Skip to content

Draft: Secure File Parsers POC

Darby Frey requested to merge code-signing-parsers into master

Context

For some additional context, please see this issue: #374949 (closed)

What does this MR do and why?

This MR is a proof of concept to see how we can extract and visualize useful information from Apple provisioning profiles and signing certificates stored in Project-level Secure Files. Below is a screenshot of the information we are able to visualize from these files:

image

There is additional data that can be added to the UI under entitlements and devices. Below is a sample of what the data looks like:

Provisioning Profile:

{:uuid=>"6b9fcce1-b9a9-4b37-b2ce-ec4da2044abz",
 :expires_at=>2023-08-01 18:15:13 -0500,
 :platforms=>["iOS"],
 :team_name=>"Darby Frey",
 :team_id=>["N7SYAN8PXZ"],
 :app_name=>"iOS Demo",
 :app_id=>"match Development com.gitlab.ios-demo",
 :app_id_prefix=>["N7SYAN8PXZ"],
 :xcode_managed=>false,
 :entitlements=>
  {"com.apple.developer.game-center"=>true,
   "application-identifier"=>"N7SYAN8PXZ.com.gitlab.ios-demo",
   "keychain-access-groups"=>["N7SYAN8PXZ.*", "com.apple.token"],
   "get-task-allow"=>true,
   "com.apple.developer.team-identifier"=>"N7SYAN8PXZ"},
 :devices=>["00008101-001454860C1000Z"],
 :certificate_ids=>["23380136242930206312716563638445789123"]}

Signing Certificate

{:issuer=>
  {"C"=>"US",
   "O"=>"Apple Inc.",
   "OU"=>"G3",
   "CN"=>"Apple Worldwide Developer Relations Certification Authority"},
 :subject=>
  {"C"=>"US",
   "O"=>"Darby Frey",
   "OU"=>"N7SYAN8PXZ",
   "CN"=>"Apple Development: Darby Frey (A3TN6GLHVZ)",
   "UID"=>"N9NDSZF6AA"},
 :serial=>"23380136242930206312716563638445789123",
 :expires_at=>2022-08-01 23:05:04 UTC}

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Darby Frey

Merge request reports