Provisioning profiles like a Pro

Provisioning Profiles like a Pro

Monday, September 9, 13

Jay GravesCTO


Lots of Apps


Ship It


Provisioning ProfilesHow do they work?


Provisioning ProfilesWhat are they?

SMIME / PKCS#7

Originally designed for email signing & encryption.


Read a Provisioning Profilevim


Read a Provisioning Profileopenssl

openssl smime -in ./your.mobileprovision -inform der -verify

openssl smime -in /path/to/your.mobileprovision -inform der -verify -noverify

https://skabber.snipt.net/provisioning-profile-tips-tricks/




Important Valuesapplication-identifier

<key>application-identifier</key>

<string>ABCDEFGHIJK.com.your.bundleid</string>


Important ValuesEntitlements<key>Entitlements</key><dict>...<key>com.apple.developer.ubiquity-container-identifiers</key>...<key>com.apple.developer.ubiquity-kvstore-identifier</key>...<key>get-task-allow</key>...</dict>


Important ValuesProvisionedDevices

<key>ProvisionedDevices</key><array><string>7af8ee3af8e4e13193bd834bab50e1d...</string> <string>a9f0d0477a6d3e8dad0ff984f7ba77e...</string> </array>


Important ValuesUUID

<key>UUID</key>

<string>E0EF8ACE-E83A-475C-9DA7-C67A147659FD</string>


Important ValuesDeveloperCertificates

<key>DeveloperCertificates</key>! <array>! ! <data>MIIFnDCCBISgAwIBAgIIEIdrqpJlb9MwDQYJKoZIhvcNAQEFBQAwgZYxCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApBcHBsZSBJbmMuMSwwKgYDVQQLDCNBcHBsZSBXb3JsZHdpZGUgRGV2ZWxvcGVyIFJlbGF0aW9uczFEMEIGA1UEAww7QXBwbGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMgQ2VydGlmaWNhdGlv...



-----BEGIN CERTIFICATE-----MIIFnDCCBISgAwIBAgIIEIdrqpJlb9MwDQYJKoZIhvcNAQEFBQAwgZYxCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApBcHBsZSBJbmMuMSwwKgYDVQQLDCNBcHBsZSBXb3JsZHdpZGUgRGV2ZWxvcGVyIFJlbGF0aW9uczFEMEIGA1UEAww7QXBwbGUgV29ybGR3aWRlIERldmVsb3BlciBSZWxhdGlvbnMgQ2VydGlmaWNhdGlv...-----END CERTIFICATE-----

openssl x509 -text -in cert.pem



Certificate: Data: Version: 3 (0x2) Serial Number: 10:87:6b:aa:92:65:6f:d3 Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, O=Apple Inc., OU=Apple Worldwide Developer Relations, CN=Apple Worldwide Developer Relations Certification Authority Validity Not Before: Nov 3 21:38:10 2012 GMT Not After : Nov 3 21:38:10 2013 GMT Subject: UID=9K9F9LCV74, CN=iPhone Distribution: Massively Overrated, OU=9K9F9LCV74, O=Massively Overrated, C=US Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:c8:57:f9:cf:af:c2:4d:7a:8a:16:62:47:4b:c2:


Install a Provisioning ProfileDon’t double click them.

Not human readable.


Install a Provisioning ProfileDrag them into the Finder

~/Library/MobileDevice/Provisioning Profiles





Much betterMonday, September 9, 13

Tools for using Provisioning ProfilesTerminal.app


Tools for using Provisioning ProfilesTerminal.app - bash alias

alias prov='openssl smime -inform der -verify -in'


Tools for using Provisioning ProfilesQuicklook Plugin

http://www.macmation.com/blog/2011/10/quicklook-plugin-for-mobile-provision-files/






Tools for using Provisioning ProfilesAutomator Service



http://cl.ly/MTZb


http://cl.ly/MTZb

http://cl.ly/MTZb



Xcode


XcodeHow does it see profiles?

CODE_SIGN_IDENTITY = "iPhone Developer";PROVISIONING_PROFILE = "";


XcodeHow does it see profiles?

CODE_SIGN_IDENTITY = "iPhone Developer: Jay Graves (E6L876QFM6)";

PROVISIONING_PROFILE = "0FEB5831-22D3-4B1D-A973-59ED243E8103";


XcodeBuild error


XcodeUpdate the profile.


XcodeProject Diff


•Automatic Profiles•Good if you don’t have multiple projects.•It can select the wrong profile.•Rules on automatic selection are not defined.

•Specific Profiles•Much more control over which profile is selected.•Can be a pain to update the project file every time a profile is updated.

What does all this mean?



Scenario1 Project 2 Builds


•Add a Duplicate Target•Large project file change•Duplicated all of the Configurations•A 2nd info.plist has been created.

• Add a new Configuration•Still a large project file change•Still duplicated all the build options•Easy to forget new build options

Multiple Build ScenarioPossible Solutions


Multiple Build ScenarioA better solution

.xcconfig file


Multiple Build ScenarioCreate a .xcconfig file


Multiple Build ScenarioCreate a .xcconfig file

CODE_SIGN_IDENTITY = iPhone Distribution: Double Encore

PROVISIONING_PROFILE = 1203C18-8F08-45D8-A5AC-76AD9319CDDC


Multiple Build ScenarioBuild with a .xcconfig file

xcodebuild -xcconfig second_build.xcconfig


This can be better!Automate it

•Every Provisioning Profile contains all the information we need.•CODE_SIGN_IDENTITY is in the DeveloperCertificates•PROVISIONING_PROFILE is the UUID


This can be better!The script

http://bit.ly/xcconfig

#!/usr/bin/env pythonfrom M2Crypto import SMIME, X509, BIO, m2import plistlib...plist = plistlib.readPlistFromString(blob)developerPEM = "-‐-‐-‐-‐-‐BEGIN CERTIFICATE-‐-‐-‐-‐-‐\n%s-‐-‐-‐-‐-‐END CERTIFICATE-‐-‐-‐-‐-‐" % plist["DeveloperCertificates"][0].asBase64()


http://cl.ly/MTZb

http://cl.ly/MTZb



This can be better!The script


developerCert = X509.load_cert_string(developerPEM)items = developerCert.get_subject().get_entries_by_nid(X509.X509_Name.nid["CN"])...open(outXcConfig, 'w').write("CODE_SIGN_IDENTITY = %s\nPROVISIONING_PROFILE = %s\n" % (codeSignIdentity, plist["UUID"]))


http://cl.ly/MTZb

http://cl.ly/MTZb



What have we accomplished?

•Real file based Provisioning Profile selection.•Zero ambiguity about which profile will be selected.•No mismatched Profiles in Xcode’s Code Signing Identity.•Other than downloading the profile from the iOS Dev Center there is no work for you!


OK, OK, Enough with the Provisioning Profiles

already.


Keychain Access


Multiple Keychains


Switch Keychains

security default-keychain -d user -s /FULLPATH/My.keychain

security unlock-keychain -p ******* /FULLPATH/My.keychain

unlock keychain


Switch Keychains

Error: User interaction is not allowed.

unlock keychain


Switch Keychainsunlock keychain


Keychain Error

Code Sign error: Certificate identity 'iPhone Developer: Your Name (NNNNNNNN)' appears more than once in the keychain


OTA Install


md5checksum


md5 checksumdoesn’t work


Install multiple appsat the same time






Thank [email protected]@skabber


Technology

Provisioning profiles like a Pro