resign-ios-app

#!/usr/bin/env bash
set -e

# Resigns an iOS app with a given provisioning profile, distribution certificate, and, optionally, a new bundle identifier.
# This script expects to be invoked with at least three arguments.
#   $1 is expected to be the path of the .ipa to be resigned
#   $2 is expected to be the path of the .mobileprovision to resign $1 with
#   $3 is expected to be the name of the distribution certificate in the Keychain to resign $1 with
#   $4 is optional. If included, this will be the new bundle identifier of the resigned app. If not included, the original bundle identifier will be used.

log_err() {
    printf "${redColor}$*${noColor}\n"
}

log_info() {
    printf "$*\n"
}

greenColor='\033[0;32m'
redColor='\033[0;31m'
noColor='\033[0m'

ipa=$1
provisioningProfile=$2
distributionCertificate=$3
bundleIdentifier=$4

ext=${ipa##*.}
ipa_filename=$(basename "$ipa" ".$ext")
ipa_out="$ipa_filename-resigned.$ext"

if [[ $# -lt 3 ]]; then
    log_err "Expected at least 3 arguments:"
    log_err "- \$1 is a path to .ipa file"
    log_err "- \$2 is a path to .mobileprovision file"
    log_err "- \$3 is the name of a distribution certificate in the Keychain (e.g. \"Apple Distribution: Organization_Name\")"
    log_err "\n4th argument is optional: a new bundle identifier for the resigned app. If not included, the original bundle identifier will be used."
    exit 1
fi

log_info "Unzipping \"$ipa\"..."
unzip -q "$ipa"

log_info "Extracting .app..."
cd Payload
declare -a appsInPayload=()
appsInPayload=$(find . -name '*app' | sed 's|^\./||')
cd ..
if [[ ${#appsInPayload[*]} -gt 1 ]]; then
    log_info "There is more than one .app in Payload/ (${appsInPayload[*]})"
    log_err "Resigning failed"
    exit 1
fi
app=$appsInPayload

log_info "Removing existing _CodeSignature..."
rm -r -f "Payload/$app/_CodeSignature"

log_info "Decoding \"$provisioningProfile\" and writing to ProvisioningProfile.plist..."
security cms -D -i "$provisioningProfile" > ProvisioningProfile.plist 2>&1

log_info "Extracting \"Entitlements\" from ProvisioningProfile.plist and writing to Entitlements.plist..."
/usr/libexec/PlistBuddy -x -c 'Print Entitlements' ProvisioningProfile.plist > Entitlements.plist 2>&1

new_provisioning_app_id=$(/usr/libexec/PlistBuddy -c 'Print :application-identifier' Entitlements.plist)
if [[ "$new_provisioning_app_id" == *"*"* ]]; then
    team_id=$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.developer.team-identifier' ProvisioningProfile.plist)
    info_plist_app_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "Payload/$app/Info.plist")
    log_info "A wildcard provisioning profile was provided, updating application-identifier in the Entitlements.plist to $team_id.$info_plist_app_id"
    /usr/libexec/PlistBuddy -c "Set :application-identifier $team_id.$info_plist_app_id" Entitlements.plist
fi

log_info "Embedding \"$provisioningProfile\" into \"$app\"..."
cp "$provisioningProfile" "Payload/$app/embedded.mobileprovision"
if [[ -n $bundleIdentifier ]]; then
    log_info "Resigning \"$app\" with bundle identifier \"$bundleIdentifier\""
    /usr/libexec/PlistBuddy -x -c "Set :CFBundleIdentifier $bundleIdentifier" "Payload/$app/Info.plist"
else
    log_info "Resigning \"$app\" with existing bundle identifier \"$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "Payload/$app/Info.plist")\""
fi

if [[ -e Payload/$app/Frameworks ]]; then
    cd "Payload/$app/Frameworks"
    log_info "Resigning embedded Swift libraries..."
    swiftLibraries=$(find . -name '*dylib')
    SDK_PATH="/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/iphoneos/"
    for dylib in $swiftLibraries; do
        codesign -f -s "$distributionCertificate" "$dylib"
    done
    frameworks=$(find . -name '*framework')
    log_info "Resigning embedded frameworks..."
    for framework in $frameworks; do
        codesign -f -s "$distributionCertificate" "$framework"
    done
    cd ../../..
fi

log_info "Resigning \"$app\" with certificate \"$distributionCertificate\"..."
codesign -f -s "$distributionCertificate" --entitlements Entitlements.plist "Payload/$app"

log_info "Zipping app data into an .ipa..."
zip -q -r "$ipa_out" Payload SwiftSupport Symbols

log_info "Removing Payload and temp files..."
rm ProvisioningProfile.plist
rm Entitlements.plist
rm -rf Payload

log_info "${greenColor}Resigning successful. Resigned app to $PWD/$ipa_out"