Description
What happened?
Background
XCFrameworks have an expected signature, as explained in this Apple documentation:
Verifying the origin of your XCFrameworks
Support for this was added to xcodeproj via this PR: CocoaPods/Xcodeproj#924.
Issue
It appears that Tuist does not support the expectedSignature property when adding an XCFramework dependency. When a project is generated that includes an XCFramework, the framework is added without this signature. Additionally, there doesn’t seem to be any reference to expectedSignature in Tuist’s codebase.
Expected Behavior
Tuist should allow specifying an expectedSignature for XCFramework dependencies, ensuring that projects generated by Tuist conform to Apple’s security requirements.
How do we reproduce it?
- Download the zip file attached here and unzip it.
- Download
RxSwift.xcframworkfrom https://github.com/ReactiveX/RxSwift, and drag it into thexcframeworksdirectory. Make sure it is signed (you can compare the signature to the one in the README of this repo, see Apple's doc). - (Optional) Run
git initin the extracted directory to track changes more easily. - With the .xcodeproj from this directory closed, run:
tuist generate --no-open
- Observe the changes in the .xcodeproj file.
The provided directory contains an .xcodeproj file that is not the one generated by Tuist, but rather the one that Xcode automatically modifies to include the missing signature. Running tuist generate will highlight the differences between the Tuist-generated project and the expected format (which Xcode tries to revert to automatically).
xcframework-signature-example.zip
Error log
Example of the difference:
- 5CA7963E2D8E037E81425C42 /* RxSwift.xcframework */ = {isa = PBXFileReference; expectedSignature = "SelfSigned:BD802E794C8ABDDA4C3F5D92B3E4C4FBFAE4734410B9AD73442EF1CEB0276140"; lastKnownFileType = wrapper.xcframework; path = RxSwift.xcframework; sourceTree = "<group>"; };
+ 5CA7963E2D8E037E81425C42 /* RxSwift.xcframework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.xcframework; path = RxSwift.xcframework; sourceTree = "<group>"; };
--> before runningtuist generate+-> after runningtuist generate
macOS version
Saquia
Tuist version
4.43.2
Xcode version
16.1 (but also observed in other versions)