xtool

signer: replace zsign with RCodesign (#389 )

## What does this PR do?

Replaces zsign with the
[apple-codesign](https://github.com/indygreg/apple-platform-rs/tree/0ebbd2ef3b96d5adccc30b1cad4deea38cd735c4/apple-codesign)
Rust crate. It's much more usable as a library (while zsign has bare
prints all over the place + we had to fork it to maintain a public
interface), it supports macOS-style bundles, and also has other features
that we would've needed to further patch zsign for.

## How was it tested?

- [x] Ran an ad-hoc signed app on the simulator (with a subsequent PR)
- [x] Ran an app with App Groups on device, confirmed that the app group
is present

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only

<!-- If an AI agent is filling this in: declare the level honestly, and
open as a draft if it is #2. Do not lower the declared level to get the
PR reviewed. -->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Updated Signing**
* App signing now uses an updated signing engine and supports
certificate-based and ad hoc signing.
* Entitlement data, including data provided through entitlement files,
is passed through during signing.
  * Deep signing is enabled in the development command.
* **Validation**
* Signing rejects invalid app or entitlement file paths and duplicate
entitlement paths.
* **Compatibility**
  * Signing contexts can be created without selecting a signer.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Kabir Oberai · 2026-10-30 02:47:23 -04:00

64fe8e30b3

ds: allow one app group on free teams (#284 )

## What does this PR do?

Resolves the FIXME in `DeveloperServicesCapability`: App Groups are no
longer filtered out on free teams, and
`DeveloperServicesAddAppOperation` assigns at most one group per app on
a free team (the constraint the FIXME mentioned).

Free teams can register and assign app groups through the Xcode
DeveloperServices API (as AltStore/SideStore do), so a widget and its
app can share `UserDefaults(suiteName:)` with a free Apple ID.

## How was it tested?

Built on Linux from `main` (4d0c429). Installed a Flutter app with a
WidgetKit extension on an iPhone (iOS 27.2) with a free Apple ID: the
app gets `group.XTL-<team>.<id>` in its entitlements and the widget
reads the app's data through it. `make lint` not run (no SwiftLint on
this machine).

## AI tool usage

How much of this PR was AI-assisted? (check one)

- [ ] **0** - No AI was used to write code
- [x] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
  * App Groups are now available to free teams.
* Apps assigned to multiple App Groups are rejected with a clear error
message.
* Invalid app errors now include the app’s URL path, making it easier to
identify which app could not be added.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Kabir Oberai <oberai.kabir@gmail.com>

Cesar Andres Pereira Bernal · 2026-10-30 02:11:54 -04:00

0c63e6979f

Fix capability creation via public API (#220 )

Ref #216: the public API seems to now complain when passing in
`capabilities`, but the field is still required when using the private
API.

Co-authored-by: sfusco <slf@stevenfusco.com>

Kabir Oberai · 2026-05-16 20:04:51 -04:00

8edb54fb71

Add support for App Extensions (#97 )

This pull request adds support for Apple's [App
Extensions](https://developer.apple.com/app-extensions/).

Closes: #45

---------

Co-authored-by: ErrorErrorError <16653389+ErrorErrorError@users.noreply.github.com>
Co-authored-by: Kabir Oberai <oberai.kabir@gmail.com>

Erik Bautista Santibanez · 2025-07-13 23:47:47 -04:00

edd6b90f53

Fix duplicate App ID registration (#90 )

We pull the list of App IDs in `upsertApp` to see if we already created
the App ID. This broke when the user had too many App IDs, since DS
returned a paginated response and we only looked at the first page.

We could paginate the whole list (as seen in #89) but that's slow.
Instead, just filter the query to the expected App ID. This is a prefix
search so we might still receive multiple responses, but it's much less
likely that the user has like 10(? I'm not sure what the default/max
pagination limit is) apps registered with the XTL-ABC.com.foo.bar prefix
(they could have PlugIns but usually just a small number of them.)

This is a tentative fix for #87.

Kabir Oberai · 2025-05-25 02:42:22 +05:30

efc1ed943f

Add support for custom entitlements (#82 )

Closes #46

Kabir Oberai · 2025-05-24 00:35:46 +05:30

3b17975fe7

Improve OpenAPI error handling (#78 )

- Make some enums non-exhaustive (closes #77)
  - Also a tentative fix for #62 and #64
- Improve logging on deserialization failure

We now use raw JS to patch the OpenAPI spec instead of openapi-overlay.
It's a lot more flexible this way.

Kabir Oberai · 2025-05-23 19:05:02 +05:30

b5d49a63cf

Improve handling of paid developer accounts (#20 )

* getTeamIsFree -> XcodeAuthData.team().isFree

* Only revoke certificates if on a free team

* Update OpenAPI spec, handle AVP

* Fix App ID capabilities on paid accounts

Kabir Oberai · 2025-05-12 18:14:36 +05:30

17d3d1019b

Rename main product

Kabir Oberai · 2025-05-06 11:30:59 +05:30

6778e66e55

libSupersign -> XKit

Kabir Oberai · 2025-05-06 11:01:25 +05:30

6e958a2ad3

10 Commits