Cocoapods: Possibility to specify code signing identity

[akashivskyy]

As a developer I should be able to specify (e.g. in Podfile) which identity should be used to code sign the framework dependencies.

As of today, CocoaPods sets the code signing identity to iOS Developer, which prevents CI builds from archiving and distributing the projects (as only distribution certificate is available).

The problem lies in xcodeproj/lib/constants.rb:158, where CODE_SIGN_IDENTITY is hardcoded to iPhone Developer.

This is related to #3156.

[segiddins]

You can already kinda do this via a post install hook, but I'm still not convinced it's necessary

[neonichu]

@segiddins Yah, shouldn't the actual signing be done by the frameworks script?

[piemonte]

@akashivskyy +1

[segiddins]

Yeah, the signing is done by the embed frameworks script, so this is unnecessary. But maybe we should forcibly disable signing on all CocoaPods targets from within Xcode?

[neonichu]

@segiddins I don't think that will work, IIRC Xcode errors when building a framework for iOS with code signing disabled

[segiddins]

Ah darn. In that case, I don't think there's anything for us to do.

[neonichu]

I agree, for people hitting special cases where they need this, a post-install hook should be totally fine.

[piemonte]

thanks for considering.

it's true, it is a special case for the folks that need it. although having to add a post install hook would require you to fork that repository and modify it. which was what I hoped to avoid.

[akashivskyy]

@piemonte You can add a post-install hook in your Podfile. Here's my current solution:

post_install do |installer|

  puts 'Setting appropriate code signing identities'
  installer.pods_project.targets.each { |target|
    {
      'iPhone Developer' => ['Debug'],
      'iPhone Distribution' => ['Release', 'Staging', 'Production'],
    }.each { |value, configs|
      target.set_build_setting('CODE_SIGN_IDENTITY[sdk=iphoneos*]', value, configs)
    }
  }

end


class Xcodeproj::Project::Object::PBXNativeTarget

  def set_build_setting setting, value, config = nil
    unless config.nil?
      if config.kind_of?(Xcodeproj::Project::Object::XCBuildConfiguration)
        config.build_settings[setting] = value
      elsif config.kind_of?(String)
        build_configurations
          .select { |config_obj| config_obj.name == config }
          .each { |config| set_build_setting(setting, value, config) }
      elsif config.kind_of?(Array)
        config.each { |config| set_build_setting(setting, value, config) }
      else
        raise 'Unsupported configuration type: ' + config.class.inspect
      end
    else
      set_build_setting(setting, value, build_configurations)
    end
  end

end

[piemonte]

ah, i see now. @akashivskyy you're awesome. thanks for the help everyone. ✌️

[rkeniger]

@akashivskyy Thanks so much for this. I've been tearing my hair out trying to get Jenkins to build a Swift project with Frameworks. Your solution is the only one that actually worked.

[fcy]

I've this problem and read through all the different solutions I found. There is one thing that I don't understand, based on the conversation here disabling code signing for Frameworks shouldn't work.

But maybe we should forcibly disable signing on all CocoaPods targets from within Xcode?

...

I don't think that will work, IIRC Xcode errors when building a framework for iOS with code signing disabled

If that is the case why the following post install hook fixes the problem? Am I missing something?

post_install do |installer|
  installer.pods_project.targets.each do |target|
    target.build_configurations.each do |config|
      config.build_settings['EXPANDED_CODE_SIGN_IDENTITY'] = ""
      config.build_settings['CODE_SIGNING_REQUIRED'] = "NO"
      config.build_settings['CODE_SIGNING_ALLOWED'] = "NO"
    end
  end
end

Edit: Things I tried using this post install hook: running on a device, archiving from the command line, archiving from Xcode and pass validation to submit to app store (didn't actually submit though).

[neonichu]

Could be that Xcode's build step got more lenient in the meantime and accepts building frameworks for the device without code-signing.

[ikonst]

For one, IB Designables can not be loaded from unsigned frameworks.