Skip to content

Commit 8ff1cc1

Browse files
nglevinluispadron
nglevin
authored and
luispadron
committed
Assign the entitlements that need to match the provisioning profile's - subset for lists - at analysis time.
Other entitlement validation modes to handle trickier relations, such as entitlements that must always be defined for a given provisioning profile, and variations on wildcard handling, will be addressed in subsequent changes. Cherry-pick: 7c9b36d
1 parent f710662 commit 8ff1cc1

File tree

3 files changed

+46
-148
lines changed

3 files changed

+46
-148
lines changed

‎apple/internal/entitlements_support.bzl‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,37 @@ def _process_entitlements(
317317
"%s_entitlements.entitlements" % rule_label.name,
318318
)
319319

320+
extra_keys_to_match_profile = [
321+
# Keys for values that are not lists, which must be in the profile if they are defined
322+
# in the entitlements.
323+
"aps-environment",
324+
"com.apple.developer.applesignin",
325+
"com.apple.developer.carplay-audio",
326+
"com.apple.developer.carplay-charging",
327+
"com.apple.developer.carplay-maps",
328+
"com.apple.developer.carplay-messaging",
329+
"com.apple.developer.carplay-parking",
330+
"com.apple.developer.carplay-quick-ordering",
331+
"com.apple.developer.declared-age-range",
332+
"com.apple.developer.playable-content",
333+
"com.apple.developer.networking.wifi-info",
334+
"com.apple.developer.passkit.pass-presentation-suppression",
335+
"com.apple.developer.payment-pass-provisioning",
336+
"com.apple.developer.proximity-reader.payment.acceptance",
337+
"com.apple.developer.siri",
338+
"com.apple.developer.usernotifications.critical-alerts",
339+
"com.apple.developer.usernotifications.time-sensitive",
340+
# Keys which have a list of potential values in the profile, but only one in
341+
# the entitlements that must be in the profile's list of values
342+
"com.apple.developer.devicecheck.appattest-environment",
343+
"com.apple.developer.nfc.readersession.formats",
344+
]
345+
if platform_prerequisites.platform_type != "macos":
346+
extra_keys_to_match_profile.append("com.apple.security.application-groups")
347+
320348
entitlements_options = {
321349
"bundle_id": bundle_id,
350+
"extra_keys_to_match_profile": extra_keys_to_match_profile,
322351
}
323352
if signing_info.profile_metadata:
324353
inputs.append(signing_info.profile_metadata)

‎tools/plisttool/plisttool.py‎

Lines changed: 1 addition & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -304,32 +304,6 @@
304304
'is not in the provisioning profiles potential values ("%s").'
305305
)
306306

307-
# TODO: b/474331541 - Remove this hard coded list and rely on values set at
308-
# analysis time in entitlements_support.bzl.
309-
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE = [
310-
'aps-environment',
311-
'com.apple.developer.applesignin',
312-
'com.apple.developer.carplay-audio',
313-
'com.apple.developer.carplay-charging',
314-
'com.apple.developer.carplay-maps',
315-
'com.apple.developer.carplay-messaging',
316-
'com.apple.developer.carplay-parking',
317-
'com.apple.developer.carplay-quick-ordering',
318-
'com.apple.developer.declared-age-range',
319-
'com.apple.developer.playable-content',
320-
'com.apple.developer.networking.wifi-info',
321-
'com.apple.developer.passkit.pass-presentation-suppression',
322-
'com.apple.developer.payment-pass-provisioning',
323-
'com.apple.developer.proximity-reader.payment.acceptance',
324-
'com.apple.developer.siri',
325-
'com.apple.developer.usernotifications.critical-alerts',
326-
'com.apple.developer.usernotifications.time-sensitive',
327-
# Keys which have a list of potential values in the profile, but only one in
328-
# the entitlements that must be in the profile's list of values
329-
'com.apple.developer.devicecheck.appattest-environment',
330-
'com.apple.developer.nfc.readersession.formats',
331-
]
332-
333307
ENTITLEMENTS_BETA_REPORTS_ACTIVE_MISMATCH = (
334308
'In target "%s"; the entitlements "beta-reports-active" ("%s") did not '
335309
'match the value in the provisioning profile ("%s").'
@@ -1202,7 +1176,7 @@ def validate_plist(self, plist):
12021176
# at analysis time in entitlements_support.bzl.
12031177
extra_keys_to_match = self.options.get(
12041178
'extra_keys_to_match_profile',
1205-
_ENTITLEMENTS_TO_VALIDATE_WITH_PROFILE,
1179+
[],
12061180
)
12071181
self._validate_entitlements_against_profile(
12081182
plist,
@@ -1322,18 +1296,6 @@ def _validate_entitlements_against_profile(
13221296
supports_wildcards=True,
13231297
allow_wildcards_in_entitlements=True)
13241298

1325-
# TODO: b/474331541 - Remove this specific check once extra_keys_to_match is
1326-
# configured exclusively at analysis time, allowing us to add the
1327-
# com.apple.security.application-groups entitlement check for all Apple
1328-
# platforms except macOS.
1329-
#
1330-
# com.apple.security.application-groups
1331-
# (This check does not apply to macOS-only provisioning profiles.)
1332-
if self._profile_metadata.get('Platform', []) != ['OSX']:
1333-
self._check_entitlements_array(
1334-
entitlements, profile_entitlements,
1335-
'com.apple.security.application-groups', self.target)
1336-
13371299
# com.apple.developer.associated-domains
13381300
self._check_entitlements_array(
13391301
entitlements, profile_entitlements,

‎tools/plisttool/plisttool_unittest.py‎

Lines changed: 16 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -1747,6 +1747,9 @@ def test_entitlements_app_groups_match(self):
17471747
},
17481748
'Version': 1,
17491749
},
1750+
'extra_keys_to_match_profile': [
1751+
'com.apple.security.application-groups',
1752+
],
17501753
},
17511754
}, plist1)
17521755

@@ -1768,6 +1771,9 @@ def test_entitlements_app_groups_wildcard_no_match(self):
17681771
},
17691772
'Version': 1,
17701773
},
1774+
'extra_keys_to_match_profile': [
1775+
'com.apple.security.application-groups',
1776+
],
17711777
},
17721778
})
17731779

@@ -1791,7 +1797,7 @@ def test_entitlements_no_app_groups_requested(self):
17911797
def test_entitlements_app_groups_not_allowed(self):
17921798
with self.assertRaisesRegex(
17931799
plisttool.PlistToolError,
1794-
re.escape(plisttool.ENTITLEMENTS_HAS_GROUP_PROFILE_DOES_NOT % (
1800+
re.escape(plisttool.ENTITLEMENTS_MISSING % (
17951801
_testing_target, 'com.apple.security.application-groups'))):
17961802
_plisttool_result({
17971803
'plists': [{
@@ -1806,6 +1812,9 @@ def test_entitlements_app_groups_not_allowed(self):
18061812
},
18071813
'Version': 1,
18081814
},
1815+
'extra_keys_to_match_profile': [
1816+
'com.apple.security.application-groups',
1817+
],
18091818
},
18101819
})
18111820

@@ -1830,6 +1839,9 @@ def test_entitlements_app_groups_mismatch(self):
18301839
},
18311840
'Version': 1,
18321841
},
1842+
'extra_keys_to_match_profile': [
1843+
'com.apple.security.application-groups',
1844+
],
18331845
},
18341846
})
18351847

@@ -1884,24 +1896,9 @@ def test_entitlements_aps_environment_missing_profile(self):
18841896
},
18851897
'Version': 1,
18861898
},
1887-
},
1888-
}, plist)
1889-
1890-
def test_entitlements_aps_environment_mismatch_default_validation(self):
1891-
with self.assertRaisesRegex(
1892-
plisttool.PlistToolError,
1893-
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
1894-
_testing_target, 'aps-environment', 'production', 'development'))):
1895-
plist = {'aps-environment': 'production'}
1896-
self._assert_plisttool_result({
1897-
'plists': [plist],
1898-
'entitlements_options': {
1899-
'profile_metadata_file': {
1900-
'Entitlements': {
1901-
'aps-environment': 'development',
1902-
},
1903-
'Version': 1,
1904-
},
1899+
'extra_keys_to_match_profile': [
1900+
'aps-environment',
1901+
],
19051902
},
19061903
}, plist)
19071904

@@ -1926,21 +1923,6 @@ def test_entitlements_aps_environment_mismatch(self):
19261923
},
19271924
}, plist)
19281925

1929-
def test_attest_valid_default_validation(self):
1930-
plist = {
1931-
'com.apple.developer.devicecheck.appattest-environment': 'development'}
1932-
self._assert_plisttool_result({
1933-
'plists': [plist],
1934-
'entitlements_options': {
1935-
'profile_metadata_file': {
1936-
'Entitlements': {
1937-
'com.apple.developer.devicecheck.appattest-environment': ['development', 'production'],
1938-
},
1939-
'Version': 1,
1940-
},
1941-
},
1942-
}, plist)
1943-
19441926
def test_attest_valid(self):
19451927
plist = {
19461928
'com.apple.developer.devicecheck.appattest-environment': 'development'}
@@ -1961,28 +1943,6 @@ def test_attest_valid(self):
19611943
},
19621944
}, plist)
19631945

1964-
def test_attest_mismatch_default_validation(self):
1965-
with self.assertRaisesRegex(
1966-
plisttool.PlistToolError,
1967-
re.escape(plisttool.ENTITLEMENTS_VALUE_NOT_IN_LIST %
1968-
(_testing_target,
1969-
'com.apple.developer.devicecheck.appattest-environment',
1970-
'foo', ['development']))):
1971-
plist = {'com.apple.developer.devicecheck.appattest-environment': 'foo'}
1972-
self._assert_plisttool_result(
1973-
{
1974-
'plists': [plist],
1975-
'entitlements_options': {
1976-
'profile_metadata_file': {
1977-
'Entitlements': {
1978-
'com.apple.developer.devicecheck.appattest-environment':
1979-
['development'],
1980-
},
1981-
'Version': 1,
1982-
},
1983-
},
1984-
}, plist)
1985-
19861946
def test_attest_mismatch(self):
19871947
with self.assertRaisesRegex(
19881948
plisttool.PlistToolError,
@@ -2055,20 +2015,6 @@ def test_entitlements_profile_missing_beta_reports_active(self):
20552015
},
20562016
}, plist)
20572017

2058-
def test_entitlements_missing_wifi_info_active_default_validation(self):
2059-
plist = {}
2060-
self._assert_plisttool_result({
2061-
'plists': [plist],
2062-
'entitlements_options': {
2063-
'profile_metadata_file': {
2064-
'Entitlements': {
2065-
'com.apple.developer.networking.wifi-info': True,
2066-
},
2067-
'Version': 1,
2068-
},
2069-
},
2070-
}, plist)
2071-
20722018
def test_entitlements_missing_wifi_info_active(self):
20732019
plist = {}
20742020
self._assert_plisttool_result({
@@ -2086,25 +2032,6 @@ def test_entitlements_missing_wifi_info_active(self):
20862032
},
20872033
}, plist)
20882034

2089-
def test_entitlements_wifi_info_active_mismatch_default_validation(self):
2090-
with self.assertRaisesRegex(
2091-
plisttool.PlistToolError,
2092-
re.escape(plisttool.ENTITLEMENTS_VALUE_MISMATCH % (
2093-
_testing_target, 'com.apple.developer.networking.wifi-info',
2094-
'False', 'True'))):
2095-
plist = {'com.apple.developer.networking.wifi-info': False}
2096-
self._assert_plisttool_result({
2097-
'plists': [plist],
2098-
'entitlements_options': {
2099-
'profile_metadata_file': {
2100-
'Entitlements': {
2101-
'com.apple.developer.networking.wifi-info': True,
2102-
},
2103-
'Version': 1,
2104-
},
2105-
},
2106-
}, plist)
2107-
21082035
def test_entitlements_wifi_info_active_mismatch(self):
21092036
with self.assertRaisesRegex(
21102037
plisttool.PlistToolError,
@@ -2143,26 +2070,6 @@ def test_entitlements_wifi_info_active_mismatch_with_no_extra_keys_to_match(self
21432070
},
21442071
}, plist)
21452072

2146-
def test_entitlements_profile_missing_wifi_info_active_default_validation(self):
2147-
with self.assertRaisesRegex(
2148-
plisttool.PlistToolError,
2149-
re.escape(
2150-
plisttool.ENTITLEMENTS_MISSING %
2151-
(_testing_target, 'com.apple.developer.networking.wifi-info'))):
2152-
plist = {'com.apple.developer.networking.wifi-info': True}
2153-
self._assert_plisttool_result({
2154-
'plists': [plist],
2155-
'entitlements_options': {
2156-
'profile_metadata_file': {
2157-
'Entitlements': {
2158-
'application-identifier': 'QWERTY.*',
2159-
# No wifi-info
2160-
},
2161-
'Version': 1,
2162-
},
2163-
},
2164-
}, plist)
2165-
21662073
def test_entitlements_profile_missing_wifi_info_active(self):
21672074
with self.assertRaisesRegex(
21682075
plisttool.PlistToolError,

0 commit comments

Comments
 (0)