[gym] Use Xcode 13's cloud signing #19973

Should already work using the general xcargs parameter.

But of course, it would be nice if the same arguments as upload_to_testflight were supported, i.e.
--api_key_path ./path/to/api_key_info.json or --api_key "{\"key_id\": \"D83848D23\", \"issuer_id\": \"227b0bbf-ada8-458c-9d62-3d8022b7d07f\", \"key_filepath\": \"D83848D23.p8\"}"

This is awesome, it works, but only the first time, I'm building with CircleCI, first time everything is smooth, the app is signed and uploaded to TestFlight, but the second time I get this error

error: Revoke certificate: Your account already has an Apple Development signing certificate for this machine, but its private key is not installed in your keychain. Xcode can create a new one after revoking your existing certificate.

I understand why this is happening, but what would be the best way to handle this?

The perfect setup would be to not deal with profiles and certificates at all, but I might end up by still keeping the certificate handled by fastlane match.

Or maybe just revoke the certificate after each build?

This is amazing! 🤩 I'm in the agency business, and it always seemed like an overhead to set up match when developing a relatively small app for a client. Now we can check Automatically manage signing in the Xcode project, and everything works out of the box.

In the case of self-hosted CI, I'm using get_certificates to use a proper developer certificate (and create it if it doesn't exist). When using some cloud-based CI (with a new instance for every build), I'm using import_certificate to import a developer certificate stored in the repository. Xcode's cloud signing entirely manages distribution certificates and provisioning profiles.

It would be nice if gym can pick up the API key from app_store_connect_api_key and use it for those authenticationKeyID / authenticationKeyIssuerID / authenticationKeyPath xcargs. @joshdholtz What do you think? 🙂

hello all, i'm trying to get this to work, but i'm getting a security: SecItemCopyMatching: The specified item could not be found in the keychain. error.

i think this is because i don't have the private key that corresponds to development.cer

i'm running this on a github action, so i have to create_keychain and import_certificate each time.

so, i'm guessing that i need to actually do all the steps from the examples section of the import_certificate docs

import_certificate(certificate_path: "certs/AppleWWDRCA6.cer")

import_certificate(
  certificate_path: "certs/dist.p12",
  certificate_password: ENV["CERTIFICATE_PASSWORD"] || "default"
)

import_certificate(
  certificate_path: "certs/development.cer"
)

this is my fastfile definition

  desc "Submit a new Beta Build to Apple TestFlight"
  lane :beta do
    create_keychain(
      name: "test.keychain-db",
      password: "test123",
      default_keychain: true,
      unlock: true,
      timeout: 3600,
      lock_when_sleeps: true
    )    
    
    import_certificate(
      certificate_path: ENV['APPLE_DEVELOPMENT_CERT'],
      keychain_name: "test.keychain-db",
      keychain_password: "test123"
    )

    key_path = ENV['APPSTORE_CONNECT_KEY_PATH']
    xcargs = "-allowProvisioningUpdates -authenticationKeyIssuerID <iuid> -authenticationKeyID <kid> -authenticationKeyPath #{key_path}"

    build_app(
      workspace: "ios/test.xcworkspace",
      scheme: "test",
      export_method: "app-store",
      xcargs: xcargs,
    )

    # upload_to_testflight
  end

can anoyone confirm ? @pchmelar maybe ? :)

p.s.: i've looked at the following troubleshooting docs

• https://developer.apple.com/forums/thread/701696
• https://developer.apple.com/forums/thread/699268