将iOS App从发行身份标识为开发者身份 [英] Resign iOS App from a distribution identity to a developer identity

问题描述

我使用一个持续集成工具，该工具使用分发标识和Ad Hoc移动设置来构建应用程序。该应用程序在网站上发送以进行临时部署，并且一切正常。

I use a continuous integration tool that builds an app using a Distribution identity and an Ad Hoc mobile provision. This app is sent on a web site for ad-hoc deployment and everything works well.

但是现在我想在构建工作流程中添加一个步骤来执行UI自动化测试。 Instruments需要使用带有开发者身份签名的应用，因此，我希望/需要（Q.A.团队实际上希望）用开发者证书对以前创建的.ipa进行签名，而不是构建使用开发者证书签名的应用的新版本。我使用以下命令来退出应用程序：

But now I would like to add a step in my build workflow to execute UI Automation tests. Instruments needs an app signed with a Developer identity, so instead of building a new version of the app signed with a developer certificate, I want/need (Q.A. team wants actually) to resign the previous created .ipa with developer certificates. I use the following commands to resign the app :

unzip "App.ipa"
rm -rf "Payload/App.app/_CodeSignature" "Payload/App.app/CodeResources"
cp "Dev.mobileprovision" "Payload/App.app/embedded.mobileprovision"
/usr/bin/codesign -f -s "iPhone Developer: john doe" --resource-rules "Payload/App.app/ResourceRules.plist" "Payload/App.app"

然后，我使用Fruitstrap安装 Payload / App.app（我尝试仅使用组织器进行安装，但它不会改变任何内容），最后我执行了类似以下的工具：

Then I use fruitstrap to install the "Payload/App.app" (I tried to just install using the organizer it does not change anything), and I finally execute Instruments like this :

instruments -w 5f9...3fd -t /Applications/Xcode.app/Contents/Applications/Instruments.app/Contents/PlugIns/AutomationInstrument.bundle/Contents/Resources/Automation.tracetemplate "App" -e UIASCRIPT /Users/../automation-tests-scripts/test-instruments.js -e UIARESULTSPATH /Users/../test-reports/

仪器失败并显示以下错误：

Instruments fail with the following error :

2013-11-28 14:32:56.679 instruments[68408:1007] Permission to debug com.company.App was denied.  The app must be signed with a development identity (e.g. iOS Developer).
2013-11-28 14:32:56.681 instruments[68408:1007] Recording cancelled : At least one target failed to launch; aborting run
Instruments Trace Error : Error Domain=com.apple.instruments Code=1 "Error Starting Recording" UserInfo=0x7fb15b290560 {NSLocalizedDescription=Error Starting Recording, NSLocalizedRecoverySuggestion=At least one target failed to launch; aborting run}
Instruments Trace Error : Failed to start trace.

这些命令可在运行iOS 6.x的iOS设备上运行，但在iOS 7上会因先前的错误而失败仅.x（我尝试了2个iOS 6.x设备，iPhone 4S和5，也尝试了4个运行iOS 7.x的设备）。因此，问题与iOS 7有关。

These commands works on iOS devices running on iOS 6.x but fails with the previous error on iOS 7.x only (I tried 2 iOS 6.x devices, iPhone 4S and 5, and also I tried with 4 devices running iOS 7.x). So the problem is related to iOS 7.

如果应用程序直接使用开发人员身份构建，则效果很好，因此我认为在签名阶段出现了问题。我还在辞职的应用程序上做了一个codesign -d -vvv，它显示了此输出

If the application is built directly with the Developer identity it works well, so i guess that something failed in the signing phase. I Also did a codesign -d -vvv on the resigned app and it shows this output

Executable=/Users/.../App.app/App Identifier=com.company.App
Format=bundle with Mach-O universal (armv7 armv7s) 
CodeDirectory v=20100 size=8547 flags=0x0(none) hashes=420+3 location=embedded 
Hash type=sha1 size=20 CDHash=f00fac8eabf174e88042f2b875505a6cacdd6b0a
Signature size=4326 
Authority=iPhone Developer: john doe (BXX559V2VW)
Authority=Apple Worldwide Developer Relations Certification Authority
Authority=Apple Root CA 
Signed Time=28 nov. 2013 11:56:04
Info.plist entries=27
Sealed Resources version=2 rules=5 files=290
Internal requirements count=2 size=708

我查看了Xcode签名过程，并导出了 CODESIGN_ALLOCATE变量，但我尝试这样做并没有获得更多的成功。

I looked at Xcode signing process and it exports a "CODESIGN_ALLOCATE" variable, I tried that and I did not get more success.

PS：我读过一些有关 iOS开发人员的信息，该证书可以替换证书标题中的 iPhone开发人员，但我没有找到更多有关此的信息。

PS: I read somewhere about the "iOS Developer" that could have replaced "iPhone Developer" in certificates titles, but I did not find more information about this.

推荐答案

我终于发现了问题，在构建过程中使用开发人员身份时，Xcode嵌入了一个包含get的Entitlements.plist文件。 -task-allow => true，在分配标识时，此get-task-allow设置为false。当发行应用程序被辞职时，我没有通过--entitlements选项进行代码签名，因此该应用程序仍然不是有效的乐器​​开发人员应用程序。

I finally found the problem, When a developer identity is used during a build, Xcode embed an Entitlements.plist file that contains a get-task-allow => true, when the identity is distribution, this get-task-allow is set to false. When the "distribution" app was "resigned", I was not passing a --entitlements option to codesign, so the app was still not a valid "developer" app for instruments.

在我的项目中添加一个get-task-allow设置为true的Entitlements.plist文件，并在我的Distribution配置中引用它解决了此问题，现在，在构建应用程序时，它包含get-task-allow => true，当它辞职时，我将这个相同的Entitlements.plist传递给codesign选项。

Adding an Entitlements.plist file with a get-task-allow set to true in my project and referencing it in my Distribution configuration solved the problem, now when the app is built it contains get-task-allow => true, and when it is resigned, I pass this same Entitlements.plist to the codesign option.

现在可以了，我希望Xcode将其他键添加到Entitlements中。该文件不会丢失（因为我在codesign命令调用中使用的那个仅包含get-task-allow键）。

It works for now, I hope that the other keys added by Xcode to the Entitlements file won't miss (since the one I'm using in my codesign command call only contains the get-task-allow key).

这篇关于将iOS App从发行身份标识为开发者身份的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！