Skip to content

Commit 14150aa

Browse files
nglevinluispadron
nglevin
authored and
luispadron
committed
Assign the entitlements that need to match the provisioning profile's - subset for lists - at analysis time.
Other entitlement validation modes to handle trickier relations, such as entitlements that must always be defined for a given provisioning profile, and variations on wildcard handling, will be addressed in subsequent changes. Cherry-pick: 7c9b36d
1 parent c8283c7 commit 14150aa

File tree

3 files changed

+46
-148
lines changed

3 files changed

+46
-148
lines changed

‎apple/internal/entitlements_support.bzl‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,37 @@ def _process_entitlements(
317317
"%s_entitlements.entitlements" % rule_label.name,
318318
)
319319

320+
extra_keys_to_match_profile = [
321+
# Keys for values that are not lists, which must be in the profile if they are defined
322+
# in the entitlements.
323+
"aps-environment",
324+
"com.apple.developer.applesignin",
325+
"com.apple.developer.carplay-audio",
326+
"com.apple.developer.carplay-charging",
327+
"com.apple.developer.carplay-maps",
328+
"com.apple.developer.carplay-messaging",
329+
"com.apple.developer.carplay-parking",
330+
"com.apple.developer.carplay-quick-ordering",
331+
"com.apple.developer.declared-age-range",
332+
"com.apple.developer.playable-content",
333+
"com.apple.developer.networking.wifi-info",
334+
"com.apple.developer.passkit.pass-presentation-suppression",
335+
"com.apple.developer.payment-pass-provisioning",
336+
"com.apple.developer.proximity-reader.payment.acceptance",
337+
"com.apple.developer.siri",
338+
"com.apple.developer.usernotifications.critical-alerts",
339+
"com.apple.developer.usernotifications.time-sensitive",
340+
# Keys which have a list of potential values in the profile, but only one in
341+
# the entitlements that must be in the profile's list of values
342+
"com.apple.developer.devicecheck.appattest-environment",
343+
"com.apple.developer.nfc.readersession.formats",
344+
]
345+
if platform_prerequisites.platform_type != "macos":
346+
extra_keys_to_match_profile.append("com.apple.security.application-groups")
347+
320348
entitlements_options = {
321349
"bundle_id": bundle_id,
350+
"extra_keys_to_match_profile": extra_keys_to_match_profile,
322351
}
323352
if signing_info.profile_metadata:
324353
inputs.append(signing_info.profile_metadata)

‎tools/plisttool/plisttool.py‎

Lines changed: 1 addition & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -304,32 +304,6 @@
304304
'is not in the provisioning profiles potential values ("%s").'
305305
)
306306

307-
# TODO: b/474331541 - Remove this hard coded list and rely on values set at
308-
# analysis time in entitlements_support.bzl.
309-
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE = [
310-
'aps-environment',
311-
'com.apple.developer.applesignin',
312-
'com.apple.developer.carplay-audio',
313-
'com.apple.developer.carplay-charging',
314-
'com.apple.developer.carplay-maps',
315-
'com.apple.developer.carplay-messaging',
316-
'com.apple.developer.carplay-parking',
317-
'com.apple.developer.carplay-quick-ordering',
318-
'com.apple.developer.declared-age-range',
319-
'com.apple.developer.playable-content',
320-
'com.apple.developer.networking.wifi-info',
321-
'com.apple.developer.passkit.pass-presentation-suppression',
322-
'com.apple.developer.payment-pass-provisioning',
323-
'com.apple.developer.proximity-reader.payment.acceptance',
324-
'com.apple.developer.siri',
325-
'com.apple.developer.usernotifications.critical-alerts',
326-
'com.apple.developer.usernotifications.time-sensitive',
327-
# Keys which have a list of potential values in the profile, but only one in
328-
# the entitlements that must be in the profile's list of values
329-
'com.apple.developer.devicecheck.appattest-environment',
330-
'com.apple.developer.nfc.readersession.formats',
331-
]
332-
333307
ENTITLEMENTS_BETA_REPORTS_ACTIVE_MISMATCH = (
334308
'In target "%s"; the entitlements "beta-reports-active" ("%s") did not '
335309
'match the value in the provisioning profile ("%s").'
@@ -1211,7 +1185,7 @@ def validate_plist(self, plist):
12111185
# at analysis time in entitlements_support.bzl.
12121186
extra_keys_to_match = self.options.get(
12131187
'extra_keys_to_match_profile',
1214-
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE,
1188+
[],
12151189
)
12161190
self._validate_entitlements_against_profile(
12171191
plist,
@@ -1330,18 +1304,6 @@ def _validate_entitlements_against_profile(
13301304
'keychain-access-groups', self.target,
13311305
supports_wildcards=True)
13321306

1333-
# TODO: b/474331541 - Remove this specific check once extra_keys_to_match is
1334-
# configured exclusively at analysis time, allowing us to add the
1335-
# com.apple.security.application-groups entitlement check for all Apple
1336-
# platforms except macOS.
1337-
#
1338-
# com.apple.security.application-groups
1339-
# (This check does not apply to macOS-only provisioning profiles.)
1340-
if self._profile_metadata.get('Platform', []) != ['OSX']:
1341-
self._check_entitlements_array(
1342-
entitlements, profile_entitlements,
1343-
'com.apple.security.application-groups', self.target)
1344-
13451307
# com.apple.developer.associated-domains
13461308
self._check_entitlements_array(
13471309
entitlements, profile_entitlements,

‎tools/plisttool/plisttool_unittest.py‎

Lines changed: 16 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -1749,6 +1749,9 @@ def test_entitlements_app_groups_match(self):
17491749
},
17501750
'Version': 1,
17511751
},
1752+
'extra_keys_to_match_profile': [
1753+
'com.apple.security.application-groups',
1754+
],
17521755
},
17531756
}, plist1)
17541757

@@ -1770,6 +1773,9 @@ def test_entitlements_app_groups_wildcard_no_match(self):
17701773
},
17711774
'Version': 1,
17721775
},
1776+
'extra_keys_to_match_profile': [
1777+
'com.apple.security.application-groups',
1778+
],
17731779
},
17741780
})
17751781

@@ -1793,7 +1799,7 @@ def test_entitlements_no_app_groups_requested(self):
17931799
def test_entitlements_app_groups_not_allowed(self):
17941800
with self.assertRaisesRegex(
17951801
plisttool.PlistToolError,
1796-
re.escape(plisttool.ENTITLEMENTS_HAS_GROUP_PROFILE_DOES_NOT % (
1802+
re.escape(plisttool.ENTITLEMENTS_MISSING % (
17971803
_testing_target, 'com.apple.security.application-groups'))):
17981804
_plisttool_result({
17991805
'plists': [{
@@ -1808,6 +1814,9 @@ def test_entitlements_app_groups_not_allowed(self):
18081814
},
18091815
'Version': 1,
18101816
},
1817+
'extra_keys_to_match_profile': [
1818+
'com.apple.security.application-groups',
1819+
],
18111820
},
18121821
})
18131822

@@ -1832,6 +1841,9 @@ def test_entitlements_app_groups_mismatch(self):
18321841
},
18331842
'Version': 1,
18341843
},
1844+
'extra_keys_to_match_profile': [
1845+
'com.apple.security.application-groups',
1846+
],
18351847
},
18361848
})
18371849

@@ -1886,24 +1898,9 @@ def test_entitlements_aps_environment_missing_profile(self):
18861898
},
18871899
'Version': 1,
18881900
},
1889-
},
1890-
}, plist)
1891-
1892-
def test_entitlements_aps_environment_mismatch_default_validation(self):
1893-
with self.assertRaisesRegex(
1894-
plisttool.PlistToolError,
1895-
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
1896-
_testing_target, 'aps-environment', 'production', 'development'))):
1897-
plist = {'aps-environment': 'production'}
1898-
self._assert_plisttool_result({
1899-
'plists': [plist],
1900-
'entitlements_options': {
1901-
'profile_metadata_file': {
1902-
'Entitlements': {
1903-
'aps-environment': 'development',
1904-
},
1905-
'Version': 1,
1906-
},
1901+
'extra_keys_to_match_profile': [
1902+
'aps-environment',
1903+
],
19071904
},
19081905
}, plist)
19091906

@@ -1928,21 +1925,6 @@ def test_entitlements_aps_environment_mismatch(self):
19281925
},
19291926
}, plist)
19301927

1931-
def test_attest_valid_default_validation(self):
1932-
plist = {
1933-
'com.apple.developer.devicecheck.appattest-environment': 'development'}
1934-
self._assert_plisttool_result({
1935-
'plists': [plist],
1936-
'entitlements_options': {
1937-
'profile_metadata_file': {
1938-
'Entitlements': {
1939-
'com.apple.developer.devicecheck.appattest-environment': ['development', 'production'],
1940-
},
1941-
'Version': 1,
1942-
},
1943-
},
1944-
}, plist)
1945-
19461928
def test_attest_valid(self):
19471929
plist = {
19481930
'com.apple.developer.devicecheck.appattest-environment': 'development'}
@@ -1963,28 +1945,6 @@ def test_attest_valid(self):
19631945
},
19641946
}, plist)
19651947

1966-
def test_attest_mismatch_default_validation(self):
1967-
with self.assertRaisesRegex(
1968-
plisttool.PlistToolError,
1969-
re.escape(plisttool.ENTITLEMENTS_VALUE_NOT_IN_LIST %
1970-
(_testing_target,
1971-
'com.apple.developer.devicecheck.appattest-environment',
1972-
'foo', ['development']))):
1973-
plist = {'com.apple.developer.devicecheck.appattest-environment': 'foo'}
1974-
self._assert_plisttool_result(
1975-
{
1976-
'plists': [plist],
1977-
'entitlements_options': {
1978-
'profile_metadata_file': {
1979-
'Entitlements': {
1980-
'com.apple.developer.devicecheck.appattest-environment':
1981-
['development'],
1982-
},
1983-
'Version': 1,
1984-
},
1985-
},
1986-
}, plist)
1987-
19881948
def test_attest_mismatch(self):
19891949
with self.assertRaisesRegex(
19901950
plisttool.PlistToolError,
@@ -2057,20 +2017,6 @@ def test_entitlements_profile_missing_beta_reports_active(self):
20572017
},
20582018
}, plist)
20592019

2060-
def test_entitlements_missing_wifi_info_active_default_validation(self):
2061-
plist = {}
2062-
self._assert_plisttool_result({
2063-
'plists': [plist],
2064-
'entitlements_options': {
2065-
'profile_metadata_file': {
2066-
'Entitlements': {
2067-
'com.apple.developer.networking.wifi-info': True,
2068-
},
2069-
'Version': 1,
2070-
},
2071-
},
2072-
}, plist)
2073-
20742020
def test_entitlements_missing_wifi_info_active(self):
20752021
plist = {}
20762022
self._assert_plisttool_result({
@@ -2088,25 +2034,6 @@ def test_entitlements_missing_wifi_info_active(self):
20882034
},
20892035
}, plist)
20902036

2091-
def test_entitlements_wifi_info_active_mismatch_default_validation(self):
2092-
with self.assertRaisesRegex(
2093-
plisttool.PlistToolError,
2094-
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
2095-
_testing_target, 'com.apple.developer.networking.wifi-info',
2096-
'False', 'True'))):
2097-
plist = {'com.apple.developer.networking.wifi-info': False}
2098-
self._assert_plisttool_result({
2099-
'plists': [plist],
2100-
'entitlements_options': {
2101-
'profile_metadata_file': {
2102-
'Entitlements': {
2103-
'com.apple.developer.networking.wifi-info': True,
2104-
},
2105-
'Version': 1,
2106-
},
2107-
},
2108-
}, plist)
2109-
21102037
def test_entitlements_wifi_info_active_mismatch(self):
21112038
with self.assertRaisesRegex(
21122039
plisttool.PlistToolError,
@@ -2145,26 +2072,6 @@ def test_entitlements_wifi_info_active_mismatch_with_no_extra_keys_to_match(self
21452072
},
21462073
}, plist)
21472074

2148-
def test_entitlements_profile_missing_wifi_info_active_default_validation(self):
2149-
with self.assertRaisesRegex(
2150-
plisttool.PlistToolError,
2151-
re.escape(
2152-
plisttool.ENTITLEMENTS_MISSING %
2153-
(_testing_target, 'com.apple.developer.networking.wifi-info'))):
2154-
plist = {'com.apple.developer.networking.wifi-info': True}
2155-
self._assert_plisttool_result({
2156-
'plists': [plist],
2157-
'entitlements_options': {
2158-
'profile_metadata_file': {
2159-
'Entitlements': {
2160-
'application-identifier': 'QWERTY.*',
2161-
# No wifi-info
2162-
},
2163-
'Version': 1,
2164-
},
2165-
},
2166-
}, plist)
2167-
21682075
def test_entitlements_profile_missing_wifi_info_active(self):
21692076
with self.assertRaisesRegex(
21702077
plisttool.PlistToolError,

0 commit comments

Comments
 (0)