Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[match][sigh][cert] Added checking hash of installed wwdr certificates #20507

Merged
merged 2 commits into from Aug 3, 2022

Conversation

grey442
Copy link
Contributor

@grey442 grey442 commented Jul 25, 2022

Checklist

  • I've run bundle exec rspec from the root directory to see all new and existing tests pass
  • I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
  • I've read the Contribution Guidelines
  • I've updated the documentation if necessary.

Motivation and Context

On different machines can be installed different wwdr certificates, but that certificates have same name "Apple Worldwide Developer Relations Certification Authority"
And It can be a problem in case:
On "new machine" fastlane will install the latest wwdr certificate https://www.apple.com/certificateauthority/AppleWWDRCAG6.cer
On "old machine" fastlane wouldn't install the latest wwdr certificate if other wwdr certificate exists
If provision profiles was created "old machine" than code sign on "old machine" will be successful, but on "new machine" code sign will be failed

Description

  • Added collecting hashes of installed wwdr certificates. Bash command for printing hash took from example man security> find-certificate -a -c MyName -Z login.keychain | grep ^SHA-256
  • Replaced checking count on checking exists hash SHA-256 hash: BDD4ED6E74691F0C2BFD01BE0296197AF1379E0418E2D300EFA9C3BEF642CA30 of certificate https://www.apple.com/certificateauthority/AppleWWDRCAG6.cer

Testing Steps

  1. Remove all wwdr certificates from keychain
  2. Install any wwdr certificates (for example https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer, https://developer.apple.com/certificationauthority/AppleWWDRCA.cer)
  3. Run with --verbose lane where match install provision profiles and certificates
  4. Take a look on debug log to see, fastlane install the latest wwdr certificate https://www.apple.com/certificateauthority/AppleWWDRCAG6.cer

@grey442
Copy link
Contributor Author

grey442 commented Jul 25, 2022

@getaaron I've created PR, could your review this?

@getaaron
Copy link
Collaborator

@grey442 code looks good! could you please login to circleci using github oauth and rerun the build (either in circleCI, or push a blank commit)? the circle builds didn't run on your PR https://support.circleci.com/hc/en-us/articles/360008097173-Why-aren-t-pull-requests-triggering-jobs-on-my-organization-

@getaaron
Copy link
Collaborator

@grey442 friendly bump on the CI tests :)

@grey442
Copy link
Contributor Author

grey442 commented Aug 2, 2022

@getaaron ouch, I have some problem with CircleCI. My Github account was blocked in CircleCI and I will restore access only after few months. Is there another way to run the build? :)

@getaaron
Copy link
Collaborator

getaaron commented Aug 3, 2022

hmm let me try pushing a commit in

@getaaron getaaron merged commit 203f195 into fastlane:master Aug 3, 2022
@fastlane-bot
Copy link

Hey @grey442 👋

Thank you for your contribution to fastlane and congrats on getting this pull request merged 🎉
The code change now lives in the master branch, however it wasn't released to RubyGems yet.
We usually ship about once a week, and your PR will be included in the next one.

Please let us know if this change requires an immediate release by adding a comment here 👍
We'll notify you once we shipped a new release with your changes 🚀

Copy link

@fastlane-bot fastlane-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Congratulations! 🎉 This was released as part of fastlane 2.209.0 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants