From 174cbb26a93b15ed9faca95f6ebb39a0553ed279 Mon Sep 17 00:00:00 2001 From: FuelBoard Contributor Date: Thu, 13 Aug 2026 17:34:18 +0100 Subject: [PATCH] Packaging: sign appex (Widget.entitlements) then app (App.entitlements). Bare --deep -s - left the appex unsigned and embedded no entitlements, so SideStore re-signed without application-groups and the widget could not read favourites from the shared container --- editor.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/editor.py b/editor.py index 2d8817a..cd5ac83 100644 --- a/editor.py +++ b/editor.py @@ -157,13 +157,24 @@ def start_build_job(content: str) -> str: append_lines(state, "✗ BUILD FAILED — see lines above") return - # 4. Package the IPA (fresh zip; remove the old one first) + # 4. Package the IPA (fresh zip; remove the old one first). + # Sign the APPEX FIRST with Widget.entitlements, then the app + # with App.entitlements. A bare `codesign --deep -s -` leaves + # the appex UNSIGNED and embeds NO entitlements, so SideStore + # re-signs without application-groups/keychain groups and the + # widget cannot read favourites from the shared container. app = REPO / "build" / "Build" / "Products" / "Release-iphoneos" / "FuelBoard.app" work = Path("/tmp/ipa-work") shutil.rmtree(work, ignore_errors=True) (work / "Payload").mkdir(parents=True) shutil.copytree(app, work / "Payload" / "FuelBoard.app") - subprocess.run(["codesign", "--force", "--deep", "-s", "-", + appex = work / "Payload" / "FuelBoard.app" / "PlugIns" / "FuelBoardWidgets.appex" + subprocess.run(["codesign", "--force", "-s", "-", + "--entitlements", str(REPO / "Config" / "Widget.entitlements"), + str(appex)], + check=True, capture_output=True) + subprocess.run(["codesign", "--force", "-s", "-", + "--entitlements", str(REPO / "Config" / "App.entitlements"), str(work / "Payload" / "FuelBoard.app")], check=True, capture_output=True) IPA_SERVE_DIR.mkdir(parents=True, exist_ok=True)