Scope App Store signing to the release target

Author: takemiyamakoto

fearless.xcodeproj/project.pbxproj

@@ -19545,7 +19545,8 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = "AppIcon$(ICON_SUFFIX)";
 				CLONED_SOURCE_PACKAGES_DIR_PATH = "$(SRCROOT)/SourcePackages";
 				CODE_SIGN_ENTITLEMENTS = fearless/WalletConnect.entitlements;
-				CODE_SIGN_STYLE = Automatic;
+				CODE_SIGN_IDENTITY = "Apple Distribution: Soramitsu Co., Ltd. (YLWWUD25VZ)";
+				CODE_SIGN_STYLE = Manual;
 				CURRENT_PROJECT_VERSION = 2026.7.26;
 				DEVELOPMENT_TEAM = YLWWUD25VZ;
 				ENABLE_BITCODE = NO;
@@ -19560,7 +19561,7 @@
 				MARKETING_VERSION = 4.2.0;
 				PRODUCT_BUNDLE_IDENTIFIER = jp.co.soramitsu.fearlesswallet;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "";
+				PROVISIONING_PROFILE_SPECIFIER = "Fearless App Store 2026.7.26";
 				SWIFT_ENABLE_EXPLICIT_MODULES = NO;
 				SWIFT_OBJC_BRIDGING_HEADER = "fearless/fearless-Bridging-Header.h";
 				SWIFT_VERSION = 5.0;

scripts/ci/audit-ios-release-identity.sh

@@ -5,6 +5,8 @@ readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 readonly REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
 readonly EXPECTED_DEVELOPMENT_TEAM="YLWWUD25VZ"
+readonly EXPECTED_SIGNING_IDENTITY="Apple Distribution: Soramitsu Co., Ltd. (YLWWUD25VZ)"
+readonly EXPECTED_PROFILE_NAME="Fearless App Store 2026.7.26"
 readonly AUDIT_TEST_HARNESS="${IOS_RELEASE_AUDIT_TEST_HARNESS:-0}"
 
 fail() {
@@ -205,8 +207,10 @@ require_setting PRODUCT_BUNDLE_IDENTIFIER "$EXPECTED_BUNDLE_ID"
 require_setting MARKETING_VERSION "$EXPECTED_VERSION"
 require_setting CURRENT_PROJECT_VERSION "$EXPECTED_BUILD"
 require_setting CODE_SIGN_ENTITLEMENTS "fearless/WalletConnect.entitlements"
-require_setting CODE_SIGN_STYLE "Automatic"
+require_setting CODE_SIGN_STYLE "Manual"
+require_setting CODE_SIGN_IDENTITY "$EXPECTED_SIGNING_IDENTITY"
 require_setting DEVELOPMENT_TEAM "$EXPECTED_DEVELOPMENT_TEAM"
+require_setting PROVISIONING_PROFILE_SPECIFIER "$EXPECTED_PROFILE_NAME"
 require_setting SWIFT_OPTIMIZATION_LEVEL "-O"
 require_setting ENABLE_TESTABILITY "NO"
 

scripts/ci/build-audited-ios-release-archive.sh

@@ -7,7 +7,6 @@ set -euo pipefail
 umask 077
 
 readonly LOG_PREFIX="[ios-release-archive]"
-readonly EXPECTED_TEAM="YLWWUD25VZ"
 readonly EXPECTED_BUNDLE="jp.co.soramitsu.fearlesswallet"
 readonly EXPECTED_VERSION="4.2.0"
 readonly EXPECTED_SIGNING_IDENTITY="Apple Distribution: Soramitsu Co., Ltd. (YLWWUD25VZ)"
@@ -129,14 +128,11 @@ xcodebuild_arguments+=(
   "CURRENT_PROJECT_VERSION=$EXPECTED_BUILD"
   "MARKETING_VERSION=$EXPECTED_VERSION"
   "FEARLESS_GIT_COMMIT=$source_commit"
-  "DEVELOPMENT_TEAM=$EXPECTED_TEAM"
-  # Keep the application target's reviewed Automatic signing style. A
-  # PROVISIONING_PROFILE_SPECIFIER passed on the xcodebuild command line is a
-  # workspace-wide override: Xcode applies it to Pods and Swift-package
-  # resource bundles too, and those targets correctly reject provisioning
-  # profiles. The post-build audit below still fails closed unless Xcode chose
-  # the exact reviewed App Store profile and distribution certificate.
-  "CODE_SIGN_IDENTITY=$EXPECTED_SIGNING_IDENTITY"
+  # Signing is intentionally target-scoped in the application's Release build
+  # configuration. Any signing setting passed here would apply to every Pod,
+  # Swift package, and resource bundle in the workspace. The source identity
+  # audit above and signed-artifact audit below fail closed on the exact team,
+  # distribution identity, App Store profile, and production entitlements.
   clean
   archive
 )

scripts/test-ios-release-archive-signing-contract.sh

@@ -14,7 +14,7 @@ fail() {
 
 contains_workspace_signing_override() {
   grep -Eq \
-    '^[[:space:]]*"?(CODE_SIGN_STYLE|PROVISIONING_PROFILE(_SPECIFIER)?)=' \
+    '^[[:space:]]*"?(CODE_SIGN_IDENTITY|CODE_SIGN_STYLE|DEVELOPMENT_TEAM|PROVISIONING_PROFILE(_SPECIFIER)?)=' \
     "$1"
 }
 
@@ -44,14 +44,16 @@ while IFS= read -r override; do
 done <<'OVERRIDES'
 CODE_SIGN_STYLE=Manual
   "CODE_SIGN_STYLE=Automatic"
+CODE_SIGN_IDENTITY=Apple Distribution
+  "CODE_SIGN_IDENTITY=Apple Distribution"
+DEVELOPMENT_TEAM=YLWWUD25VZ
+  "DEVELOPMENT_TEAM=YLWWUD25VZ"
 PROVISIONING_PROFILE=01234567-89AB-CDEF-0123-456789ABCDEF
   "PROVISIONING_PROFILE=01234567-89AB-CDEF-0123-456789ABCDEF"
 PROVISIONING_PROFILE_SPECIFIER=Fearless App Store
   "PROVISIONING_PROFILE_SPECIFIER=Fearless App Store"
 OVERRIDES
 
-grep -Fq '"CODE_SIGN_IDENTITY=$EXPECTED_SIGNING_IDENTITY"' "$BUILD_SCRIPT" ||
-  fail "archive script does not bind the reviewed distribution identity"
 grep -Fq \
   'bash "$SCRIPT_DIR/audit-ios-signed-release-artifact.sh"' \
   "$BUILD_SCRIPT" ||
@@ -68,8 +70,16 @@ grep -Fq -- \
   '--expected-profile-name "$EXPECTED_PROFILE_NAME"' \
   "$BUILD_SCRIPT" ||
   fail "signed-artifact audit is not bound to the reviewed profile name"
-grep -Fq 'require_setting CODE_SIGN_STYLE "Automatic"' "$IDENTITY_AUDIT" ||
-  fail "release identity no longer requires target-scoped Automatic signing"
+grep -Fq 'require_setting CODE_SIGN_STYLE "Manual"' "$IDENTITY_AUDIT" ||
+  fail "release identity no longer requires target-scoped Manual signing"
+grep -Fq \
+  'require_setting CODE_SIGN_IDENTITY "$EXPECTED_SIGNING_IDENTITY"' \
+  "$IDENTITY_AUDIT" ||
+  fail "release identity no longer requires the target-scoped distribution identity"
+grep -Fq \
+  'require_setting PROVISIONING_PROFILE_SPECIFIER "$EXPECTED_PROFILE_NAME"' \
+  "$IDENTITY_AUDIT" ||
+  fail "release identity no longer requires the target-scoped App Store profile"
 
 printf '%s\n' \
   "[ios-release-archive-signing-test] PASS: canonical contract and $override_number workspace-wide override mutations"

scripts/test-ios-release-identity-audit.sh

@@ -43,8 +43,10 @@ jq -n '[
       MARKETING_VERSION: "4.2.0",
       CURRENT_PROJECT_VERSION: "2026.7.26",
       CODE_SIGN_ENTITLEMENTS: "fearless/WalletConnect.entitlements",
-      CODE_SIGN_STYLE: "Automatic",
+      CODE_SIGN_IDENTITY: "Apple Distribution: Soramitsu Co., Ltd. (YLWWUD25VZ)",
+      CODE_SIGN_STYLE: "Manual",
       DEVELOPMENT_TEAM: "YLWWUD25VZ",
+      PROVISIONING_PROFILE_SPECIFIER: "Fearless App Store 2026.7.26",
       SWIFT_OPTIMIZATION_LEVEL: "-O",
       ENABLE_TESTABILITY: "NO"
     }
@@ -149,10 +151,26 @@ mutate_setting ENABLE_TESTABILITY YES "$testable_release"
 run_reject testable-release \
   run_audit "$testable_release" "$scheme" "$entitlements"
 
-manual_signing="$FIXTURES/manual-signing.json"
-mutate_setting CODE_SIGN_STYLE Manual "$manual_signing"
-run_reject manual-signing \
-  run_audit "$manual_signing" "$scheme" "$entitlements"
+automatic_signing="$FIXTURES/automatic-signing.json"
+mutate_setting CODE_SIGN_STYLE Automatic "$automatic_signing"
+run_reject automatic-signing \
+  run_audit "$automatic_signing" "$scheme" "$entitlements"
+
+wrong_signing_identity="$FIXTURES/wrong-signing-identity.json"
+mutate_setting CODE_SIGN_IDENTITY "Apple Development" "$wrong_signing_identity"
+run_reject wrong-signing-identity \
+  run_audit "$wrong_signing_identity" "$scheme" "$entitlements"
+
+wrong_profile="$FIXTURES/wrong-profile.json"
+mutate_setting PROVISIONING_PROFILE_SPECIFIER \
+  "Another App Store Profile" "$wrong_profile"
+run_reject wrong-profile \
+  run_audit "$wrong_profile" "$scheme" "$entitlements"
+
+empty_profile="$FIXTURES/empty-profile.json"
+mutate_setting PROVISIONING_PROFILE_SPECIFIER "" "$empty_profile"
+run_reject empty-profile \
+  run_audit "$empty_profile" "$scheme" "$entitlements"
 
 wrong_team="$FIXTURES/wrong-team.json"
 mutate_setting DEVELOPMENT_TEAM AAAAAAAAAA "$wrong_team"