Signing
In-App Protection Shielder for Apple modifies the application, so the application has to be signed after shielding. The Shielder can sign the application itself, or the application can be signed afterwards by the owner of the signing certificates.
Signing by the Shielder
The Shielder signs the application, its extensions, and the runtime SDK. The following are required:
- a signing identity in an unlocked keychain,
- a provisioning profile for the main application and for each app extension, from the same team as the signing identity.
Entitlements are taken from the original signature and can be adjusted with the entitlements options.
The signing inputs are set with the signing options or in a signing configuration file (--signing-config). Example:
schema_version: 1
signing:
identity: "<SHA-1 of the signing certificate>"
profiles:
main: profiles/App.mobileprovision
by_bundle_id:
com.example.app.share: profiles/Share.mobileprovision
require_explicit_app_id: true
| Option | Command Line Option |
|---|---|
signing.identity |
--signing-identity |
signing.keychain |
--keychain |
signing.profiles.main |
--profile |
signing.profiles.by_bundle_id |
--profile-for |
signing.profiles.directory |
--profiles-directory |
signing.entitlements.main |
--entitlements |
signing.entitlements.by_bundle_id |
--entitlements-for |
signing.entitlements.remove |
--remove-entitlement |
signing.synthesize_identifier_entitlements |
--[no-]synthesize-identifier-entitlements |
signing.require_explicit_app_id |
--[no-]require-explicit-app-id |
The signing identities and their SHA-1 hashes are listed by:
security find-identity -v -p codesigning
Signing After Shielding
With --defer-signing, the Shielder keeps the existing signatures and profiles. The input application has to be signed, and the shielded application has to be signed again before installation.
All components have to be signed with certificates of the same team, from the innermost to the outermost:
- frameworks and libraries in
Frameworks/, includingIAPShielderRuntime.framework, without entitlements, - app extensions in
PlugIns/and other nested bundles, such as App Clips or watch apps, each with its own provisioning profile, - the main application, with its provisioning profile.
App extensions, nested bundles and the main application keep the entitlements of the original signature, adjusted to their provisioning profiles. Each provisioning profile has to include the signing certificate.