Cloud Secrets Storage#9
Merged
Merged
Conversation
Introduce local keychain certificate support and a CI Secrets Wizard UI. Adds new records/enums and ILocalCertificateService to Core.Interfaces for representing local signing identities and CI wizard state. Implements LocalCertificateService which queries the macOS `security` tool, caches identities, matches API certificates to local identities, and can export P12 files (platform-limited; uses macOS security CLI). Adds a large Blazor component CISecretsWizard.razor that provides a multi-step wizard to select platform, distribution, bundle id, certificates, profiles and export CI secrets (including placeholders for P12 export and profile encoding). Updates MauiProgram and ProvisioningProfiles to integrate the new wizard/service (wiring and minor changes to provisioning UI). Includes TODOs/placeholder behavior for P12 export and profile base64 encoding that should be implemented when signing/export flow is completed.
Introduce cloud secrets storage abstractions and implementations and add certificate sync support. - Add cloud secrets abstractions (ICloudSecretsProvider, ICloudSecretsService, ICloudSecretsProviderFactory) and related types (CloudSecretsProviderConfig, provider enums, secret metadata/status records). - Implement providers for AWS Secrets Manager and Azure Key Vault (AwsSecretsManagerProvider, AzureKeyVaultProvider) and add factory (CloudSecretsProviderFactory) and service (CloudSecretsService) to manage provider configs and operations. - Add CertificateSyncService to upload/download P12s, manage per-certificate cloud keys/passwords/metadata, and helpers to import P12 into the local keychain. - Update core interfaces: added optional defaultFileName to IDialogService.ShowFileDialogAsync; added Hash to LocalSigningIdentity; extend ILocalCertificateService with ExportCertificateAsync, DeleteCertificateAsync and InvalidateCache. - Add package references for AWS, Azure, Google Secret Manager and Infisical to the MauiSherpa.Core project file. These changes enable syncing and managing certificate private keys in cloud secret stores and provide pluggable provider support.
Updates CI secrets wizard and certificate pages; minor AppleConnect logging tweak. - AppleConnectService: default certificate platform is now empty string when missing and log line includes platform for easier debugging. - CISecretsWizard.razor: major enhancements: - Conditional installer step support (ShowInstallerStep) and step validation adjustments. - Added P12 export password input and state (p12ExportPassword). - New Build Command section with shell tabs (bash, PowerShell, GitHub Actions), copy button, and generated commands for each shell. - CSS/layout tweaks for search box and new build command styles. - Improved secret generation: attempts to export signing/installer P12s via LocalCertService.ExportP12Async using the provided export password, includes error handling and adds corresponding password and identity secrets; shows loading messages when downloading/exporting and downloads provisioning profile for export. - Helpers added: GetShellLabel, GetBuildCommand, GetTargetFramework, GetMSBuildProperties, GenerateBashCommand, GeneratePowerShellCommand, GenerateGitHubActionsCommand, and CopyBuildCommand. - Reset logic now clears selected shell and P12 password. - Certificates.razor: platform formatting improved (FormatPlatform made instance method), better handling of unknown/empty platforms, added mappings for TV and Vision OS, and adjusted badge ordering/visibility. These changes add CI-friendly outputs, allow exporting protected P12 artifacts for CI use, and improve platform display and logging for certificates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request adds support for multiple cloud secrets providers to the project, enabling secure storage and retrieval of secrets from AWS Secrets Manager, Azure Key Vault, Google Secret Manager, and Infisical. It introduces new provider classes, updates dependencies, and improves logging for certificate management.
Cloud Secrets Provider Integrations:
AwsSecretsManagerProviderclass implementingICloudSecretsProvider, allowing secret operations (store, retrieve, delete, list, existence check) using AWS Secrets Manager. This includes credential configuration, secret name sanitization, and metadata support. (src/MauiSherpa.Core/Services/AwsSecretsManagerProvider.cs)AzureKeyVaultProviderclass implementingICloudSecretsProvider, supporting secret operations via Azure Key Vault with client credentials, base64 encoding for binary values, and key sanitization. (src/MauiSherpa.Core/Services/AzureKeyVaultProvider.cs)Dependency Updates:
AWSSDK.SecretsManager,Azure.Identity,Azure.Security.KeyVault.Secrets,Google.Cloud.SecretManager.V1, andInfisical.Sdkto enable integration with respective cloud providers. (src/MauiSherpa.Core/MauiSherpa.Core.csproj)Certificate Management Logging:
GetCertificatesAsyncto include certificate platform information and updated platform assignment logic for certificates. (src/MauiSherpa.Core/Services/AppleConnectService.cs)