signing

package
v1.260828.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 28, 2026 License: MIT Imports: 47 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrEphemeralRecoveryJournalInvalid = errors.New("invalid ephemeral signing recovery journal")

ErrEphemeralRecoveryJournalInvalid means the retained signing recovery journal is structurally unsafe and cannot be repaired by retrying.

View Source 
var ErrReconcilePlanDrift = errors.New("signing reconcile plan no longer matches current state")

ErrReconcilePlanDrift marks a terminal mismatch between a hash-confirmed signing plan and the current local or App Store Connect state. Adapter callers may use errors.Is without receiving the underlying provider detail.

Functions

func RecoverEphemeral added in v1.260816.0 

func RecoverEphemeral(ctx context.Context) error

RecoverEphemeral serializes with every ephemeral signing run and performs only validated crash-journal recovery. It reads no identity or profile and creates no keychain or provisioning profile when no journal exists.

func RunEphemeral added in v1.260816.0 

func RunEphemeral(ctx context.Context, options EphemeralRunOptions, callback func(context.Context) error) error

RunEphemeral runs callback once inside the same audited ephemeral signing boundary used by `asc signing run`. The callback must be synchronous and context-aware; any subprocess it starts must use SanitizedChildEnvironment.

func SanitizedChildEnvironment added in v1.260816.0 

func SanitizedChildEnvironment(base []string) []string

SanitizedChildEnvironment returns the strict environment allowlist for Xcode build and export subprocesses started by an EphemeralRun callback. Authentication, cloud-provider, Git-helper, signing-password, loader, and unrecognized variables are intentionally excluded.

func SigningCommand 

func SigningCommand() *ffcli.Command

SigningCommand returns the signing command with subcommands.

func SigningFetchCommand 

func SigningFetchCommand() *ffcli.Command

SigningFetchCommand returns the signing fetch subcommand.

func SigningReconcileApplyCommand added in v1.260816.0 

func SigningReconcileApplyCommand() *ffcli.Command

SigningReconcileApplyCommand returns the confirmed reconcile executor.

func SigningReconcileCommand added in v1.260816.0 

func SigningReconcileCommand() *ffcli.Command

SigningReconcileCommand returns the artifact-backed signing reconciliation group.

func SigningReconcilePlanCommand added in v1.260816.0 

func SigningReconcilePlanCommand() *ffcli.Command

SigningReconcilePlanCommand returns the read-only reconcile planner.

func SigningRunCommand added in v1.260816.0 

func SigningRunCommand() *ffcli.Command

SigningRunCommand returns the signing run subcommand.

func SigningSyncCommand 

func SigningSyncCommand() *ffcli.Command

SigningSyncCommand returns the signing sync command group.

Types

type EphemeralRunOptions added in v1.260816.0 

type EphemeralRunOptions struct {
	IdentityPath              string
	IdentityPasswordPath      string
	ProfilePath               string
	ReceiptPath               string
	ExpectedCertificateSHA256 string
	ExpectedProfileSHA256     string
}

EphemeralRunOptions identifies the private signing inputs used while an in-process operation runs. Release testing is the only supported purpose.

type PKCS12IdentityInfo added in v1.260816.0 

type PKCS12IdentityInfo struct {
	CertificateSHA256 string    `json:"certificateSha256"`
	CertificateSHA1   string    `json:"certificateSha1"`
	TeamID            string    `json:"teamId"`
	NotBefore         time.Time `json:"notBefore"`
	NotAfter          time.Time `json:"notAfter"`
}

PKCS12IdentityInfo contains only public certificate metadata. It never exposes the source path, password, certificate bytes, or private key.

func InspectPKCS12Identity added in v1.260816.0 

func InspectPKCS12Identity(ctx context.Context, options PKCS12IdentityOptions) (PKCS12IdentityInfo, error)

InspectPKCS12Identity securely reads and validates one PKCS#12 identity and returns only public leaf-certificate metadata. The certificate must be currently valid and its private key must cryptographically match.

type PKCS12IdentityOptions added in v1.260816.0 

type PKCS12IdentityOptions struct {
	IdentityPath         string
	IdentityPasswordPath string
}

PKCS12IdentityOptions identifies a private PKCS#12 identity and its optional password file for read-only inspection.

type ReconcileActionReceiptView added in v1.260816.0 

type ReconcileActionReceiptView struct {
	Kind     string `json:"kind"`
	BundleID string `json:"bundleId,omitempty"`
	Status   string `json:"status"`
	Error    string `json:"error,omitempty"`
}

ReconcileActionReceiptView reports converged action state without internal IDs.

type ReconcileActionView added in v1.260816.0 

type ReconcileActionView struct {
	Kind     string `json:"kind"`
	BundleID string `json:"bundleId,omitempty"`
}

ReconcileActionView describes a planned operation without device identifiers.

type ReconcileApplyOptions added in v1.260816.0 

type ReconcileApplyOptions struct {
	PlanPath         string
	ExpectedPlanHash string
	Confirm          bool
}

ReconcileApplyOptions identifies and confirms an exact protected plan artifact.

type ReconcileCertificateView added in v1.260816.0 

type ReconcileCertificateView struct {
	ResourceID     string `json:"resourceId"`
	SHA256         string `json:"sha256"`
	TeamID         string `json:"teamId"`
	ExpirationDate string `json:"expirationDate"`
}

ReconcileCertificateView is the selected certificate identity safe for orchestration.

type ReconcileCompletionEvidence added in v1.260816.0 

type ReconcileCompletionEvidence struct {
	ReceiptPath   string                     `json:"receiptPath"`
	ReceiptSHA256 string                     `json:"receiptSha256"`
	Profiles      []ReconcileProfileEvidence `json:"profiles"`
}

ReconcileCompletionEvidence identifies exact protected run-local copies of the completed receipt and every profile output. The receipt contents remain bound to the nested plan; only the local read authority is overridden.

type ReconcileExecutionErrorKind added in v1.260816.0 

type ReconcileExecutionErrorKind string

ReconcileExecutionErrorKind is the closed, redacted failure classification returned by the orchestration-safe reconcile adapters. 

const (
	ReconcileExecutionErrorPlanInvalid ReconcileExecutionErrorKind = "plan_invalid"
	ReconcileExecutionErrorPlanDrift   ReconcileExecutionErrorKind = "plan_drift"
	ReconcileExecutionErrorRetryable   ReconcileExecutionErrorKind = "retryable"
)

func ClassifyReconcileExecutionError added in v1.260816.0 

func ClassifyReconcileExecutionError(err error) ReconcileExecutionErrorKind

ClassifyReconcileExecutionError returns a closed adapter-safe category.

type ReconcilePlanOptions added in v1.260816.0 

type ReconcilePlanOptions struct {
	ArchivePath         string
	DevicesFile         string
	CertificateID       string
	CertificateSHA256   string
	MinimumValidityDays int
	MaxMutations        int
	StateDir            string
	Overwrite           bool
}

ReconcilePlanOptions defines a protected, read-only signing reconciliation plan.

type ReconcilePlanView added in v1.260816.0 

type ReconcilePlanView struct {
	SchemaVersion       int                       `json:"schemaVersion"`
	PlanHash            string                    `json:"planHash"`
	Ready               bool                      `json:"ready"`
	MutationCount       int                       `json:"mutationCount"`
	MaxMutations        int                       `json:"maxMutations"`
	DeviceCount         int                       `json:"deviceCount"`
	DeviceSetSHA256     string                    `json:"deviceSetSha256"`
	TeamID              string                    `json:"teamId"`
	ArchivePath         string                    `json:"archivePath"`
	DevicesFile         string                    `json:"devicesFile"`
	StateDir            string                    `json:"stateDir"`
	PlanPath            string                    `json:"planPath"`
	ReceiptPath         string                    `json:"receiptPath"`
	ProfilesDir         string                    `json:"profilesDir"`
	MinimumValidityDays int                       `json:"minimumValidityDays"`
	Certificate         *ReconcileCertificateView `json:"certificate,omitempty"`
	Targets             []ReconcileTargetView     `json:"targets"`
	Actions             []ReconcileActionView     `json:"actions"`
	Blockers            []string                  `json:"blockers,omitempty"`
}

ReconcilePlanView is the redacted orchestration projection of a protected plan.

func ExecuteReconcilePlan added in v1.260816.0 

func ExecuteReconcilePlan(ctx context.Context, options ReconcilePlanOptions) (ReconcilePlanView, error)

ExecuteReconcilePlan creates a protected plan selected by an exact certificate fingerprint.

func ReadReconcilePlan added in v1.260816.0 

func ReadReconcilePlan(options ReconcileApplyOptions) (ReconcilePlanView, error)

ReadReconcilePlan returns the redacted, hash-verified protected plan without authentication, network access, or mutation.

type ReconcileProfileEvidence added in v1.260816.0 

type ReconcileProfileEvidence struct {
	ResourceID string `json:"resourceId"`
	Path       string `json:"path"`
	SHA256     string `json:"sha256"`
}

ReconcileProfileEvidence identifies an exact protected local profile copy that may be used instead of the nested reconcile output during resume.

type ReconcileProfileView added in v1.260816.0 

type ReconcileProfileView struct {
	TargetKind string `json:"targetKind"`
	BundleID   string `json:"bundleId"`
	ResourceID string `json:"resourceId"`
	UUID       string `json:"uuid"`
	Path       string `json:"path"`
	SHA256     string `json:"sha256"`
}

ReconcileProfileView identifies one exact verified local provisioning profile.

type ReconcileReceiptView added in v1.260816.0 

type ReconcileReceiptView struct {
	SchemaVersion int                          `json:"schemaVersion"`
	PlanHash      string                       `json:"planHash"`
	Complete      bool                         `json:"complete"`
	ReceiptPath   string                       `json:"receiptPath"`
	MainProfile   *ReconcileProfileView        `json:"mainProfile,omitempty"`
	Profiles      []ReconcileProfileView       `json:"profiles,omitempty"`
	Actions       []ReconcileActionReceiptView `json:"actions,omitempty"`
}

ReconcileReceiptView is the redacted apply result for orchestration.

func ExecuteReconcileApply added in v1.260816.0 

func ExecuteReconcileApply(ctx context.Context, options ReconcileApplyOptions) (ReconcileReceiptView, error)

ExecuteReconcileApply validates and applies one exact plan after explicit confirmation.

func VerifyReconcileCompletion added in v1.260816.0 

func VerifyReconcileCompletion(ctx context.Context, options ReconcileApplyOptions) (ReconcileReceiptView, error)

VerifyReconcileCompletion revalidates an exact completed receipt without mutation.

func VerifyReconcileCompletionFromArchive added in v1.260816.0 

func VerifyReconcileCompletionFromArchive(ctx context.Context, options ReconcileApplyOptions, archivePath string) (ReconcileReceiptView, error)

VerifyReconcileCompletionFromArchive revalidates an exact completed receipt using a caller-owned immutable archive snapshot as the archive authority. The snapshot is still parsed and compared with the protected plan; this only avoids depending on the mutable original archive path after snapshotting.

func VerifyReconcileCompletionFromEvidence added in v1.260816.0 

func VerifyReconcileCompletionFromEvidence(ctx context.Context, options ReconcileApplyOptions, archivePath string, evidence ReconcileCompletionEvidence) (ReconcileReceiptView, error)

VerifyReconcileCompletionFromEvidence verifies remote completion using an immutable archive snapshot and exact protected run-local receipt/profile copies. It does not depend on the nested generated receipt/profile paths.

type ReconcileTargetView added in v1.260816.0 

type ReconcileTargetView struct {
	Kind     string `json:"kind"`
	BundleID string `json:"bundleId"`
}

ReconcileTargetView identifies a signing target without exposing entitlements.

type SyncResult 

type SyncResult struct {
	Operation       string   `json:"operation"`
	RepoURL         string   `json:"repoUrl"`
	BundleID        string   `json:"bundleId"`
	ProfileType     string   `json:"profileType"`
	Files           []string `json:"files"`
	IdentityPresent bool     `json:"identityPresent"`
	IdentitySHA256  string   `json:"identitySha256,omitempty"`
	SensitiveFiles  []string `json:"sensitiveFiles,omitempty"`
}

SyncResult is the structured output for sync operations.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.