add signature script.
This commit is contained in:
aria committed
1 parent
97c2a18c10
commit
855d24bc64
1 file changed
+299
@@ -0,0 +1,299 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -u
|
||||||
|
|
||||||
|
ENTITLEMENT_KEY="com.apple.developer.networking.HotspotConfiguration"
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
TIMESTAMP="$(date '+%Y%m%d-%H%M%S')"
|
||||||
|
LOG_FILE="${SCRIPT_DIR}/ios-hotspot-signature-check-${TIMESTAMP}.log"
|
||||||
|
WORK_DIR=""
|
||||||
|
|
||||||
|
exec > >(tee -a "${LOG_FILE}") 2>&1
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
if [[ -n "${WORK_DIR}" && -d "${WORK_DIR}" ]]; then
|
||||||
|
rm -rf "${WORK_DIR}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
print_usage() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$(basename "$0") /path/to/App.ipa
|
||||||
|
|
||||||
|
Checks:
|
||||||
|
1. embedded.mobileprovision contains ${ENTITLEMENT_KEY}=true
|
||||||
|
2. App executable appears to contain ${ENTITLEMENT_KEY}=true
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
Linux cannot run Apple's codesign tool. The executable check is a best-effort
|
||||||
|
scan of the signed Mach-O payload. For authoritative signed entitlements,
|
||||||
|
verify on macOS with: codesign -d --entitlements :- Your.app
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
fail() {
|
||||||
|
echo "[FAIL] $*"
|
||||||
|
echo
|
||||||
|
echo "Full log: ${LOG_FILE}"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
warn() {
|
||||||
|
echo "[WARN] $*"
|
||||||
|
}
|
||||||
|
|
||||||
|
pass() {
|
||||||
|
echo "[PASS] $*"
|
||||||
|
}
|
||||||
|
|
||||||
|
info() {
|
||||||
|
echo "[INFO] $*"
|
||||||
|
}
|
||||||
|
|
||||||
|
has_command() {
|
||||||
|
command -v "$1" >/dev/null 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
extract_plist_from_binary() {
|
||||||
|
local source_file="$1"
|
||||||
|
local target_file="$2"
|
||||||
|
|
||||||
|
python3 - "$source_file" "$target_file" <<'PY'
|
||||||
|
import sys
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
source = Path(sys.argv[1])
|
||||||
|
target = Path(sys.argv[2])
|
||||||
|
data = source.read_bytes()
|
||||||
|
|
||||||
|
start = data.find(b"<?xml")
|
||||||
|
if start < 0:
|
||||||
|
start = data.find(b"<plist")
|
||||||
|
if start < 0:
|
||||||
|
sys.exit(2)
|
||||||
|
|
||||||
|
end = data.find(b"</plist>", start)
|
||||||
|
if end < 0:
|
||||||
|
sys.exit(3)
|
||||||
|
|
||||||
|
target.write_bytes(data[start:end + len(b"</plist>")])
|
||||||
|
PY
|
||||||
|
}
|
||||||
|
|
||||||
|
check_plist_key_true() {
|
||||||
|
local plist_file="$1"
|
||||||
|
local key="$2"
|
||||||
|
|
||||||
|
python3 - "$plist_file" "$key" <<'PY'
|
||||||
|
import plistlib
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
path = Path(sys.argv[1])
|
||||||
|
key = sys.argv[2]
|
||||||
|
data = path.read_bytes()
|
||||||
|
|
||||||
|
try:
|
||||||
|
value = plistlib.loads(data).get(key)
|
||||||
|
if value is True:
|
||||||
|
print("true")
|
||||||
|
sys.exit(0)
|
||||||
|
if value is None:
|
||||||
|
print("missing")
|
||||||
|
sys.exit(1)
|
||||||
|
print(repr(value))
|
||||||
|
sys.exit(2)
|
||||||
|
except Exception:
|
||||||
|
text = data.decode("utf-8", errors="ignore")
|
||||||
|
pattern = re.compile(
|
||||||
|
r"<key>\s*" + re.escape(key) + r"\s*</key>\s*<true\s*/>",
|
||||||
|
re.IGNORECASE,
|
||||||
|
)
|
||||||
|
if pattern.search(text):
|
||||||
|
print("true")
|
||||||
|
sys.exit(0)
|
||||||
|
if key in text:
|
||||||
|
print("present_but_not_true_or_unparsed")
|
||||||
|
sys.exit(2)
|
||||||
|
print("missing")
|
||||||
|
sys.exit(1)
|
||||||
|
PY
|
||||||
|
}
|
||||||
|
|
||||||
|
find_main_executable() {
|
||||||
|
local app_dir="$1"
|
||||||
|
local info_plist="${app_dir}/Info.plist"
|
||||||
|
|
||||||
|
if [[ -f "${info_plist}" ]] && has_command python3; then
|
||||||
|
local exe_name
|
||||||
|
exe_name="$(python3 - "$info_plist" <<'PY'
|
||||||
|
import plistlib
|
||||||
|
import sys
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
try:
|
||||||
|
info = plistlib.loads(Path(sys.argv[1]).read_bytes())
|
||||||
|
print(info.get("CFBundleExecutable", ""))
|
||||||
|
except Exception:
|
||||||
|
print("")
|
||||||
|
PY
|
||||||
|
)"
|
||||||
|
if [[ -n "${exe_name}" && -f "${app_dir}/${exe_name}" ]]; then
|
||||||
|
printf '%s\n' "${app_dir}/${exe_name}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
find "${app_dir}" -maxdepth 1 -type f ! -name '*.plist' ! -name 'PkgInfo' -printf '%s %p\n' \
|
||||||
|
| sort -nr \
|
||||||
|
| awk 'NR==1 { sub(/^[0-9]+ /, ""); print }'
|
||||||
|
}
|
||||||
|
|
||||||
|
print_section() {
|
||||||
|
echo
|
||||||
|
echo "==== $* ===="
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "iOS Hotspot Configuration Signature Check"
|
||||||
|
echo "Started: $(date -Is)"
|
||||||
|
echo "Script: ${BASH_SOURCE[0]}"
|
||||||
|
echo "Log: ${LOG_FILE}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
print_usage
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
IPA_PATH="${1:-}"
|
||||||
|
if [[ -z "${IPA_PATH}" ]]; then
|
||||||
|
print_usage
|
||||||
|
fail "Missing IPA path."
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f "${IPA_PATH}" ]]; then
|
||||||
|
fail "IPA not found: ${IPA_PATH}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
for cmd in unzip find grep sed awk sort date mktemp tee; do
|
||||||
|
if ! has_command "${cmd}"; then
|
||||||
|
fail "Required command not found: ${cmd}"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if ! has_command python3; then
|
||||||
|
fail "Required command not found: python3"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! has_command openssl; then
|
||||||
|
warn "openssl not found. embedded.mobileprovision will be parsed with a fallback XML extractor."
|
||||||
|
fi
|
||||||
|
|
||||||
|
WORK_DIR="$(mktemp -d)"
|
||||||
|
EXTRACT_DIR="${WORK_DIR}/ipa"
|
||||||
|
mkdir -p "${EXTRACT_DIR}"
|
||||||
|
|
||||||
|
print_section "Input"
|
||||||
|
info "IPA: ${IPA_PATH}"
|
||||||
|
info "IPA size: $(du -h "${IPA_PATH}" | awk '{print $1}')"
|
||||||
|
info "Work dir: ${WORK_DIR}"
|
||||||
|
|
||||||
|
print_section "Extract IPA"
|
||||||
|
unzip -q "${IPA_PATH}" -d "${EXTRACT_DIR}" || fail "Failed to unzip IPA."
|
||||||
|
|
||||||
|
APP_DIR="$(find "${EXTRACT_DIR}/Payload" -maxdepth 1 -type d -name '*.app' | head -n 1)"
|
||||||
|
if [[ -z "${APP_DIR}" ]]; then
|
||||||
|
fail "No .app directory found under Payload."
|
||||||
|
fi
|
||||||
|
pass "Found app bundle: ${APP_DIR}"
|
||||||
|
|
||||||
|
PROFILE_PATH="${APP_DIR}/embedded.mobileprovision"
|
||||||
|
if [[ ! -f "${PROFILE_PATH}" ]]; then
|
||||||
|
fail "embedded.mobileprovision not found in app bundle."
|
||||||
|
fi
|
||||||
|
pass "Found provisioning profile: ${PROFILE_PATH}"
|
||||||
|
|
||||||
|
EXECUTABLE_PATH="$(find_main_executable "${APP_DIR}")"
|
||||||
|
if [[ -z "${EXECUTABLE_PATH}" || ! -f "${EXECUTABLE_PATH}" ]]; then
|
||||||
|
fail "Could not find main app executable."
|
||||||
|
fi
|
||||||
|
pass "Found main executable: ${EXECUTABLE_PATH}"
|
||||||
|
|
||||||
|
print_section "Provisioning Profile Entitlements"
|
||||||
|
PROFILE_PLIST="${WORK_DIR}/embedded.mobileprovision.plist"
|
||||||
|
|
||||||
|
PROFILE_EXTRACTED=0
|
||||||
|
if has_command openssl; then
|
||||||
|
if openssl smime -inform DER -verify -noverify -in "${PROFILE_PATH}" -out "${PROFILE_PLIST}" >/dev/null 2>&1; then
|
||||||
|
PROFILE_EXTRACTED=1
|
||||||
|
pass "Decoded embedded.mobileprovision with openssl smime."
|
||||||
|
elif openssl cms -inform DER -verify -noverify -in "${PROFILE_PATH}" -out "${PROFILE_PLIST}" >/dev/null 2>&1; then
|
||||||
|
PROFILE_EXTRACTED=1
|
||||||
|
pass "Decoded embedded.mobileprovision with openssl cms."
|
||||||
|
else
|
||||||
|
warn "openssl could not decode embedded.mobileprovision; trying XML fallback."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${PROFILE_EXTRACTED}" -eq 0 ]]; then
|
||||||
|
if extract_plist_from_binary "${PROFILE_PATH}" "${PROFILE_PLIST}"; then
|
||||||
|
pass "Extracted plist XML from embedded.mobileprovision."
|
||||||
|
else
|
||||||
|
fail "Could not extract plist from embedded.mobileprovision."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
PROFILE_RESULT="$(check_plist_key_true "${PROFILE_PLIST}" "${ENTITLEMENT_KEY}" 2>&1)"
|
||||||
|
PROFILE_STATUS=$?
|
||||||
|
echo "Profile entitlement value: ${PROFILE_RESULT}"
|
||||||
|
if [[ "${PROFILE_STATUS}" -eq 0 ]]; then
|
||||||
|
pass "Provisioning profile contains ${ENTITLEMENT_KEY}=true"
|
||||||
|
else
|
||||||
|
fail "Provisioning profile does not contain ${ENTITLEMENT_KEY}=true"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Profile entitlement context:"
|
||||||
|
grep -n -A2 -B1 "${ENTITLEMENT_KEY}" "${PROFILE_PLIST}" || true
|
||||||
|
|
||||||
|
print_section "Signed App Entitlements"
|
||||||
|
echo "Linux cannot run Apple's codesign. This is a best-effort scan of the app executable."
|
||||||
|
|
||||||
|
if grep -a -q "${ENTITLEMENT_KEY}" "${EXECUTABLE_PATH}"; then
|
||||||
|
pass "Executable contains entitlement key string: ${ENTITLEMENT_KEY}"
|
||||||
|
else
|
||||||
|
fail "Executable does not contain entitlement key string. Signed app entitlements likely do not include Hotspot Configuration."
|
||||||
|
fi
|
||||||
|
|
||||||
|
EXEC_ENTITLEMENTS_PLIST="${WORK_DIR}/signed-entitlements-heuristic.plist"
|
||||||
|
if extract_plist_from_binary "${EXECUTABLE_PATH}" "${EXEC_ENTITLEMENTS_PLIST}"; then
|
||||||
|
echo "Extracted executable plist candidate: ${EXEC_ENTITLEMENTS_PLIST}"
|
||||||
|
EXEC_RESULT="$(check_plist_key_true "${EXEC_ENTITLEMENTS_PLIST}" "${ENTITLEMENT_KEY}" 2>&1)"
|
||||||
|
EXEC_STATUS=$?
|
||||||
|
echo "Executable entitlement value: ${EXEC_RESULT}"
|
||||||
|
if [[ "${EXEC_STATUS}" -eq 0 ]]; then
|
||||||
|
pass "Executable plist candidate contains ${ENTITLEMENT_KEY}=true"
|
||||||
|
else
|
||||||
|
warn "Executable contains entitlement key, but extracted plist candidate did not prove value=true."
|
||||||
|
warn "Use macOS codesign for authoritative validation."
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "Executable entitlement context:"
|
||||||
|
grep -n -A2 -B1 "${ENTITLEMENT_KEY}" "${EXEC_ENTITLEMENTS_PLIST}" || true
|
||||||
|
else
|
||||||
|
warn "Could not extract XML plist from executable. Key string was present, but value=true was not proven."
|
||||||
|
warn "Use macOS codesign for authoritative validation."
|
||||||
|
fi
|
||||||
|
|
||||||
|
print_section "Summary"
|
||||||
|
pass "Provisioning profile Hotspot entitlement: true"
|
||||||
|
pass "Executable Hotspot entitlement key: present"
|
||||||
|
echo
|
||||||
|
echo "Full log written to:"
|
||||||
|
echo " ${LOG_FILE}"
|
||||||
|
echo
|
||||||
|
echo "Authoritative macOS check, if available:"
|
||||||
|
echo " codesign -d --entitlements :- Your.app"
|
||||||
Reference in new issue
Block a user