Report
On Windows with plumesign 2.6.0, signing an IPA with a saved Apple ID account produces an output file that is identical to the unsigned input.
plumesign sign `
--package Han1meViewer-unsigned.ipa `
--apple-id `
--output Han1meViewer-signed.ipa
The signing logs show the app and its frameworks being signed, and the command exits with code 0:
Saved signed package to: Han1meViewer-signed.ipa
However, both files have the same hash:
unsigned: 7366C9F721BE7290EA429CCFAF26BAB6D90A45BC81F3C093309C8D90072FAE26
signed: 7366C9F721BE7290EA429CCFAF26BAB6D90A45BC81F3C093309C8D90072FAE26
The output IPA has no _CodeSignature directory or embedded.mobileprovision. Installing it fails with 0xe800801c: No code signature found.
I reproduced this twice with the release CLI.
It looks like sign.rs passes the original IPA path here:
pkg.get_archive_based_on_path(&args.package.clone())?
Since the path is a file, get_archive_based_on_path returns the staged copy of the original IPA instead of calling archive_package_bundle(). The signed staging directory is therefore never repacked.
Contributor Checks
Additional Information
Report
On Windows with
plumesign 2.6.0, signing an IPA with a saved Apple ID account produces an output file that is identical to the unsigned input.The signing logs show the app and its frameworks being signed, and the command exits with code 0:
However, both files have the same hash:
The output IPA has no
_CodeSignaturedirectory orembedded.mobileprovision. Installing it fails with0xe800801c: No code signature found.I reproduced this twice with the release CLI.
It looks like
sign.rspasses the original IPA path here:Since the path is a file,
get_archive_based_on_pathreturns the staged copy of the original IPA instead of callingarchive_package_bundle(). The signed staging directory is therefore never repacked.Contributor Checks
Additional Information