logo标签列表

通过命令行归档并分发iOS应用到App Store

iosxcodeapp-store
15
通常情况下，当我将iOS应用提交到App Store时，我会在Xcode中选择“产品” -> “归档”，然后选择“分发到App Store”。我可以成功地创建一个存档版本：
xcodebuild -scheme "myScheme" archive -archivePath /my/path/myArchive

但是，我如何使用正确的配置文件进行签名流程，并通过命令行进行分发？

对于Ad Hoc版本构建，我在归档后使用以下命令生成我的ipa：

xcodebuild -exportArchive -exportFormat IPA -archivePath myArchive.xcarchive -exportPath /my/path/myFile.ipa -exportProvisioningProfile 'my adhoc profile name'

在分发到应用商店时，我是否需要生成ipa文件？无论如何，我如何使用正确的配置文件进行签名并通过命令行分发？

1个回答
18

关于Xcode 8的更新，请见回答底部。

首先回答问题的最后一部分 - 是的，通过iTunes连接提交应用程序需要一个App Store预配配置文件。如果没有正确的预配配置文件，则不会通过预验证步骤。您需要在会员中心创建一个App Store分发配置文件。

添加iOS预配配置文件截图

对于问题的第一部分来说，使用命令行工具创建、签名和分发存档和IPA文件的过程文档很少。实现脚本化解决方案充满了陷阱，因为在某些情况下，工具不会按预期进行处理，并且需要更详细的了解开发人员帐户、密钥链、签名证书和预配配置文件之间的关系。

以下是一个示例脚本，可用于创建嵌入Ad Hoc预配配置文件的存档、创建适用于Ad Hoc分发的IPA。同时也会创建DSYMs压缩文件以供上传至TestFlight。然后提供了另外两个脚本。第一个将从现有的xcarchive创建一个App Store版本的IPA，第二个将展示如何修改xcarchive以便第三方可以重新签名并用于企业内部分发。

此自动化构建脚本假定预配配置文件可在名为ProvisioningProfiles的目录中与源代码一起检查。它还假定存储在构建用户主目录中的受保护文件中的密码可以解锁保存签名证书的密钥链。

#!/bin/sh

# SETME
# set to name of signing certification usually starts something like "iPhone Distribution: ...."
# (the associated private key must be available in the key store)
#
# use the command "security find-identity" to list all the possible values available
#
codeSignIdentity="iPhone Distribution"

# SETME
# set to location of Ad Hoc provisioning profile
# (this profile must have the codeSignIdentity specified above included in it)
#
provisioningProfile=ProvisioningProfiles/MyAppAdHocDistribution.mobileprovision

# The keychain needs to be unlocked for signing, which requires the keychain
# password. This is stored in a file in the build account only accessible to
# the build account user
if [ ! -f $HOME/.pass ] ; then
    echo "no keychain password file available"
    exit 1
fi

case `stat -L -f "%p" $HOME/.pass`
in
    *400) ;;
    *)
        echo "keychain password file permissions are not restrictive enough"
        echo "chmod 400 $HOME/.pass"
        exit 1
        ;;
esac

#
# turn off tracing if it is on for security command
# to prevent logging of password
#
case `set -o | grep xtrace`
in
    *on) xon=yes ;;
    *) xon=no ;;
esac

#
# unlock the keychain, automatically lock keychain on script exit
#
[ $xon == yes ] && set +x
security unlock-keychain -p `cat $HOME/.pass` $HOME/Library/Keychains/login.keychain
[ $xon == yes ] && set -x
trap "security lock-keychain $HOME/Library/Keychains/login.keychain" EXIT

#
# Extract the profile UUID from the checked in Provisioning Profile.
#
uuid=`/usr/libexec/plistbuddy -c Print:UUID /dev/stdin <<< \
        \`security cms -D -i $provisioningProfile\``

#
# Copy the profile to the location XCode expects to find it and start the build,
# specifying which profile and signing identity to use for the archived app
#
cp -f $provisioningProfile \
        "$HOME/Library/MobileDevice/Provisioning Profiles/$uuid.mobileprovision"

#
# Build the xcarchive - this will only be done once, will will then
# distribute it for Ad Hoc, App Store and Enterprise In House scenarios
# (profile must be specified by UUID for this step)
#
xcodebuild \
    -workspace MyApp.xcworkspace \
    -scheme MyApp \
    -archivePath build/MyApp.xcarchive \
    archive \
    PROVISIONING_PROFILE="$uuid" \
    CODE_SIGN_IDENTITY="$codeSignIdentity"

#
# Create a zip of the DSYMs for TestFlight
#
/usr/bin/zip -r MyApp.dSYM.zip build/MyApp.xcarchive/dSYMs/MyApp.app.dSYM

#
# now distribute the xcarchive using an Ad Hoc profile
# (for QA testing for example)
#
profileName=`/usr/libexec/plistbuddy -c Print:Name /dev/stdin <<< \
        \`security cms -D -i $provisioningProfile\``

#
# The profile must be specified by name for this step
#
xcodebuild \
        -exportArchive \
        -exportFormat IPA \
        -archivePath build/MyApp.xcarchive \
        -exportPath MyAppForAdHoc.ipa \
        -exportProvisioningProfile "$profileName"

要使用应用商店发布配置文件重新分发 xcarchive，请使用新配置文件重新导出 xcarchive（对于 Ad Hoc 和应用商店配置文件，签名标识相同）。

# SETME
# set to location of App Store provisioning profile
#
appStoreProvisioningProfile=ProvisioningProfiles/MyAppAppStoreDistribution.mobileprovision

#
# Extract the App Store profile UUID from the checked in Provisioning Profile.
#
uuid=`/usr/libexec/plistbuddy -c Print:UUID /dev/stdin <<< \
        \`security cms -D -i $appStoreProvisioningProfile\``

#
# Copy the profile to the location XCode expects to find it and start the export,
# specifying which profile to use for the archived app
# (Profile must match with signing identity used to create xcarchive)
#
cp -f $appStoreProvisioningProfile \
        "$HOME/Library/MobileDevice/Provisioning Profiles/$uuid.mobileprovision"

#
# Extract the enterprise profile name from the checked in App Store Provisioning Profile.
# and redistribute the xcarchive as an App Store ready IPA
#
profileName=`/usr/libexec/plistbuddy -c Print:Name /dev/stdin <<< \
        \`security cms -D -i $appStoreProvisioningProfile\``

#
# Profile must be specified by name for this step
#
xcodebuild \
    -exportArchive \
    -exportFormat IPA \
    -archivePath build/MyApp.xcarchive \
    -exportPath MyAppForStore.ipa \
    -exportProvisioningProfile "$profileName"

最后完整一点，如果您想使用新的身份和配置文件重新签名xcarchive怎么办？如果您向第三方公司分发xcarchives以供内部分发使用，则可能会出现这种情况。接收方需要使用其企业证书为分发签署您的xcarchive。xcodebuild无法强制覆盖xcarchive中的现有代码签名，因此必须直接使用codesign。

# SETME
# set to name of enterprise signing certification usually starts something like
# "iPhone Distribution: ...."
#
# use the command "security find-identity" to list all the possible values available
#
enterpriseCodeSignIdentity="iPhone Distribution: Acme Ltd"

# SETME
# set to location of Enterprise In-House provisioning profile
# (this profile must be associated with the enterprise code signing identity)
#
enterpriseProvisioningProfile=ProvisioningProfiles/MyAppInHouseDistribution.mobileprovision

# SETME
# A resigning of the app with a different certificate requires a new bundle ID
# that is registered by the Enterprise and is included in the In-House distribution
# profile (This could be automatically extracted from the Enterprise In-House distribution
# profile, I leave that as an ETTR)
enterpriseBundleId="com.enterprise.myapp"

#
# Extract the enterprise profile UUID from the checked in Provisioning Profile.
#
euuid=`/usr/libexec/plistbuddy -c Print:UUID /dev/stdin <<< \
        \`security cms -D -i $enterpriseProvisioningProfile\``

#
# Copy the profile to the location XCode expects to find it and start the build,
# specifying which profile and signing identity to use for the archived app
#
cp -f $enterpriseProvisioningProfile \
        "$HOME/Library/MobileDevice/Provisioning Profiles/$euuid.mobileprovision"

#
# Copy, modify and resign the xcarchive ready for Enterprise deployment
# (has to be resigned as the production certificate is different for enterprise)
#
cp -Rp build/MyApp.xcarchive build/MyAppEnterprise.xcarchive

#
# Remove old code signature
#
rm -rf build/MyAppEnterprise.xcarchive/Products/Applications/MyApp.app/_CodeSignature

#
# copy in the enterprise provisioning profile
#
cp $enterpriseProvisioningProfile \
        build/MyAppEnterprise.xcarchive/Products/Applications/MyApp.app/embedded.mobileprovision

#
# Modify the bundle id to that of the enterprise bundle id
#   
/usr/libexec/plistbuddy -c "Set:CFBundleIdentifier $enterpriseBundleId" \
        build/MyAppEnterprise.xcarchive/Products/Applications/MyApp.app/Info.plist

#
# resign the xcarchive with the enterprise code signing identity
#
/usr/bin/codesign -f -v -s $enterpriseCodeSignIdentity \
        build/MyAppEnterprise.xcarchive/Products/Applications/MyApp.app 

#
# Update the DSYM bundle id and create a zip of the DSYMs for TestFlight (if applicable)
#
/usr/libexec/plistbuddy -c "Set:CFBundleIdentifier com.apple.xcode.dsym.${enterpriseBundleId}" \
        build/MyAppEnterprise.xcarchive/dSYMs/MyApp.app.dSYM/Contents/Info.plist
/usr/bin/zip -r MyAppEnterprise.dSYM.zip build/MyAppEnterprise.xcarchive/dSYMs/MyApp.app.dSYM

#
# Extract the enterprise profile Name from the checked in Provisioning Profile.
#
enterpriseProfileName=`/usr/libexec/plistbuddy -c Print:Name /dev/stdin <<< \
        l\`security cms -D -i $enterpriseProvisioningProfile\``

#
# Profile must be specified by name for this step
#
xcodebuild \
    -exportArchive \
    -exportFormat IPA \
    -archivePath build/MyAppEnterprise.xcarchive \
    -exportPath MyAppEnterprise.ipa \
    -exportProvisioningProfile "$enterpriseProfileName"

如果该脚本作为launchd守护程序运行，请参见此答案https://dev59.com/NWw15IYBdhLWcg3wGn9c#9482707，以解决从launchd守护程序访问登录钥匙串的问题。

OSX Mavericks和Yosemite的更新

在OSX Mavericks（v10.9.5）和OSX Yosemite上，您可能会看到代码签名错误：

Codesign check fails : ...../MyApp.app: resource envelope is obsolete

请查看此处的帖子以了解原因xcodebuild - codesign -vvvv says"resource envelope is obsolete"

要实现苹果支持在引用的帖子中建议的更改，请运行以下命令：

 sudo perl -pi.bak -e 's/--verify"./--verify", "--no-strict",/ if /codesign.*origApp/;' `xcrun -sdk iphoneos -f PackageApplication`

Xcode8更新说明

在Xcode8中，以前回答中描述的过程已经无法与新的自动管理签名功能一起使用，因此您需要选择手动签名才能使用此方法。

如果您希望使用自动签名，在这里根据我们尝试在IBM Jazz和Jenkins CI环境下使其工作的一些观察结果：

  1. 如果您有一台CI机器，则可以通过创建并分配开发人员帐户到CI机器上的Xcode实例来获得自动代码签名。这是一个手动步骤，我没有找到通过命令行导入开发人员配置文件的方法。

  2. 如果您使用具有多个构建机器的分布式CI环境，它就不会很好地工作。首先你需要解决上面的问题，必须手动添加开发人员帐户到所有Xcode实例，其次每个帐户都必须是不同的Apple ID，否则您将为常用构建帐户遇到证书生成问题（所有机器共享一个帐户，因此会导致开发人员证书与特定机器绑定引发冲突）。

我们运行了一个分布式Jenkins CI环境，所以我们坚持使用手动签名，但是导出IPA的方法已经改变，现在必须使用-exportOptionsPlist选项。

更改存档命令：

#
# Build the xcarchive - this will only be done once, will will then
# distribute it for Ad Hoc, App Store and Enterprise In House scenarios
#
xcodebuild \
    -workspace MyApp.xcworkspace \
    -scheme MyApp \
    -archivePath build/MyApp.xcarchive \
    archive

存档使用与构建账户相关的iOS开发者证书进行签名（因此请确保在钥匙串中已安装证书）。现在，可以使用 -exportOptionsPlist 选项将存档导出为 Ad-hoc、企业和 App Store 的 IPA 格式。

创建一个名为 exportAppStore.plist 的文件，并将以下内容保存到您的顶级项目目录中。

<?xml version="1.0" encoding="UTF-8"?>                                                                                                                                                                                                                                                                                                     
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>app-store</string>
</dict>
</plist>

查看输出xcodebuild -help以获取完整的可用于-exportOptionsPlist选项的键列表。

现在修改导出存档命令，使用新的导出选项plist文件。

xcodebuild \
    -exportArchive \
    -archivePath build/MyApp.xcarchive \
    -exportOptionsPlist exportAppStore.plist \
    -exportPath MyAppForStore.ipa
@BitByeDog：可以解释一下你如何生成$HOME/.pass文件吗？我在Yosemite上找不到这个文件。 - Hamid Tavakoli
1
@Hamid，$HOME/.pass文件只是一个包含构建用户密码的文本文件。该文件受到文件权限的保护，以防止未经授权的访问。以下两个命令将完成此操作：1. echo -n "<myBuildAccountPassword>" > $HOME/.pass 2. chmod 400 $HOME/.pass。请记住，在<myBuildAccountPassword>的位置替换实际的帐户密码。 - BitByteDog
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接