apt/fuelboard-editor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Packaging: sign appex (Widget.entitlements) then app (App.entitlements). Bare --deep -s - left the appex unsigned and embedded no entitlements, so SideStore re-signed without application-groups and the widget could not read favourites from the shared container

Browse Source
This commit is contained in:
FuelBoard Contributor
2026-08-13 17:34:18 +01:00
parent b371acbc43
commit 174cbb26a9
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
editor.py
+13 -2
View File
@@ -157,13 +157,24 @@ def start_build_job(content: str) -> str:
append_lines(state, "✗ BUILD FAILED — see lines above")
return
# 4. Package the IPA (fresh zip; remove the old one first)
# 4. Package the IPA (fresh zip; remove the old one first).
# Sign the APPEX FIRST with Widget.entitlements, then the app
# with App.entitlements. A bare `codesign --deep -s -` leaves
# the appex UNSIGNED and embeds NO entitlements, so SideStore
# re-signs without application-groups/keychain groups and the
# widget cannot read favourites from the shared container.
app = REPO / "build" / "Build" / "Products" / "Release-iphoneos" / "FuelBoard.app"
work = Path("/tmp/ipa-work")
shutil.rmtree(work, ignore_errors=True)
(work / "Payload").mkdir(parents=True)
shutil.copytree(app, work / "Payload" / "FuelBoard.app")
subprocess.run(["codesign", "--force", "--deep", "-s", "-",
appex = work / "Payload" / "FuelBoard.app" / "PlugIns" / "FuelBoardWidgets.appex"
subprocess.run(["codesign", "--force", "-s", "-",
"--entitlements", str(REPO / "Config" / "Widget.entitlements"),
str(appex)],
check=True, capture_output=True)
subprocess.run(["codesign", "--force", "-s", "-",
"--entitlements", str(REPO / "Config" / "App.entitlements"),
str(work / "Payload" / "FuelBoard.app")],
check=True, capture_output=True)
IPA_SERVE_DIR.mkdir(parents=True, exist_ok=True)