(device.udid.clone()),
	1363	+ ),
	1364	+ )
	1365	+ .child(
	1366	+ surface_button(("remove-developer-device", index))
	1367	+ .flex_none()
	1368	+ .w_7()
	1369	+ .h_7()
	1370	+ .when(disabled, \|this\| this.opacity(0.45).tab_stop(false))
	1371	+ .when(!disabled, \|this\| {
	1372	+ this.cursor_pointer().on_click(cx.listener(
	1373	+ move \|settings, event, window, cx\| {
	1374	+ settings.remove_developer_device(device_id.clone(), event, window, cx)
	1375	+ },
	1376	+ ))
	1377	+ })
	1378	+ .child(icon_button_surface(
	1379	+ "icons/trash-2.svg",
	1380	+ 0xf4e9e7,
	1381	+ 0xfff7f6,
	1382	+ 0x7d3430,
	1383	+ )),
	1384	+ )
	1385	+}
	1386	+
1120	1387	fn settings_app_id_row(app_id: &AppIdOption, index: usize, selected: bool) -> Button {
1121	1388	select_option_button(
1122	1389	("app-id-row", index),
1123	1390