Skip to content

[codex] Fix Developer ID DNS proxy signing #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
offyotto merged 1 commit into from
Jun 7, 2026
Merged

[codex] Fix Developer ID DNS proxy signing #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
126 changes: 126 additions & 0 deletions Locale.xcodeproj/project.pbxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,8 @@
30F000000000000000000002 /* main.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = main.swift; sourceTree = "<group>"; };
40F000000000000000000001 /* Locale.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Locale.entitlements; sourceTree = "<group>"; };
40F000000000000000000002 /* LocaleDNSProxy.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = LocaleDNSProxy.entitlements; sourceTree = "<group>"; };
40F000000000000000000007 /* LocaleDirect.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = LocaleDirect.entitlements; sourceTree = "<group>"; };
40F000000000000000000008 /* LocaleDNSProxyDirect.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = LocaleDNSProxyDirect.entitlements; sourceTree = "<group>"; };
40F000000000000000000003 /* AppIcon.icns */ = {isa = PBXFileReference; lastKnownFileType = image.icns; path = AppIcon.icns; sourceTree = "<group>"; };
40F000000000000000000004 /* Assets.car */ = {isa = PBXFileReference; lastKnownFileType = file; path = Assets.car; sourceTree = "<group>"; };
40F000000000000000000005 /* Locale-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "Locale-Info.plist"; sourceTree = "<group>"; };
Expand Down Expand Up @@ -203,6 +205,8 @@
40F000000000000000000006 /* LocaleDNSProxy-Info.plist */,
40F000000000000000000001 /* Locale.entitlements */,
40F000000000000000000002 /* LocaleDNSProxy.entitlements */,
40F000000000000000000007 /* LocaleDirect.entitlements */,
40F000000000000000000008 /* LocaleDNSProxyDirect.entitlements */,
40F000000000000000000003 /* AppIcon.icns */,
40F000000000000000000004 /* Assets.car */,
);
Expand Down Expand Up @@ -517,6 +521,59 @@
};
name = Release;
};
80C000000000000000000003 /* Direct */ = {
isa = XCBuildConfiguration;
buildSettings = {
CLANG_ANALYZER_NONNULL = YES;
CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_ENABLE_OBJC_WEAK = YES;
CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
CLANG_WARN_BOOL_CONVERSION = YES;
CLANG_WARN_COMMA = YES;
CLANG_WARN_CONSTANT_CONVERSION = YES;
CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
CLANG_WARN_EMPTY_BODY = YES;
CLANG_WARN_ENUM_CONVERSION = YES;
CLANG_WARN_INFINITE_RECURSION = YES;
CLANG_WARN_INT_CONVERSION = YES;
CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
CLANG_WARN_STRICT_PROTOTYPES = YES;
CLANG_WARN_SUSPICIOUS_MOVE = YES;
CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
CLANG_WARN_UNREACHABLE_CODE = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
COPY_PHASE_STRIP = NO;
DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
ENABLE_NS_ASSERTIONS = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
GCC_C_LANGUAGE_STANDARD = gnu17;
GCC_NO_COMMON_BLOCKS = YES;
GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
GCC_WARN_UNDECLARED_SELECTOR = YES;
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES;
MACOSX_DEPLOYMENT_TARGET = 14.0;
MTL_ENABLE_DEBUG_INFO = NO;
MTL_FAST_MATH = YES;
SDKROOT = macosx;
SWIFT_COMPILATION_MODE = wholemodule;
SWIFT_OPTIMIZATION_LEVEL = "-Osize";
SWIFT_VERSION = 5.0;
};
name = Direct;
};
81C000000000000000000001 /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
Expand Down Expand Up @@ -565,6 +622,31 @@
};
name = Release;
};
81C000000000000000000003 /* Direct */ = {
isa = XCBuildConfiguration;
buildSettings = {
CODE_SIGN_ENTITLEMENTS = Resources/LocaleDirect.entitlements;
CODE_SIGNING_ALLOWED = NO;
CODE_SIGN_STYLE = Automatic;
CURRENT_PROJECT_VERSION = "20260603.2";
DEVELOPMENT_TEAM = 6VDP675K4L;
ENABLE_HARDENED_RUNTIME = YES;
GENERATE_INFOPLIST_FILE = NO;
INFOPLIST_FILE = "Resources/Locale-Info.plist";
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/../Frameworks",
);
MARKETING_VERSION = 1.0.0;
PRODUCT_BUNDLE_IDENTIFIER = dev.offyotto.Locale;
PRODUCT_MODULE_NAME = LocaleApp;
PRODUCT_NAME = Locale;
PROVISIONING_PROFILE_SPECIFIER = "";
SKIP_INSTALL = NO;
SWIFT_VERSION = 5.0;
};
name = Direct;
};
82C000000000000000000001 /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
Expand All @@ -589,6 +671,18 @@
};
name = Release;
};
82C000000000000000000003 /* Direct */ = {
isa = XCBuildConfiguration;
buildSettings = {
DEFINES_MODULE = YES;
MACH_O_TYPE = staticlib;
PRODUCT_MODULE_NAME = LocaleShared;
PRODUCT_NAME = LocaleShared;
SKIP_INSTALL = YES;
SWIFT_VERSION = 5.0;
};
name = Direct;
};
83C000000000000000000001 /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
Expand Down Expand Up @@ -643,6 +737,34 @@
};
name = Release;
};
83C000000000000000000003 /* Direct */ = {
isa = XCBuildConfiguration;
buildSettings = {
CODE_SIGN_ENTITLEMENTS = Resources/LocaleDNSProxyDirect.entitlements;
CODE_SIGNING_ALLOWED = NO;
CODE_SIGN_STYLE = Automatic;
CURRENT_PROJECT_VERSION = "20260603.2";
DEVELOPMENT_TEAM = 6VDP675K4L;
ENABLE_HARDENED_RUNTIME = YES;
GENERATE_INFOPLIST_FILE = NO;
INFOPLIST_FILE = "Resources/LocaleDNSProxy-Info.plist";
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/../Frameworks",
"@executable_path/../../../../Frameworks",
);
MARKETING_VERSION = 1.0.0;
PRODUCT_BUNDLE_IDENTIFIER = dev.offyotto.Locale.LocaleDNSProxy;
PRODUCT_MODULE_NAME = LocaleDNSProxy;
PRODUCT_NAME = LocaleDNSProxy;
PROVISIONING_PROFILE_SPECIFIER = "";
SKIP_INSTALL = YES;
SWIFT_VERSION = 5.0;
WRAPPER_NAME = dev.offyotto.Locale.LocaleDNSProxy.systemextension;
WRAPPER_EXTENSION = systemextension;
};
name = Direct;
};
/* End XCBuildConfiguration section */

/* Begin XCConfigurationList section */
Expand All @@ -651,6 +773,7 @@
buildConfigurations = (
80C000000000000000000001 /* Debug */,
80C000000000000000000002 /* Release */,
80C000000000000000000003 /* Direct */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
Expand All @@ -660,6 +783,7 @@
buildConfigurations = (
81C000000000000000000001 /* Debug */,
81C000000000000000000002 /* Release */,
81C000000000000000000003 /* Direct */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
Expand All @@ -669,6 +793,7 @@
buildConfigurations = (
82C000000000000000000001 /* Debug */,
82C000000000000000000002 /* Release */,
82C000000000000000000003 /* Direct */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
Expand All @@ -678,6 +803,7 @@
buildConfigurations = (
83C000000000000000000001 /* Debug */,
83C000000000000000000002 /* Release */,
83C000000000000000000003 /* Direct */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
Expand Down
77 changes: 77 additions & 0 deletions Locale.xcodeproj/xcshareddata/xcschemes/LocaleAppDirect.xcscheme
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "2650"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"
buildImplicitDependencies = "YES"
buildArchitectures = "Automatic">
<BuildActionEntries>
<BuildActionEntry
buildForTesting = "YES"
buildForRunning = "YES"
buildForProfiling = "YES"
buildForArchiving = "YES"
buildForAnalyzing = "YES">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "111111111111111111111111"
BuildableName = "Locale.app"
BlueprintName = "LocaleApp"
ReferencedContainer = "container:Locale.xcodeproj">
</BuildableReference>
</BuildActionEntry>
</BuildActionEntries>
</BuildAction>
<TestAction
buildConfiguration = "Debug"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
shouldUseLaunchSchemeArgsEnv = "YES">
</TestAction>
<LaunchAction
buildConfiguration = "Debug"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
launchStyle = "0"
useCustomWorkingDirectory = "NO"
ignoresPersistentStateOnLaunch = "NO"
debugDocumentVersioning = "YES"
debugServiceExtension = "internal"
allowLocationSimulation = "YES">
<BuildableProductRunnable
runnableDebuggingMode = "0">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "111111111111111111111111"
BuildableName = "Locale.app"
BlueprintName = "LocaleApp"
ReferencedContainer = "container:Locale.xcodeproj">
</BuildableReference>
</BuildableProductRunnable>
</LaunchAction>
<ProfileAction
buildConfiguration = "Direct"
shouldUseLaunchSchemeArgsEnv = "YES"
savedToolIdentifier = ""
useCustomWorkingDirectory = "NO"
debugDocumentVersioning = "YES">
<BuildableProductRunnable
runnableDebuggingMode = "0">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "111111111111111111111111"
BuildableName = "Locale.app"
BlueprintName = "LocaleApp"
ReferencedContainer = "container:Locale.xcodeproj">
</BuildableReference>
</BuildableProductRunnable>
</ProfileAction>
<AnalyzeAction
buildConfiguration = "Debug">
</AnalyzeAction>
<ArchiveAction
buildConfiguration = "Direct"
revealArchiveInOrganizer = "YES">
</ArchiveAction>
</Scheme>
16 changes: 16 additions & 0 deletions Resources/ExportOptions-DeveloperID.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>destination</key>
<string>export</string>
<key>method</key>
<string>developer-id</string>
<key>signingStyle</key>
<string>automatic</string>
<key>stripSwiftSymbols</key>
<true/>
<key>teamID</key>
<string>6VDP675K4L</string>
</dict>
</plist>
16 changes: 16 additions & 0 deletions Resources/LocaleDNSProxyDirect.entitlements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>dns-proxy-systemextension</string>
</array>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.application-groups</key>
<array>
<string>group.dev.offyotto.Locale</string>
</array>
</dict>
</plist>
20 changes: 20 additions & 0 deletions Resources/LocaleDirect.entitlements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>dns-proxy-systemextension</string>
</array>
<key>com.apple.developer.system-extension.install</key>
<true/>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.application-groups</key>
<array>
<string>group.dev.offyotto.Locale</string>
</array>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
</dict>
</plist>
29 changes: 29 additions & 0 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,31 @@ Open `Locale.xcodeproj`, select the `LocaleApp` scheme, and archive that
scheme. The app and `LocaleDNSProxy` targets use automatic signing with the
development team `6VDP675K4L`.

For TestFlight or App Store submission, choose **App Store Connect** in
Organizer. Do not choose Direct Distribution for this path. Apple's Store
profiles carry the Network Extension value `dns-proxy`, which is what the
`Release` configuration uses.

If you intentionally need a Direct Distribution archive, switch the scheme to
`LocaleAppDirect` before archiving. Direct profiles carry
`dns-proxy-systemextension`, so that scheme archives the separate `Direct`
configuration with `Resources/LocaleDirect.entitlements` and
`Resources/LocaleDNSProxyDirect.entitlements`. The Direct configuration archives
unsigned on purpose; Xcode signs it during export with the Direct/Developer ID
profiles.

The repeatable CLI path for Developer ID export is:

```bash
./script/export_developer_id.sh
```

It writes:

```text
dist/developer-id/Locale.app
```

Do not archive the Swift package workspace directly. Xcode treats package
archives as Generic Xcode Archives because there is no installable app target
owning the archive.
Expand Down Expand Up @@ -46,6 +71,10 @@ dist/Locale-notarized.zip

It also validates the stapled app with `spctl` and `xcrun stapler validate`.

The notarization script signs with the Direct entitlement files because
Developer ID and Direct system extension profiles use the `-systemextension`
Network Extension values.

## Network Extension Notes

`LocaleDNSProxy` is staged as a system extension at:
Expand Down
Loading
Loading