Skip to content

Commit 23c30d1

Browse files
nglevinluispadron
nglevin
authored and
luispadron
committed
Add an analysis time configurable option to customize the keys we compare values between entitlements xml and the assigned provisioning profile.
This only covers the simple case (exact match) and not the more complex cases that have special handling today in plisttool.py. These could also be pulled out as analysis time configurable options, with different arguments or additional arguments to tweak specific behavior. Cherry-pick: e9f9f61
1 parent 8b73806 commit 23c30d1

File tree

2 files changed

+160
-7
lines changed

2 files changed

+160
-7
lines changed

‎tools/plisttool/plisttool.py‎

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@
7676
`child_plists`), and the valures are a list of key/value pairs. The
7777
key/value pairs are encoded as a list of exactly two items, the key is
7878
actually an array of keys, so it can walk into the child plist.
79+
entitlements_to_validate_with_profile: If present, a list of entitlements keys
80+
that should be validated as being present in the provisioning profile.
7981
8082
If info_plist_options is present, validation will be performed on the output
8183
file after merging is complete. If any of the following conditions are not
@@ -302,7 +304,9 @@
302304
'is not in the provisioning profiles potential values ("%s").'
303305
)
304306

305-
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE = (
307+
# TODO: b/474331541 - Remove this hard coded list and rely on values set at
308+
# analysis time in entitlements_support.bzl.
309+
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE = [
306310
'aps-environment',
307311
'com.apple.developer.applesignin',
308312
'com.apple.developer.carplay-audio',
@@ -323,7 +327,7 @@
323327
# Keys which have a list of potential values in the profile, but only one in
324328
# the entitlements that must be in the profile's list of values
325329
'com.apple.developer.devicecheck.appattest-environment',
326-
)
330+
]
327331

328332
ENTITLEMENTS_BETA_REPORTS_ACTIVE_MISMATCH = (
329333
'In target "%s"; the entitlements "beta-reports-active" ("%s") did not '
@@ -360,7 +364,10 @@
360364

361365
# All valid keys in the entitlements_options control structure.
362366
_ENTITLEMENTS_OPTIONS_KEYS = frozenset([
363-
'bundle_id', 'profile_metadata_file', 'validation_mode',
367+
'bundle_id',
368+
'extra_keys_to_match_profile',
369+
'profile_metadata_file',
370+
'validation_mode',
364371
])
365372

366373
# Two regexes for variable matching/validation.
@@ -1190,7 +1197,15 @@ def validate_plist(self, plist):
11901197
self._sanity_check_profile()
11911198

11921199
if self._validation_mode != 'skip':
1193-
self._validate_entitlements_against_profile(plist)
1200+
extra_keys_to_match = self.options.get(
1201+
'extra_keys_to_match_profile',
1202+
)
1203+
if not extra_keys_to_match:
1204+
extra_keys_to_match = _ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE
1205+
self._validate_entitlements_against_profile(
1206+
plist,
1207+
extra_keys_to_match,
1208+
)
11941209

11951210
def _validate_bundle_id_covered(self, bundle_id, entitlements):
11961211
"""Checks that the bundle id is covered by the entitlements.
@@ -1241,11 +1256,21 @@ def _sanity_check_profile(self):
12411256
# for setting up substitutions. At the moment no validation between them
12421257
# is being done.
12431258

1244-
def _validate_entitlements_against_profile(self, entitlements):
1259+
def _validate_entitlements_against_profile(
1260+
self, entitlements, extra_keys_to_match
1261+
):
12451262
"""Checks that the given entitlements are valid for the current profile.
12461263
12471264
Args:
12481265
entitlements: The entitlements.
1266+
<<<<<<< HEAD
1267+
||||||| parent of e9f9f61b (Add an analysis time configurable option to customize the keys we compare values between entitlements xml and the assigned provisioning profile.)
1268+
1269+
=======
1270+
extra_keys_to_match: A list of additional entitlements keys to validate
1271+
that their values match those of the provisioning profile exactly.
1272+
1273+
>>>>>>> e9f9f61b (Add an analysis time configurable option to customize the keys we compare values between entitlements xml and the assigned provisioning profile.)
12491274
Raises:
12501275
PlistToolError: For any issues found.
12511276
"""
@@ -1275,7 +1300,7 @@ def _validate_entitlements_against_profile(self, entitlements):
12751300
ENTITLEMENTS_APP_ID_PROFILE_MISMATCH % (
12761301
self.target, src_app_id, profile_app_id))
12771302

1278-
for entitlement in _ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE:
1303+
for entitlement in extra_keys_to_match:
12791304
self._check_entitlement_matches_profile_value(
12801305
entitlement=entitlement,
12811306
entitlements=entitlements,

‎tools/plisttool/plisttool_unittest.py‎

Lines changed: 129 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1887,6 +1887,24 @@ def test_entitlements_aps_environment_missing_profile(self):
18871887
},
18881888
}, plist)
18891889

1890+
def test_entitlements_aps_environment_mismatch_default_validation(self):
1891+
with self.assertRaisesRegex(
1892+
plisttool.PlistToolError,
1893+
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
1894+
_testing_target, 'aps-environment', 'production', 'development'))):
1895+
plist = {'aps-environment': 'production'}
1896+
self._assert_plisttool_result({
1897+
'plists': [plist],
1898+
'entitlements_options': {
1899+
'profile_metadata_file': {
1900+
'Entitlements': {
1901+
'aps-environment': 'development',
1902+
},
1903+
'Version': 1,
1904+
},
1905+
},
1906+
}, plist)
1907+
18901908
def test_entitlements_aps_environment_mismatch(self):
18911909
with self.assertRaisesRegex(
18921910
plisttool.PlistToolError,
@@ -1896,6 +1914,9 @@ def test_entitlements_aps_environment_mismatch(self):
18961914
self._assert_plisttool_result({
18971915
'plists': [plist],
18981916
'entitlements_options': {
1917+
'extra_keys_to_match_profile': [
1918+
'aps-environment',
1919+
],
18991920
'profile_metadata_file': {
19001921
'Entitlements': {
19011922
'aps-environment': 'development',
@@ -1905,7 +1926,7 @@ def test_entitlements_aps_environment_mismatch(self):
19051926
},
19061927
}, plist)
19071928

1908-
def test_attest_valid(self):
1929+
def test_attest_valid_default_validation(self):
19091930
plist = {
19101931
'com.apple.developer.devicecheck.appattest-environment': 'development'}
19111932
self._assert_plisttool_result({
@@ -1920,6 +1941,48 @@ def test_attest_valid(self):
19201941
},
19211942
}, plist)
19221943

1944+
def test_attest_valid(self):
1945+
plist = {
1946+
'com.apple.developer.devicecheck.appattest-environment': 'development'}
1947+
self._assert_plisttool_result(
1948+
{
1949+
'plists': [plist],
1950+
'entitlements_options': {
1951+
'extra_keys_to_match_profile': [
1952+
'com.apple.developer.devicecheck.appattest-environment',
1953+
],
1954+
'profile_metadata_file': {
1955+
'Entitlements': {
1956+
'com.apple.developer.devicecheck.appattest-environment':
1957+
['development', 'production'],
1958+
},
1959+
'Version': 1,
1960+
},
1961+
},
1962+
}, plist)
1963+
1964+
def test_attest_mismatch_default_validation(self):
1965+
with self.assertRaisesRegex(
1966+
plisttool.PlistToolError,
1967+
re.escape(plisttool.ENTITLEMENTS_VALUE_NOT_IN_LIST %
1968+
(_testing_target,
1969+
'com.apple.developer.devicecheck.appattest-environment',
1970+
'foo', ['development']))):
1971+
plist = {'com.apple.developer.devicecheck.appattest-environment': 'foo'}
1972+
self._assert_plisttool_result(
1973+
{
1974+
'plists': [plist],
1975+
'entitlements_options': {
1976+
'profile_metadata_file': {
1977+
'Entitlements': {
1978+
'com.apple.developer.devicecheck.appattest-environment':
1979+
['development'],
1980+
},
1981+
'Version': 1,
1982+
},
1983+
},
1984+
}, plist)
1985+
19231986
def test_attest_mismatch(self):
19241987
with self.assertRaisesRegex(
19251988
plisttool.PlistToolError,
@@ -1932,6 +1995,9 @@ def test_attest_mismatch(self):
19321995
self._assert_plisttool_result({
19331996
'plists': [plist],
19341997
'entitlements_options': {
1998+
'extra_keys_to_match_profile': [
1999+
'com.apple.developer.devicecheck.appattest-environment',
2000+
],
19352001
'profile_metadata_file': {
19362002
'Entitlements': {
19372003
'com.apple.developer.devicecheck.appattest-environment': ['development'],
@@ -1989,11 +2055,28 @@ def test_entitlements_profile_missing_beta_reports_active(self):
19892055
},
19902056
}, plist)
19912057

2058+
def test_entitlements_missing_wifi_info_active_default_validation(self):
2059+
plist = {}
2060+
self._assert_plisttool_result({
2061+
'plists': [plist],
2062+
'entitlements_options': {
2063+
'profile_metadata_file': {
2064+
'Entitlements': {
2065+
'com.apple.developer.networking.wifi-info': True,
2066+
},
2067+
'Version': 1,
2068+
},
2069+
},
2070+
}, plist)
2071+
19922072
def test_entitlements_missing_wifi_info_active(self):
19932073
plist = {}
19942074
self._assert_plisttool_result({
19952075
'plists': [plist],
19962076
'entitlements_options': {
2077+
'extra_keys_to_match_profile': [
2078+
'com.apple.developer.networking.wifi-info',
2079+
],
19972080
'profile_metadata_file': {
19982081
'Entitlements': {
19992082
'com.apple.developer.networking.wifi-info': True,
@@ -2003,6 +2086,25 @@ def test_entitlements_missing_wifi_info_active(self):
20032086
},
20042087
}, plist)
20052088

2089+
def test_entitlements_wifi_info_active_mismatch_default_validation(self):
2090+
with self.assertRaisesRegex(
2091+
plisttool.PlistToolError,
2092+
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
2093+
_testing_target, 'com.apple.developer.networking.wifi-info',
2094+
'False', 'True'))):
2095+
plist = {'com.apple.developer.networking.wifi-info': False}
2096+
self._assert_plisttool_result({
2097+
'plists': [plist],
2098+
'entitlements_options': {
2099+
'profile_metadata_file': {
2100+
'Entitlements': {
2101+
'com.apple.developer.networking.wifi-info': True,
2102+
},
2103+
'Version': 1,
2104+
},
2105+
},
2106+
}, plist)
2107+
20062108
def test_entitlements_wifi_info_active_mismatch(self):
20072109
with self.assertRaisesRegex(
20082110
plisttool.PlistToolError,
@@ -2013,6 +2115,9 @@ def test_entitlements_wifi_info_active_mismatch(self):
20132115
self._assert_plisttool_result({
20142116
'plists': [plist],
20152117
'entitlements_options': {
2118+
'extra_keys_to_match_profile': [
2119+
'com.apple.developer.networking.wifi-info',
2120+
],
20162121
'profile_metadata_file': {
20172122
'Entitlements': {
20182123
'com.apple.developer.networking.wifi-info': True,
@@ -2022,6 +2127,26 @@ def test_entitlements_wifi_info_active_mismatch(self):
20222127
},
20232128
}, plist)
20242129

2130+
def test_entitlements_profile_missing_wifi_info_active_default_validation(self):
2131+
with self.assertRaisesRegex(
2132+
plisttool.PlistToolError,
2133+
re.escape(
2134+
plisttool.ENTITLEMENTS_MISSING %
2135+
(_testing_target, 'com.apple.developer.networking.wifi-info'))):
2136+
plist = {'com.apple.developer.networking.wifi-info': True}
2137+
self._assert_plisttool_result({
2138+
'plists': [plist],
2139+
'entitlements_options': {
2140+
'profile_metadata_file': {
2141+
'Entitlements': {
2142+
'application-identifier': 'QWERTY.*',
2143+
# No wifi-info
2144+
},
2145+
'Version': 1,
2146+
},
2147+
},
2148+
}, plist)
2149+
20252150
def test_entitlements_profile_missing_wifi_info_active(self):
20262151
with self.assertRaisesRegex(
20272152
plisttool.PlistToolError,
@@ -2032,6 +2157,9 @@ def test_entitlements_profile_missing_wifi_info_active(self):
20322157
self._assert_plisttool_result({
20332158
'plists': [plist],
20342159
'entitlements_options': {
2160+
'extra_keys_to_match_profile': [
2161+
'com.apple.developer.networking.wifi-info',
2162+
],
20352163
'profile_metadata_file': {
20362164
'Entitlements': {
20372165
'application-identifier': 'QWERTY.*',

0 commit comments

Comments
 (0)