• Elias Naur's avatar
    misc/ios: make detect.go more robust · c3cb44fd
    Elias Naur authored
    To enable the exec wrapper go_darwin_arm_exec.go to run binaries
    on iOS devices, the GOIOS_DEV_ID variable needs to be set to a code
    signing identity. The program detect.go attempts to detect suitable
    values for GOIOS_DEV_ID (along with GOIOS_APP_ID and GOIOS_TEAM_ID).
    
    Before this change, detect.go would use "security find-identity
    -p codesigning -v" to list all available identities for code signing
    and pick the first one with "iPhone Developer" in its name. However,
    that pick might be invalid since if it was replaced by an identity
    issued later.
    
    For example, on the mobile builder:
    
    $ security find-identity -p codesigning -v
      1) 0E251DE41FE4490574E475AC320B47F58D6D3635 "lldb_codesign"
      2) 0358588D07AA6A19478981BA405F40A97F95F187 "iPhone Developer: xxx@xxx (2754T98W8E)"
      3) FC6D96F24A3223C98BF7A2C2C5194D82E04CD23E "iPhone Developer: xxx@xxx (2754T98W8E)"
         3 valid identities found
    
    In this case, the identity 0358588D07AA6A19478981BA405F40A97F95F187
    is picked by detect.go even though it has been invalidated by
    FC6D96F24A3223C98BF7A2C2C5194D82E04CD23E.
    
    Instead of attempting to find an identity from the "security
    find-identity" list, use the identity from the CommonName in the
    embedded certificate in the provisioning file. The CommonName only
    lists the identity name (iPhone Developer: xxx@xxx (2754T98W8E)),
    not the fingerprint (FC6D96F24A3223C98BF7A2C2C5194D82E04CD23E), but
    fortunately the codesign tool accepts both.
    
    Identity names may not be unique, as demonstrated by the example,
    but that will result in an ambiguity error at codesigning instead of
    a more obscure error about an invalid identity when
    go_darwin_arm_exec.go runs a binary.
    The fix is then to delete the invalid identity from the system
    keychain.
    
    While here, find all connected devices instead of the first connected
    and only consider provision files that covers them all. This matters
    for the mobile builder where two devices are connected.
    
    Change-Id: I6beb59ace3fc5e071ba76222a20a607765943989
    Reviewed-on: https://go-review.googlesource.com/105436
    Run-TryBot: Elias Naur <elias.naur@gmail.com>
    TryBot-Result: Gobot Gobot <gobot@golang.org>
    Reviewed-by: 's avatarHyang-Ah Hana Kim <hyangah@gmail.com>
    c3cb44fd
detect.go 3.21 KB