Support XCFramework Signatures

[andre-alves]

Starting on May 1st, Apple will require that the frameworks on this list are signed (if they are distributed as binary).

I didn't find any documentation showing how this validation will be done by Apple, but I did a demo with Xcode + Lottie 4.4.1 (which is already being distributed with signature and privacy manifest).

There is a new directory Signatures inside the .ipa that Xcode 15 creates:

Seems likely that Apple will use this Signatures directory to validate frameworks in AppStoreConnect. If that's true, Bazel will need to support this directory to avoid blocking the upload of apps.

I still haven't found how to generate this .signature file. I just know that it is a plist containing certificate data.

My demo is available here: https://github.com/andre-alves/privacy_demo

[andre-alves]

It's still unknown if Apple is going to these .signature files for validation. I tried asking them but got no answer.

However, I did some research and figured out how to create .signature files. Let me share what I have learned so far.

First, there is no public command line for generating these files directly. Xcode uses the private builtin-process-xcframework to do the work:

ProcessXCFramework /Users/andre.alves/Library/Developer/Xcode/DerivedData/PrivacyDemo-asbbylacalqzukgbxiibeztzjvug/SourcePackages/artifacts/lottie-spm/Lottie/Lottie.xcframework /Users/andre.alves/Library/Developer/Xcode/DerivedData/PrivacyDemo-asbbylacalqzukgbxiibeztzjvug/Build/Intermediates.noindex/ArchiveIntermediates/PrivacyDemo/BuildProductsPath/Release-iphoneos/Lottie.framework ios
    cd /Users/andre.alves/Documents/Works/privacy_demo/xcode/PrivacyDemo/PrivacyDemo.xcodeproj
    builtin-process-xcframework --xcframework /Users/andre.alves/Library/Developer/Xcode/DerivedData/PrivacyDemo-asbbylacalqzukgbxiibeztzjvug/SourcePackages/artifacts/lottie-spm/Lottie/Lottie.xcframework --platform ios --target-path /Users/andre.alves/Library/Developer/Xcode/DerivedData/PrivacyDemo-asbbylacalqzukgbxiibeztzjvug/Build/Intermediates.noindex/ArchiveIntermediates/PrivacyDemo/BuildProductsPath/Release-iphoneos

Not surprisingly, I couldn't find public documentation on this file spec either. The best documentation is the WWDC23 session: https://developer.apple.com/videos/play/wwdc2023/10061/ explaining the 3 identity types:

• AppleDeveloperProgram
• SelfSigned
• Unsigned

Here is an example: Lottie.xcframework-ios.signature (which is SelfSigned) as generated by Xcode 15.3

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>bundleIndentifier</key>
	<string>Lottie</string>
	<key>cdhashes</key>
	<array>
		<data>
		w0cmYl37knoMwCZkMkAulbpwtFU=
		</data>
		<data>
		Nv8UWkw/O8QOWGHI/HcGq7akcSs=
		</data>
	</array>
	<key>certificates</key>
	<array>
		<data>
		MIIDxjCCAq6gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgDETMBEGA1UEAwwK
		TG90dGllIGlPUzEPMA0GA1UECgwGQWlyYm5iMQswCQYDVQQIDAJDQTELMAkG
		A1UEBhMCVVMxFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xJjAkBgkqhkiG9w0B
		CQEWF2NhbC5zdGVwaGVuc0BhaXJibmIuY29tMB4XDTIzMTIxNDIzMDczMVoX
		DTM5MDIyODIzMDczMVowgYAxEzARBgNVBAMMCkxvdHRpZSBpT1MxDzANBgNV
		BAoMBkFpcmJuYjELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMRYwFAYDVQQH
		DA1TYW4gRnJhbmNpc2NvMSYwJAYJKoZIhvcNAQkBFhdjYWwuc3RlcGhlbnNA
		YWlyYm5iLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALUT
		MrsPnFiax7fVj+0VgfugRcTfalt27eVq1Fa8IIaFjBbS30QLDZejeRBg7i5c
		dVM5//blKSXWEGdUECyBFpD3QYoIVWBcI8uBd4aJh7CL0Cz9FAiJkLSr5zrR
		cb9sHAyssvy7pyxaTJX3C9DmC13cVhefe9qDkDLPUpuBLKiJflDsgq3wzRSt
		BMGe5B+21pnRs899WzJaONirMw5Y4XDqVRAgK18HHTQjvRF0p54qb0D7miWz
		a1TIDMSVuEiiycXJGARRxBf3+5EdirQc7dW8vugtinH00spTKwexhoRgDpxW
		WwLvfsgQE7Z/5TuTTi8EZ6dV/VjzGXN+xVxPdd0CAwEAAaNJMEcwDgYDVR0P
		AQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBSc
		fyDfLp3ND/UU4RgWasRGnqDh0TANBgkqhkiG9w0BAQsFAAOCAQEAlihUB+a3
		yfP/1/cidRxD0oSyz7ChjVeBoDH1GBi7hzeFRc0ojzo7vL++uW0sQE2YU3iY
		vSpxjdhM1fHuaKyxXQsdX3h7kAooneBVoRu9fMP2S1Ek/igu4r0ZDqheQXac
		dEUc8nZMlcG1qo6eOd7ojn/En7wqEmGX71wX71aVFyrlC7quHeqxaOQD1yKk
		QarPi15T7zxHRYUP/1NfJuLPAdJMIDtFeweU758v1KNhuni3e+EV4d/ORhrh
		RQ53qTLr3TMGyj71cNlgmuAIWzp7QEfnsuLs/jcQ63OBWw1aaGnMJgWrtMdG
		oBOIi9XTWFCGpuuIubyFmYx239eY8APHlQ==
		</data>
	</array>
	<key>isSecureTimestamp</key>
	<false/>
	<key>metadata</key>
	<dict>
		<key>library</key>
		<string>Lottie.framework</string>
		<key>platform</key>
		<string>ios</string>
	</dict>
	<key>signatureIdentifier</key>
	<string>892F1B43047B50538F2F46EAD92900DD3D4811F3582178C061A5FB20F111CB26</string>
	<key>signatureType</key>
	<string>SelfSigned</string>
	<key>signed</key>
	<true/>
	<key>source</key>
	<string>embedded</string>
</dict>
</plist>

After playing around with codesign, I was able to successfully generate .signature files with the following script:

https://gist.github.com/andre-alves/af8795e77b9d7cc533ddfd381022fa54

Pass the .xcframework as input, and it outputs the .signature. Supports all 3 identity types.

I tried to make it easy to integrate with rules_apple by using python and only importing the standard library (very similar to rules_apple's tools/ directory). I don't have plans to make this integration for now, since it's not trivial and we don't know if it is required.

[acecilia]

Also, seems to me a per-framework-signature only applies to dynamic frameworks.

The binary of a static framework ends up as part of the main app binary, so there wont be a standalone binary/framework to be used for signature validation: I cannot think of a way to implement signature validation when linking statically. And the most common linkage in Bazel is static 😄

[andre-alves]

Xcode 15.3 generates .signature files for XCFrameworks with static linking too... but yeah, not sure how Apple will use it.

[luispadron]

Anyone able to add the signature tool to the existing xcramework rules? Happy to review / help with PRs that do that.

[andre-alves]

upstream will add support for XCFramework Signatures https://github.com/bazelbuild/rules_apple/commit/106a743f53783e358430640ff60cb6a653c481af 👀