1#!/usr/bin/env python2.7 2# 3# Copyright 2017 Google Inc. 4# 5# Use of this source code is governed by a BSD-style license that can be 6# found in the LICENSE file. 7 8import glob 9import os 10import os.path 11import re 12import shutil 13import subprocess 14import sys 15import tempfile 16 17# Arguments to the script: 18# pkg path to application directory, e.g. out/Debug/dm.app 19# executable and plist should already be in this directory 20# identstr search string (regex fragment) for code signing identity 21# profile path or name of provisioning profile 22pkg,identstr,profile = sys.argv[1:] 23 24# Find the signing identity. 25identity = None 26for line in subprocess.check_output(['security', 'find-identity']).split('\n'): 27 m = re.match(r'''.*\) (.*) "''' + identstr + '"', line) 28 if m: 29 identity = m.group(1) 30if identity is None: 31 print("Signing identity matching '" + identstr + "' not found.") 32 print("Please verify by running 'security find-identity' or checking your keychain.") 33 sys.exit(1) 34 35# Find the mobile provisioning profile. 36mobileprovision = None 37if os.path.isfile(profile): 38 mobileprovision = profile 39else: 40 for p in glob.glob(os.path.join(os.environ['HOME'], 'Library', 'MobileDevice', 41 'Provisioning Profiles', 42 '*.mobileprovision')): 43 if re.search(r'''<key>Name</key> 44\t<string>''' + profile + r'''</string>''', open(p).read(), re.MULTILINE): 45 mobileprovision = p 46if mobileprovision is None: 47 print("Provisioning profile matching '" + profile + "' not found.") 48 print("Please verify that the correct profile is installed in '${HOME}/Library/MobileDevice/Provisioning Profiles' or specify the path directly.") 49 sys.exit(1) 50 51# The .mobileprovision just gets copied into the package. 52shutil.copy(mobileprovision, 53 os.path.join(pkg, 'embedded.mobileprovision')) 54 55# Extract the appliciation identitifer prefix from the .mobileprovision. 56m = re.search(r'''<key>ApplicationIdentifierPrefix</key> 57\t<array> 58\t<string>(.*)</string>''', open(mobileprovision).read(), re.MULTILINE) 59prefix = m.group(1) 60 61app, _ = os.path.splitext(os.path.basename(pkg)) 62 63# Write a minimal entitlements file, then codesign. 64with tempfile.NamedTemporaryFile() as f: 65 f.write(''' 66<plist version="1.0"> 67 <dict> 68 <key>application-identifier</key> <string>{prefix}.com.google.{app}</string> 69 <key>get-task-allow</key> <true/> 70 </dict> 71</plist> 72'''.format(prefix=prefix, app=app)) 73 f.flush() 74 75 subprocess.check_call(['codesign', 76 '--force', 77 '--sign', identity, 78 '--entitlements', f.name, 79 '--timestamp=none', 80 pkg]) 81