SideSign

A Swift library for resigning iOS apps, provisioning developer certificates, and communicating with Apple Developer APIs.

---

Features

• Cryptography & Code Signing: Powered by CodeSignKit for CMS/PKCS#7 signature generation, PKCS#12 archive parsing/export, and Mach-O binary signing.
• Apple SRP & GrandSlam Protocol: uses GSACryptoKit for secure SRP-6a cryptographic handshakes and performs Authentication using GrandSlam Authentication (GSA) flow.
• Streaming Zip Support: High-Speed IPA unpacking and repacking backed by minizip-ng with exact POSIX permission preservation.
• Full Bundle & Extension Resigning: In-Depth resigning support for main executables, app extensions, plugins, and embedded frameworks.

---

Architecture Overview

                                ┌───────────────────┐
                                │     SideSign      │                       ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐
                                │ GSA, portal apis  │ ◀ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ │    AnisetteKit    │
                                └─────────┬─────────┘                       │  (Local Anisette) │
                                          │                                 └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘
             ┌────────────────────────────┼────────────────────────────┐
             │                            │                            │
             ▼                            ▼                            ▼
     ┌───────────────┐            ┌───────────────┐            ┌───────────────┐
     │  CodeSignKit  │            │ GSACryptoKit  │            │  minizip-ng   │
     │ (CMS, PKCS#12,│            │(SRP-6a Client │            │  (Streaming   │
     │  Mach-O, CD)  │            │  Crypto utils)│            │   Zip Engine) │
     └───────────────┘            └───────────────┘            └───────────────┘

---

Core Capabilities

1. IPA Resigning (AppBundleSigner)

• Extracts and parses application bundles (.app).
• Resigns Mach-O binaries (thin and FAT architectures) using cryptographic signatures generated by CodeSignKit.
• Injects and embeds active embedded.mobileprovision profiles.
• Dynamically validates and rewrites entitlements (application-identifier, team-identifier, keychain-access-groups).
• Recursively signs nested app extensions, frameworks, and helper tools with correct designated requirements.
• Repackages resigned bundles into release-ready .ipa archives.

2. Certificate Management (CertificateParser, PKCS12Parser)

• CSR Generation: Generates 2048-bit RSA keys and PKCS#10 Certificate Signing Requests without external CLI or OpenSSL binaries.
• PKCS#12 Handling: Imports, exports, and parses .p12 archives with full support for unencrypted, 3DES, PBES2, and AES cipher suites.
• X.509 Parsing: Extracts certificate serial numbers, common names, validity ranges, and issuer details.

3. Apple Developer API Client (DeveloperPortal)

• Fetches active developer accounts, teams, and entitlements.
• Registers new bundle IDs (AppID) and app groups (AppGroup).
• Registers device UDIDs (Device).
• Submits CSRs to request and download iOS Development certificates.
• Generates and downloads development provisioning profiles.

4. High-Performance Archive Streaming (Archive)

• Reads and writes ZIP/IPA archives via direct Swift wrappers over minizip-ng.
• Preserves executable bits, symbolic links, and POSIX file modes.

---

Swift Package Integration

Add SideSign to your Package.swift:

dependencies: [
    .package(url: "https://github.com/SideStore/SideSign.git", branch: "main"),
]

Target configuration:

.target(
    name: "YourTarget",
    dependencies: [
        .product(name: "SideSign", package: "SideSign"),
// or   .product(name: "SideSign-Dynamic", package: "SideSign"),
    ]
)

---

Usage Examples

Signing an Application Bundle

import SideSign
import CodeSignKit

let signer = AppBundleSigner(team: team, keyStore: keyStore)

let appURL = URL(fileURLWithPath: "/path/to/Payload/MyApp.app")
let profile = ProvisioningProfile(data: profileData)!

try await signer.signApp(
    at: appURL,
    provisioningProfiles: [profile]
)

Generating a Certificate Signing Request (CSR)

import SideSign

let certRequest = try CertificateRequest(machineName: "My Mac")
let csrData = certRequest.csrData
let privateKeyData = certRequest.privateKey

Exporting and Parsing .p12 Files

import SideSign

// Parse X.509 certificate and private key from PKCS#12
let (certDER, keyDER) = try PKCS12Parser.extract(p12Data, password: "password")

// Parse certificate metadata
if let info = CertificateParser.parseCertificate(certDER) {
    print("Name: \(info.name), Serial: \(info.serial)")
    print("Expires: \(info.expiryDate ?? Date.distantPast)")
}

---

License

This project is licensed under the terms of the GNU General Public License v3.0 (GPL-3.0).