Command Line Options

View product v1.0.0

In-App Protection Shielder for Apple supports the following command-line options:

iap-shielder protect [OPTIONS] <input-application>

Options on the command line override the same values in the configuration files.

Required Options

Option	Description
`--output <path>`, `-o`	Output file with the shielded application. Must be different from the input file. Not required with `--dry-run`.
`--runtime <path>`	Path to `IAPShielderRuntime.xcframework`, with `iap-shielder-artifact-manifest.json` in the same folder. Not required if set as `runtime.artifact` in the configuration file.

Option	Description
`--config <config.yml>`	Configuration file. See Configuration.
`--signing-config <signing.yml>`	Signing configuration file. See Signing.
`--defer-signing`	Shields the application without signing it. The output has to be signed before installation.
`--expected-team-id <team-id>`	Apple Team ID the application is signed with. Required for Repackaging Detection with deferred signing.
`--trusted-certificate-sha256 <hash>`	SHA-256 hash of a trusted signing certificate. Repeat for each certificate. Replaces the list from the configuration file.
`--dry-run`	Validates the inputs and prints the shielding plan. Writes no output.
`--version`	Prints the version.
`-h`, `--help`	Prints help.

These options are used only when the Shielder signs the application. They are not allowed with --defer-signing.

Option	Description
`--signing-identity <identity>`	SHA-1 hash (preferred) or name of the signing certificate in the keychain. Required unless set in the signing configuration file.
`--keychain <path>`	Keychain with the signing identity.
`--profile <path>`	Provisioning profile for the main application.
`--profile-for <bundle-id>=<path>`	Provisioning profile for one bundle ID, for example an app extension. Repeatable.
`--profiles-directory <path>`	Folder with provisioning profiles, matched to the application and its extensions automatically.
`--entitlements <path>`	Entitlements file for the main application.
`--entitlements-for <bundle-id>=<path>`	Entitlements file for one bundle ID. Repeatable.
`--remove-entitlement <bundle-id>:<key>`	Removes one entitlement. Repeatable.
`--[no-]synthesize-identifier-entitlements`	For unsigned input without an entitlements file, sets only the identifier entitlements.
`--[no-]require-explicit-app-id`	Rejects provisioning profiles with a wildcard App ID. Required for App Store distribution.