fix(ios): harden third-party app signing

Author: legeling

.github/workflows/release.yml

@@ -106,6 +106,8 @@ jobs:
           -only-testing:AltTests/AltTests/testSourceID
           -only-testing:AltTests/AltTests/testAltForgeSourceDeepLink
           -only-testing:AltTests/AltTests/testALTApplicationIgnoresMalformedOptionalMetadata
+          -only-testing:AltTests/AltTests/testUnsupportedAppleWatchBundleIsRemovedBeforeSigning
+          -only-testing:AltTests/AltTests/testSigningDiagnosticDetailIsRelativeAndBounded
           -only-testing:AltTests/AltTests/testThemePreferenceDefaultsAndRoundTrips
 
       - name: Build unsigned iOS application

AltStore/Managing Apps/AppManager.swift

@@ -104,7 +104,15 @@ private final class PendingAppOperationStore
         var events = records[index].events ?? []
         guard events.last?.stage != stage || events.last?.detail != boundedDetail else { return }
 
-        events.append(PendingAppOperationEvent(date: Date(), stage: stage, detail: boundedDetail))
+        let event = PendingAppOperationEvent(date: Date(), stage: stage, detail: boundedDetail)
+        if stage == .signingApp, events.last?.stage == .signingApp
+        {
+            events[events.count - 1] = event
+        }
+        else
+        {
+            events.append(event)
+        }
         records[index].events = Array(events.suffix(PendingAppOperation.maximumEventCount))
         self.save(records)
     }

AltStore/Operations/ResignAppOperation.swift

@@ -12,6 +12,46 @@ import Roxas
 import AltStoreCore
 import AltSign
 
+func removeUnsupportedAppleWatchBundle(from appBundleURL: URL, fileManager: FileManager = .default) throws -> Bool
+{
+    let watchURL = appBundleURL.appendingPathComponent("Watch", isDirectory: true)
+    guard fileManager.fileExists(atPath: watchURL.path) else { return false }
+
+    try fileManager.removeItem(at: watchURL)
+    return true
+}
+
+func sanitizedSigningDiagnosticDetail(_ rawValue: String) -> String?
+{
+    var value = rawValue
+        .replacingOccurrences(of: "\\", with: "/")
+        .unicodeScalars
+        .filter { !CharacterSet.controlCharacters.contains($0) }
+        .map(String.init)
+        .joined()
+
+    if value == "*"
+    {
+        return NSLocalizedString("Main App Bundle", comment: "Signing diagnostic detail")
+    }
+
+    if value.hasSuffix("*")
+    {
+        value.removeLast()
+    }
+
+    let components = value
+        .split(separator: "/", omittingEmptySubsequences: true)
+        .map(String.init)
+        .filter { $0 != "." && $0 != ".." }
+    guard !components.isEmpty else { return nil }
+
+    // ldid paths are relative to the app bundle. Keeping only the trailing
+    // components prevents accidental disclosure if a future caller passes an
+    // absolute path while retaining the bundle, executable, and architecture.
+    return components.suffix(4).joined(separator: "/")
+}
+
 @objc(ResignAppOperation)
 class ResignAppOperation: ResultOperation<ALTApplication>, @unchecked Sendable
 {
@@ -158,6 +198,12 @@ private extension ResignAppOperation
             {
                 let appBundleURL = self.context.temporaryDirectory.appendingPathComponent("App.app")
                 try FileManager.default.copyItem(at: fileURL, to: appBundleURL)
+
+                if try removeUnsupportedAppleWatchBundle(from: appBundleURL)
+                {
+                    self.context.recordDiagnostic(.preparingApp, detail: NSLocalizedString("Removed unsupported Apple Watch components", comment: "App operation diagnostic detail"))
+                    Logger.sideload.notice("Removed unsupported Apple Watch components before signing.")
+                }
 
                 // Become current so we can observe progress from unzipAppBundle().
                 progress.becomeCurrent(withPendingUnitCount: 1)
@@ -253,7 +299,10 @@ private extension ResignAppOperation
     func resignAppBundle(at fileURL: URL, team: ALTTeam, certificate: ALTCertificate, profiles: [ALTProvisioningProfile], completionHandler: @escaping (Result<URL, Error>) -> Void) -> Progress
     {
         let signer = ALTSigner(team: team, certificate: certificate)
-        let progress = signer.signApp(at: fileURL, provisioningProfiles: profiles) { (success, error) in
+        let progress = signer.signApp(at: fileURL, provisioningProfiles: profiles, progressHandler: { rawDetail in
+            guard let detail = sanitizedSigningDiagnosticDetail(rawDetail) else { return }
+            self.context.recordDiagnostic(.signingApp, detail: detail)
+        }) { (success, error) in
             do
             {
                 try Result(success, error).get()

AltStore/Resources/Localizable.xcstrings

@@ -361,6 +361,26 @@
         }
       }
     },
+    "Main App Bundle" : {
+      "localizations" : {
+        "zh-Hans" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "主应用包"
+          }
+        }
+      }
+    },
+    "Removed unsupported Apple Watch components" : {
+      "localizations" : {
+        "zh-Hans" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "已移除不受支持的 Apple Watch 组件"
+          }
+        }
+      }
+    },
     "Sending App" : {
       "localizations" : {
         "zh-Hans" : {

AltTests/AltTests.swift

@@ -93,6 +93,33 @@ final class AltTests: XCTestCase
         XCTAssertNil(application.icon)
     }
 
+    func testUnsupportedAppleWatchBundleIsRemovedBeforeSigning() throws
+    {
+        let appURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString, isDirectory: true)
+            .appendingPathExtension("app")
+        defer { try? FileManager.default.removeItem(at: appURL) }
+
+        let watchAppURL = appURL
+            .appendingPathComponent("Watch", isDirectory: true)
+            .appendingPathComponent("Companion.app", isDirectory: true)
+        try FileManager.default.createDirectory(at: watchAppURL, withIntermediateDirectories: true)
+
+        XCTAssertTrue(try removeUnsupportedAppleWatchBundle(from: appURL))
+        XCTAssertFalse(FileManager.default.fileExists(atPath: watchAppURL.path))
+        XCTAssertFalse(try removeUnsupportedAppleWatchBundle(from: appURL))
+    }
+
+    func testSigningDiagnosticDetailIsRelativeAndBounded()
+    {
+        let rawValue = "/private/var/mobile/Payload/WeChat.app/Frameworks/Example.framework/Example (arm64)\n"
+        let detail = sanitizedSigningDiagnosticDetail(rawValue)
+
+        XCTAssertEqual(detail, "WeChat.app/Frameworks/Example.framework/Example (arm64)")
+        XCTAssertFalse(detail?.contains("/private/var/mobile") == true)
+        XCTAssertEqual(sanitizedSigningDiagnosticDetail("*"), NSLocalizedString("Main App Bundle", comment: "Signing diagnostic detail"))
+    }
+
     func testThemePreferenceDefaultsAndRoundTrips()
     {
         let suiteName = "com.legeling.AltForgeTests.Theme.\(UUID().uuidString)"

Dependencies/AltSign

@@ -105,6 +105,10 @@ def png_dimensions(root, path)
 assert(ldid_source.include?("#define CPU_TYPE_ARM64_32"), "ldid must recognize Apple Watch arm64_32 Mach-O binaries")
 assert(ldid_source.include?('arch = "arm64_32"'), "ldid signing progress must name the arm64_32 architecture without constructing a string from NULL")
 assert(ldid_source.include?("unsupported CPU type:"), "ldid must reject unknown CPU types with a catchable error instead of crashing")
+alt_signer = read(root, "Dependencies/AltSign/AltSign/Signing/ALTSigner.mm")
+assert(!alt_signer.include?("return entitlements.UTF8String;"), "AltSign must not construct std::string from nullable Objective-C entitlement bytes")
+assert(alt_signer.include?("embedded bundle is missing prepared entitlements or a provisioning profile"), "AltSign must turn missing embedded-bundle entitlements into a catchable error")
+assert(alt_signer.include?("progressHandler(detail)"), "AltSign must expose bounded bundle and Mach-O signing checkpoints")
 release_workflow = read(root, ".github/workflows/release.yml")
 assert(release_workflow.include?("bash Scripts/test_ldid_architecture_compatibility.sh"), "Apple release CI must exercise ldid architecture compatibility")
 
@@ -157,6 +161,7 @@ def png_dimensions(root, path)
 assert(ios_app_manager.include?("recoverInterruptedOperations"), "interrupted iOS operations must become visible after relaunch")
 assert(ios_app_manager.include?("PendingAppOperations.json"), "pending iOS operations must use an atomic on-disk journal")
 assert(ios_app_manager.include?("try data.write(to: self.fileURL, options: .atomic)"), "pending iOS operation journal writes must be atomic")
+assert(ios_app_manager.include?("if stage == .signingApp, events.last?.stage == .signingApp"), "signing checkpoints must replace the latest signing event instead of evicting the bounded stage history")
 assert(ios_app_manager.include?("recoverUnexpectedTermination"), "unexpected foreground termination must become visible after relaunch")
 assert(ios_app_manager.include?("CurrentSession.json") && ios_app_manager.include?("InterruptedSession.json"), "app lifecycle recovery must retain bounded current and interrupted session records")
 assert(ios_app_manager.include?("guard didSave else { return }"), "interrupted operation records must remain pending until the recovery log saves")
@@ -174,6 +179,9 @@ def png_dimensions(root, path)
 assert(my_apps_update&.include?("cellForItem(at: indexPath) as? NoUpdatesCollectionViewCell"), "My Apps must update the already-visible no-updates cell without mutating collection structure")
 verify_app = read(root, "AltStore/Operations/VerifyAppOperation.swift")
 assert(verify_app.include?("throw self.context.error ?? OperationError.invalidApp()"), "a missing prepared app must surface as a handled invalid-app error")
+resign_app = read(root, "AltStore/Operations/ResignAppOperation.swift")
+assert(resign_app.include?("removeUnsupportedAppleWatchBundle(from: appBundleURL)"), "unsupported Apple Watch companion bundles must be removed before iPhone app signing")
+assert(resign_app.include?("sanitizedSigningDiagnosticDetail"), "signing checkpoints must be sanitized before entering persistent diagnostics")
 
 ios_operation_contexts = read(root, "AltStore/Operations/OperationContexts.swift")
 %w[findingServer authenticating preparingApp verifyingApp preparingProfiles signingApp sendingApp installingApp refreshingApp].each do |stage|
@@ -183,10 +191,11 @@ def png_dimensions(root, path)
 assert(ios_error_log.include?('NSLocalizedString("Copy Diagnostic Report"'), "error log must expose the bounded diagnostic report action")
 assert(ios_error_log.include?("ALTDiagnosticTraceErrorKey"), "copied error reports must include the operation trace")
 diagnostic_detail_calls = Dir.glob(File.join(root, "AltStore/**/*.swift")).flat_map { |path| File.readlines(path).grep(/recordDiagnostic\(\..*detail:/) }
-assert(diagnostic_detail_calls.all? { |line| line.include?("localizedDiagnosticName") || line.include?("authenticationDiagnosticDetail") }, "diagnostic details must remain on the connection/team-category allowlist")
+allowed_diagnostic_details = ["localizedDiagnosticName", "authenticationDiagnosticDetail", "recordDiagnostic(.signingApp, detail: detail)", "Removed unsupported Apple Watch components"]
+assert(diagnostic_detail_calls.all? { |line| allowed_diagnostic_details.any? { |value| line.include?(value) } }, "diagnostic details must remain on the connection/team/signing allowlist")
 
 ios_strings = JSON.parse(read(root, "AltStore/Resources/Localizable.xcstrings")).fetch("strings")
-["Authentication Ready", "Authenticating Apple ID", "Diagnostic ID", "Failure Stage", "Operation Trace", "Copy Diagnostic Report", "AltForge closed unexpectedly while it was active.", "The installation ended before AltForge received a result.", "Theme Color", "Forge Red", "Ocean Blue", "Indigo", "Rose", "Selected"].each do |key|
+["Authentication Ready", "Authenticating Apple ID", "Diagnostic ID", "Failure Stage", "Operation Trace", "Copy Diagnostic Report", "AltForge closed unexpectedly while it was active.", "The installation ended before AltForge received a result.", "Main App Bundle", "Removed unsupported Apple Watch components", "Theme Color", "Forge Red", "Ocean Blue", "Indigo", "Rose", "Selected"].each do |key|
   assert(ios_strings.dig(key, "localizations", "zh-Hans", "stringUnit", "value"), "missing Simplified Chinese diagnostic string: #{key}")
 end