xtool

signer: replace zsign with RCodesign (#389 )

## What does this PR do?

Replaces zsign with the
[apple-codesign](https://github.com/indygreg/apple-platform-rs/tree/0ebbd2ef3b96d5adccc30b1cad4deea38cd735c4/apple-codesign)
Rust crate. It's much more usable as a library (while zsign has bare
prints all over the place + we had to fork it to maintain a public
interface), it supports macOS-style bundles, and also has other features
that we would've needed to further patch zsign for.

## How was it tested?

- [x] Ran an ad-hoc signed app on the simulator (with a subsequent PR)
- [x] Ran an app with App Groups on device, confirmed that the app group
is present

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only

<!-- If an AI agent is filling this in: declare the level honestly, and
open as a draft if it is #2. Do not lower the declared level to get the
PR reviewed. -->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Updated Signing**
* App signing now uses an updated signing engine and supports
certificate-based and ad hoc signing.
* Entitlement data, including data provided through entitlement files,
is passed through during signing.
  * Deep signing is enabled in the development command.
* **Validation**
* Signing rejects invalid app or entitlement file paths and duplicate
entitlement paths.
* **Compatibility**
  * Signing contexts can be created without selecting a signer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Kabir Oberai · 2026-10-30 02:47:23 -04:00

64fe8e30b3

ds: allow one app group on free teams (#284 )

## What does this PR do?

Resolves the FIXME in `DeveloperServicesCapability`: App Groups are no
longer filtered out on free teams, and
`DeveloperServicesAddAppOperation` assigns at most one group per app on
a free team (the constraint the FIXME mentioned).

Free teams can register and assign app groups through the Xcode
DeveloperServices API (as AltStore/SideStore do), so a widget and its
app can share `UserDefaults(suiteName:)` with a free Apple ID.

## How was it tested?

Built on Linux from `main` (4d0c429). Installed a Flutter app with a
WidgetKit extension on an iPhone (iOS 27.2) with a free Apple ID: the
app gets `group.XTL-<team>.<id>` in its entitlements and the widget
reads the app's data through it. `make lint` not run (no SwiftLint on
this machine).

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
  * App Groups are now available to free teams.
* Apps assigned to multiple App Groups are rejected with a clear error
message.
* Invalid app errors now include the app’s URL path, making it easier to
identify which app could not be added.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Kabir Oberai <oberai.kabir@gmail.com>

Cesar Andres Pereira Bernal · 2026-10-30 02:11:54 -04:00

0c63e6979f

entitlements: support Sign in with Apple (#377 )

## What does this PR do?

Hi! xtool didn't know about the `com.apple.developer.applesignin`
entitlement, so every time I installed my app, the capability sync
removed Sign in with Apple from the App ID. The new provisioning profile
didn't have it, and the device refused the app ("A valid provisioning
profile for this executable was not found").

This maps the entitlement to the `APPLE_ID_AUTH` capability, as a
primary App ID, so the capability stays and the profile includes it.

## How was it tested?

I built xtool from this branch on macOS and installed my app (a SwiftPM
app with `entitlementsPath` and the Sign in with Apple entitlement) on
an iPhone with a paid team. The App ID kept the capability, the install
worked, and native Sign in with Apple works in the app. Before the
change the same install failed every time.

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **New Features**
  * Added support for configuring the Apple Sign In entitlement.
* Apple Sign In is now available as a supported entitlement type,
including serialization and configuration support.
  * Configures Apple ID app consent as the primary app consent option.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Víctor Agudo Gonzalez · 2026-10-22 22:25:37 -04:00

952a7ffd43

Support wifi-aware entitlement (#240 )

SuperKenVery · 2026-09-01 14:10:54 -04:00

8f11844553

Fix capability creation via public API (#220 )

Ref #216: the public API seems to now complain when passing in
`capabilities`, but the field is still required when using the private
API.

Co-authored-by: sfusco <slf@stevenfusco.com>

Kabir Oberai · 2026-05-16 20:04:51 -04:00

8edb54fb71

Clean up some entitlements code (#165 )

- We already do the `isFree` declarations in
`DeveloperServiceCapability.swift`. Don't need to duplicate it on the
entitlement types.
- Add support for creating capabilities with raw names

Kabir Oberai · 2025-09-28 19:04:28 -04:00

f29f6ba601

Add support for App Extensions (#97 )

This pull request adds support for Apple's [App
Extensions](https://developer.apple.com/app-extensions/).

Closes: #45

---------

Co-authored-by: ErrorErrorError <16653389+ErrorErrorError@users.noreply.github.com>
Co-authored-by: Kabir Oberai <oberai.kabir@gmail.com>

Erik Bautista Santibanez · 2025-07-13 23:47:47 -04:00

edd6b90f53

Make ALL response enums extensible (#92 )

Another bugfix for #64. Fifth… time's the charm?

Kabir Oberai · 2025-05-25 19:09:17 +05:30

6730ea3896

Fix duplicate App ID registration (#90 )

We pull the list of App IDs in `upsertApp` to see if we already created
the App ID. This broke when the user had too many App IDs, since DS
returned a paginated response and we only looked at the first page.

We could paginate the whole list (as seen in #89) but that's slow.
Instead, just filter the query to the expected App ID. This is a prefix
search so we might still receive multiple responses, but it's much less
likely that the user has like 10(? I'm not sure what the default/max
pagination limit is) apps registered with the XTL-ABC.com.foo.bar prefix
(they could have PlugIns but usually just a small number of them.)

This is a tentative fix for #87.

Kabir Oberai · 2025-05-25 02:42:22 +05:30

efc1ed943f

Add support for custom entitlements (#82 )

Closes #46

Kabir Oberai · 2025-05-24 00:35:46 +05:30

3b17975fe7

Improve OpenAPI error handling (#78 )

- Make some enums non-exhaustive (closes #77)
  - Also a tentative fix for #62 and #64
- Improve logging on deserialization failure

We now use raw JS to patch the OpenAPI spec instead of openapi-overlay.
It's a lot more flexible this way.

Kabir Oberai · 2025-05-23 19:05:02 +05:30

b5d49a63cf

Improve handling of paid developer accounts (#20 )

* getTeamIsFree -> XcodeAuthData.team().isFree

* Only revoke certificates if on a free team

* Update OpenAPI spec, handle AVP

* Fix App ID capabilities on paid accounts

Kabir Oberai · 2025-05-12 18:14:36 +05:30

17d3d1019b

Rename main product

Kabir Oberai · 2025-05-06 11:30:59 +05:30

6778e66e55

libSupersign -> XKit

Kabir Oberai · 2025-05-06 11:01:25 +05:30

6e958a2ad3

14 Commits