Codesign Lottie.xcframework #2259

calda · 2023-12-14T19:11:09Z

This PR updates the job that builds Lottie.xcframework to codesign the bundle using a self-signed certificate.

When viewing Lottie.xcframework in Xcode 15 it now shows the following signature information:

We'll publish the signature fingerprint in the README so consumers can validate they're using an authentic build.

calda · 2023-12-14T22:36:54Z

.github/workflows/main.yml

+      - uses: apple-actions/import-codesign-certs@v2
+        with:
+          p12-file-base64: ${{ secrets.SIGNING_CERTIFICATE_BASE_64 }}
+          p12-password: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}


I followed these steps to create a self-signing certificate and installed it as a secret in this repository:

Create code signing certificate in Keychain Assistant (instructions)

Export .p12 file for the code signing certificate, protected with a password. I also added this password to my iCloud Keychain for future reference in case we need it.

Add certificate password as GitHub actions secret (SIGNING_CERTIFICATE_PASSWORD)

Convert certificate file to base64, e.g. using base64 -i "Lottie iOS Self Signing.p12".

Added base 64 as secret to GitHub repo, e.g. using SIGNING_CERTIFICATE_BASE_64 key

…work

This reverts commit e63369d.

jparise · 2023-12-15T19:02:44Z

.github/workflows/main.yml

@@ -86,11 +86,15 @@ jobs:
          - '14.1' # Swift 5.7.1
    steps:
      - uses: actions/checkout@v2
+      - uses: apple-actions/import-codesign-certs@v2
+        with:
+          p12-file-base64: ${{ secrets.SIGNING_CERTIFICATE_BASE_64 }}


nit: _BASE64 would be a little more natural spelling, but no strong feelings on that.

jparise · 2023-12-15T19:04:11Z

README.md

@@ -85,6 +85,14 @@ Lottie supports Swift / Xcode versions back to the minimum version that is permi

 Lottie does not collect any data. We provide this notice to help you fill out [App Privacy Details](https://developer.apple.com/app-store/app-privacy-details/). We additionally provide a [privacy manifest](https://github.com/airbnb/lottie-ios/blob/master/PrivacyInfo.xcprivacy) which can be included in your app.

+## Security
+
+We distribute XCFramework bundles for each release on [GitHub](https://github.com/airbnb/lottie-ios/releases/latest). In Lottie 4.4.0 and later, these XCFramework bundles include a [code signature](https://developer.apple.com/documentation/xcode/verifying-the-origin-of-your-xcframeworks). These bundles are self-signed under the name "Lottie iOS" and have the following fingerprint:


Should we include some instructions on how someone could use the fingerprint to verify the integrity of their framework artifact?

Good idea, updated: c7944f6

I couldn't easily find out how to verify this outside of Xcode, e.g. via the command line. Open to suggestions if you have any ideas!

I tried codesign -dv --verbose=4 Lottie.xcframework, but it doesn't show this specific fingerprint string:

Executable=/Users/calstephens/Downloads/BuildProducts/Lottie.xcframework/Info.plist Identifier=Lottie Format=bundle CodeDirectory v=20100 size=183 flags=0x0(none) hashes=1+3 location=embedded Hash type=sha256 size=32 CandidateCDHash sha1=8e6caf486f23b91f5bbc5eb92c40343ca894cf0d CandidateCDHashFull sha1=8e6caf486f23b91f5bbc5eb92c40343ca894cf0d CandidateCDHash sha256=99b40b7bf0ff70ea7abab9e549d3bdd01b26226b CandidateCDHashFull sha256=99b40b7bf0ff70ea7abab9e549d3bdd01b26226b613be5bca5976e32834aa4f7 Hash choices=sha1,sha256 CMSDigest=4baf8f8e561d838359115d9a23741afeac1a999720d6715a10c5b0238a988081 CMSDigestType=2 Page size=none CDHash=99b40b7bf0ff70ea7abab9e549d3bdd01b26226b Signature size=6332 Authority=Lottie iOS Timestamp=Dec 15, 2023 at 9:15:20 AM Info.plist entries=3 TeamIdentifier=not set Sealed Resources version=2 rules=10 files=83 Internal requirements count=1 size=84

Perhaps one of the hashes here corresponds to the fingerprint shown in Xcode via some encoding, but I'm not sure.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | minor | `from: "4.3.4"` -> `from: "4.4.0"` | --- ### Release Notes <details> <summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary> ### [`v4.4.0`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.0) [Compare Source](https://togithub.com/airbnb/lottie-spm/compare/4.3.4...4.4.0) #### New features - Add privacy manifest ([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252)) - Codesign Lottie.xcframework ([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259)) - Add time remapping support to Core Animation rendering engine ([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286)) - Add official visionOS support to lottie-ios repo ([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287)) - lottie-spm now supports visionOS ([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12)) - Adopt policy on minimum supported Swift / Xcode version, update minimum versions to Swift 5.7 / Xcode 14.1 ([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260)) #### Bug fixes - Update LottieView to display placeholder using `overlay` instead of `ZStack` ([https://github.com/airbnb/lottie-ios/pull/2289](https://togithub.com/airbnb/lottie-ios/pull/2289)) - Fix issue where Core Animation rendering engine couldn't display last frame of animation when paused ([https://github.com/airbnb/lottie-ios/pull/2254](https://togithub.com/airbnb/lottie-ios/pull/2254)) - Do not create `DotLottieImageProvider` instance if there's no image files ([https://github.com/airbnb/lottie-ios/pull/2271](https://togithub.com/airbnb/lottie-ios/pull/2271)) - Mark DotLottieCache as Sendable ([https://github.com/airbnb/lottie-ios/pull/2245](https://togithub.com/airbnb/lottie-ios/pull/2245)) - Fix issue where AnimationKeypath in SolidLayer could be incorrect ([https://github.com/airbnb/lottie-ios/pull/2278](https://togithub.com/airbnb/lottie-ios/pull/2278)) - Fix issue where Repeater could be displayed incorrectly ([https://github.com/airbnb/lottie-ios/pull/2276](https://togithub.com/airbnb/lottie-ios/pull/2276)) - Include dSYMs in xcframework build ([https://github.com/airbnb/lottie-ios/pull/2284](https://togithub.com/airbnb/lottie-ios/pull/2284)) - Fix parsing issue, add support for DotLottieConfiguration in SwiftUI LottieView ([https://github.com/airbnb/lottie-ios/pull/2277](https://togithub.com/airbnb/lottie-ios/pull/2277)) - Fix issue where DotLottieImageProvider didn't handle base64 images ([https://github.com/airbnb/lottie-ios/pull/2283](https://togithub.com/airbnb/lottie-ios/pull/2283)) - Fix issue where manually interpolated keyframes could animate incorrectly ([https://github.com/airbnb/lottie-ios/pull/2285](https://togithub.com/airbnb/lottie-ios/pull/2285)) **Full Changelog**: airbnb/lottie-ios@4.3.4...4.4.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch | `from: "4.4.0"` -> `from: "4.4.1"` | --- ### Release Notes <details> <summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary> ### [`v4.4.1`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.1) [Compare Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.0...4.4.1) ##### Bug fixes in 4.4.1 - Replace os check with canImport so classes are available on visionOS ([https://github.com/airbnb/lottie-ios/pull/2294](https://togithub.com/airbnb/lottie-ios/pull/2294)) - Omit privacy manifest from source files in podspec ([https://github.com/airbnb/lottie-ios/pull/2307](https://togithub.com/airbnb/lottie-ios/pull/2307)) - Fix crash in Main Thread rendering engine path interpolation implementation ([https://github.com/airbnb/lottie-ios/pull/2305](https://togithub.com/airbnb/lottie-ios/pull/2305)) - Fix warning from invalid character in Cocoapods resource bundle identifier ([https://github.com/airbnb/lottie-ios/pull/2317](https://togithub.com/airbnb/lottie-ios/pull/2317)) - Fix infinite loop when setting `LottieAnimationView.viewportFrame` ([https://github.com/airbnb/lottie-ios/pull/2316](https://togithub.com/airbnb/lottie-ios/pull/2316)) ##### New features in 4.4.0 - Add privacy manifest ([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252)) - Codesign Lottie.xcframework ([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259)) - Add time remapping support to Core Animation rendering engine ([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286)) - Add official visionOS support to lottie-ios repo ([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287)) - lottie-spm now supports visionOS ([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12)) - Adopt policy on minimum supported Swift / Xcode version, update minimum versions to Swift 5.7 / Xcode 14.1 ([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260)) **Full Changelog**: airbnb/lottie-ios@4.4.0...4.4.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch | `from: "4.4.1"` -> `from: "4.4.2"` | --- ### Release Notes <details> <summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary> ### [`v4.4.2`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.2) [Compare Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.1...4.4.2) ##### Changes in 4.4.2 - Update minimum deployment target to iOS 13.0 / macOS 10.15 ([https://github.com/airbnb/lottie-ios/pull/2322](https://togithub.com/airbnb/lottie-ios/pull/2322)) - Add privacy manifest to lottie-spm repo ([https://github.com/airbnb/lottie-spm/pull/23](https://togithub.com/airbnb/lottie-spm/pull/23)) - Add visionOS support to Cocoapods podspec ([https://github.com/airbnb/lottie-ios/pull/2348](https://togithub.com/airbnb/lottie-ios/pull/2348)) - Fix incorrect usage of `State(initialValue:)` in `LottieView` ([https://github.com/airbnb/lottie-ios/pull/2357](https://togithub.com/airbnb/lottie-ios/pull/2357)) - Use correct version number when building XCFramework bundle ([https://github.com/airbnb/lottie-ios/pull/2341](https://togithub.com/airbnb/lottie-ios/pull/2341)) ##### New features in 4.4.0 - Add privacy manifest ([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252)) - Codesign Lottie.xcframework ([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259)) - Add time remapping support to Core Animation rendering engine ([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286)) - Add official visionOS support to lottie-ios repo ([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287)) - lottie-spm now supports visionOS ([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12)) - Adopt policy on minimum supported Swift / Xcode version, update minimum versions to Swift 5.7 / Xcode 14.1 ([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260)) **Full Changelog**: airbnb/lottie-ios@4.4.1...4.4.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>

) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [airbnb/lottie-spm](https://togithub.com/airbnb/lottie-spm) | patch | `from: "4.4.2"` -> `from: "4.4.3"` | --- ### Release Notes <details> <summary>airbnb/lottie-spm (airbnb/lottie-spm)</summary> ### [`v4.4.3`](https://togithub.com/airbnb/lottie-spm/releases/tag/4.4.3) [Compare Source](https://togithub.com/airbnb/lottie-spm/compare/4.4.2...4.4.3) ##### Bug fixes in 4.4.3 - Fix issue where animation size could be incorrect after loading async animation ([https://github.com/airbnb/lottie-ios/pull/2379](https://togithub.com/airbnb/lottie-ios/pull/2379)) - Update NSPrivacyAccessedAPITypeReasons in privacy manifest ([https://github.com/airbnb/lottie-ios/pull/2380](https://togithub.com/airbnb/lottie-ios/pull/2380)) - Include animation duration when computing cost/complexity of Core Animation time remapping ([https://github.com/airbnb/lottie-ios/pull/2381](https://togithub.com/airbnb/lottie-ios/pull/2381)) ##### New features in 4.4.0 - Add privacy manifest ([https://github.com/airbnb/lottie-ios/pull/2252](https://togithub.com/airbnb/lottie-ios/pull/2252)) - Codesign Lottie.xcframework ([https://github.com/airbnb/lottie-ios/pull/2259](https://togithub.com/airbnb/lottie-ios/pull/2259)) - Add time remapping support to Core Animation rendering engine ([https://github.com/airbnb/lottie-ios/pull/2286](https://togithub.com/airbnb/lottie-ios/pull/2286)) - Add official visionOS support to lottie-ios repo ([https://github.com/airbnb/lottie-ios/pull/2287](https://togithub.com/airbnb/lottie-ios/pull/2287)) - lottie-spm now supports visionOS ([https://github.com/airbnb/lottie-spm/pull/12](https://togithub.com/airbnb/lottie-spm/pull/12)) - Adopt policy on minimum supported Swift / Xcode version, update minimum versions to Swift 5.7 / Xcode 14.1 ([https://github.com/airbnb/lottie-ios/pull/2260](https://togithub.com/airbnb/lottie-ios/pull/2260)) **Full Changelog**: airbnb/lottie-ios@4.4.2...4.4.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: Self-hosted Renovate Bot <361546+cgrindel-self-hosted-renovate[bot]@users.noreply.github.enterprise.com>

calda force-pushed the cal--codesigning branch 4 times, most recently from 54b5628 to 414c20c Compare December 14, 2023 22:33

calda commented Dec 14, 2023

View reviewed changes

calda force-pushed the cal--codesigning branch from 414c20c to e43751f Compare December 14, 2023 22:38

calda and others added 10 commits December 15, 2023 08:14

Import signing certificate from secrets and use when building XCFrame…

a569680

…work

Tweak command for importing certificate

a876be2

Use password protected .p12 file, pass custom keychain path to rakefile

3608de1

Unlock keychain in build script

0cc1976

Revert "Unlock keychain in build script"

91cc0a6

This reverts commit e63369d.

Simplify by using apple-actions/import-codesign-certs

10b7305

Clean up

ac9f320

Update certificate name

6b27a67

Add content about self-signing fingerprint to README

467a3dd

Update README.md

ca5f1ec

calda force-pushed the cal--codesigning branch from 7a9d900 to ca5f1ec Compare December 15, 2023 16:14

Clean up

4ac820d

calda marked this pull request as ready for review December 15, 2023 17:20

jparise reviewed Dec 15, 2023

View reviewed changes

Add information about how to verify signature in Xcode

c7944f6

jparise approved these changes Dec 15, 2023

View reviewed changes

calda enabled auto-merge (squash) December 15, 2023 19:31

calda merged commit abaf862 into master Dec 15, 2023
14 checks passed

calda deleted the cal--codesigning branch December 15, 2023 20:32

calda mentioned this pull request Jan 23, 2024

Add privacy manifest #2252

Merged

Muesly mentioned this pull request Feb 6, 2024

SnapKit SDK Signature SnapKit/SnapKit#800

Closed

3 tasks

iago849 pushed a commit to atteamapps/lottie-ios that referenced this pull request Feb 8, 2024

Codesign Lottie.xcframework (airbnb#2259)

0b47d29

MoroziOS pushed a commit to MoroziOS/tmg-lottie-ios that referenced this pull request May 22, 2024

Codesign Lottie.xcframework (airbnb#2259)

a14570a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Codesign Lottie.xcframework #2259

Codesign Lottie.xcframework #2259

calda commented Dec 14, 2023 •

edited

Loading

calda Dec 14, 2023 •

edited

Loading

jparise Dec 15, 2023

jparise Dec 15, 2023

calda Dec 15, 2023 •

edited

Loading

Codesign Lottie.xcframework #2259

Codesign Lottie.xcframework #2259

Conversation

calda commented Dec 14, 2023 • edited Loading

calda Dec 14, 2023 • edited Loading

Choose a reason for hiding this comment

jparise Dec 15, 2023

Choose a reason for hiding this comment

jparise Dec 15, 2023

Choose a reason for hiding this comment

calda Dec 15, 2023 • edited Loading

Choose a reason for hiding this comment

calda commented Dec 14, 2023 •

edited

Loading

calda Dec 14, 2023 •

edited

Loading

calda Dec 15, 2023 •

edited

Loading