Skip to content

Stamp Xcode build-provenance keys into generated framework Info.plists #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FeodorFitsner merged 1 commit into from
Jul 26, 2026
Merged

Stamp Xcode build-provenance keys into generated framework Info.plists #36

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 81 additions & 6 deletions darwin/xcframework_utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,56 @@ archs=("iphoneos.arm64" "iphonesimulator.arm64" "iphonesimulator.x86_64")

dylib_ext=so

# Build-provenance values that Xcode stamps into every framework Info.plist it
# produces (DT* / BuildMachineOSBuild). The frameworks here are assembled by hand
# from lib-dynload .so's, so without this they carry none of them and the bundle
# doesn't look like it was built by Xcode at all -- which is the most substantive
# difference we could find between our _ssl/_hashlib frameworks and third-party
# OpenSSL xcframeworks that Apple's App Store scan accepts. See flet-dev/flet#6724.
#
# Resolved once per run: identical for every framework built from the same SDK.
sdk_metadata_init() {
[ -n "${sdk_metadata_ready:-}" ] && return

build_machine_os_build=$(sw_vers -buildVersion)
sdk_version=$(xcrun --sdk iphoneos --show-sdk-version)
sdk_build=$(xcrun --sdk iphoneos --show-sdk-build-version)
xcode_build=$(xcodebuild -version | sed -n 's/^Build version //p')

# DTXcode is the Xcode version with the separators dropped, as major(2) +
# minor(1) + patch(1): 26.5 -> "2650", 16.2 -> "1620", 9.4.1 -> "0941".
local xcode_version major minor patch
xcode_version=$(xcodebuild -version | sed -n '1s/^Xcode //p')
IFS=. read -r major minor patch <<< "$xcode_version"
dt_xcode=$(printf '%02d%d%d' "$major" "${minor:-0}" "${patch:-0}")

sdk_metadata_ready=1
}

create_plist() {
name=$1
identifier=$2
plist_file=$3
# "iphoneos" (default) or "iphonesimulator". The previous version hardcoded
# iPhoneOS for both slices, which mislabelled the simulator framework.
platform=${4:-iphoneos}

sdk_metadata_init

local supported_platform
if [ "$platform" = "iphonesimulator" ]; then
supported_platform=iPhoneSimulator
else
supported_platform=iPhoneOS
fi

cat > $plist_file << PLIST_TEMPLATE
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>BuildMachineOSBuild</key>
<string>$build_machine_os_build</string>
<key>CFBundleDevelopmentRegion</key>
<string>en</string>
<key>CFBundleName</key>
Expand All @@ -28,15 +68,50 @@ create_plist() {
<string>1.0</string>
<key>CFBundleSupportedPlatforms</key>
<array>
<string>iPhoneOS</string>
<string>$supported_platform</string>
</array>
<key>MinimumOSVersion</key>
<string>13.0</string>
<key>CFBundleVersion</key>
<string>1</string>
<key>DTCompiler</key>
<string>com.apple.compilers.llvm.clang.1_0</string>
<key>DTPlatformBuild</key>
<string>$sdk_build</string>
<key>DTPlatformName</key>
<string>$platform</string>
<key>DTPlatformVersion</key>
<string>$sdk_version</string>
<key>DTSDKBuild</key>
<string>$sdk_build</string>
<key>DTSDKName</key>
<string>$platform$sdk_version</string>
<key>DTXcode</key>
<string>$dt_xcode</string>
<key>DTXcodeBuild</key>
<string>$xcode_build</string>
<key>MinimumOSVersion</key>
<string>13.0</string>
<key>UIDeviceFamily</key>
<array>
<integer>1</integer>
<integer>2</integer>
</array>
PLIST_TEMPLATE

# Device slice only: the simulator framework is a fat arm64/x86_64 binary, so
# it can't claim an arm64 device capability.
if [ "$platform" != "iphonesimulator" ]; then
cat >> $plist_file << PLIST_CAPABILITIES
<key>UIRequiredDeviceCapabilities</key>
<array>
<string>arm64</string>
</array>
PLIST_CAPABILITIES
fi

cat >> $plist_file << PLIST_TAIL
</dict>
</plist>
PLIST_TEMPLATE
PLIST_TAIL
}

# convert lib-dynloads to xcframeworks
Expand Down Expand Up @@ -66,7 +141,7 @@ create_xcframework_from_dylibs() {
mv "$iphone_dir/$dylib_relative_path" $fd/$framework
echo "Frameworks/$framework.framework/$framework" > "$iphone_dir/$dylib_without_ext.fwork"
install_name_tool -id @rpath/$framework.framework/$framework $fd/$framework
create_plist $framework "org.python.$framework_identifier" $fd/Info.plist
create_plist $framework "org.python.$framework_identifier" $fd/Info.plist iphoneos
echo "$origin_prefix/$dylib_without_ext.fwork" > $fd/$framework.origin

# copy privacy manifest if any
Expand All @@ -84,7 +159,7 @@ create_xcframework_from_dylibs() {
rm "$simulator_arm64_dir/$dylib_without_ext".*.$dylib_ext
rm "$simulator_x86_64_dir/$dylib_without_ext".*.$dylib_ext
install_name_tool -id @rpath/$framework.framework/$framework $fd/$framework
create_plist $framework "org.python.$framework_identifier" $fd/Info.plist
create_plist $framework "org.python.$framework_identifier" $fd/Info.plist iphonesimulator
echo "$origin_prefix/$dylib_without_ext.fwork" > $fd/$framework.origin

# copy privacy manifest if any
Expand Down
Loading