From f66ab7eae945ff41e88600c8be2ba7553afa2174 Mon Sep 17 00:00:00 2001
From: mso7nueh <mso7nueh@mail.ru>
Date: Mon, 21 Apr 2025 18:17:05 +0300
Subject: [PATCH] fix(ci/cd): build tf

---
 Build-tf | 84 +++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 62 insertions(+), 22 deletions(-)

diff --git a/Build-tf b/Build-tf
index b697d11b..d1422cb7 100644
--- a/Build-tf
+++ b/Build-tf
@@ -6,6 +6,10 @@ set -o pipefail
 export LANG=en_US.UTF-8
 LANG=en_US.UTF-8
 
+IDENTITY="Apple Distribution: ITVIO, OOO (VL68C36HYS)"
+P12_PATH="${P12_PATH:-certs/distribution.p12}"
+P12_PASSWORD="${P12_PASSWORD:-password}"
+
 function finish() {
   if [[ -d "${RESULT_BUNDLE_PATH}" ]]; then
     ditto -c -k --sequesterRsrc --keepParent "${RESULT_BUNDLE_PATH}" "${RESULT_BUNDLE_PATH}.zip"
@@ -28,6 +32,16 @@ DERIVED_DATA_PATH="${DERIVED_DATA_PATH:-${BUILD_DIR}/DerivedData}"
 CURRENT_PROJECT_VERSION="${BUILD_NUMBER:-0}"
 EXPORT_OPTIONS_FILE="Support/ExportOptions.plist"
 
+# 🛡️ Ensure signing identity is available
+if ! security find-identity -v -p codesigning | grep -q "${IDENTITY}"; then
+  echo "🔑 Importing .p12 certificate..."
+  security import "${P12_PATH}" -k login.keychain -P "${P12_PASSWORD}" -T /usr/bin/codesign || {
+    echo "❌ Failed to import .p12"
+    exit 1
+  }
+  security set-key-partition-list -S apple-tool:,apple: -s -k "${P12_PASSWORD}" login.keychain
+fi
+
 # Clean and prepare the build
 flutter clean
 flutter pub get
@@ -43,7 +57,33 @@ rm -rf "${RESULT_BUNDLE_PATH}" "${DERIVED_DATA_PATH}"
 mkdir -p "${ARTIFACT_PATH}"
 
 function resign_frameworks() {
-  local identity="Apple Distribution: ITVIO, OOO (VL68C36HYS)"
+  # ⬇️ Раскодировать p12 из base64 и сохранить во временный файл
+  P12_TMP_PATH="certs/distribution.p12"
+  echo "$CERTIFICATES_FILE_BASE64" | base64 --decode -o "$P12_TMP_PATH"
+
+  # 🛡️ Импортировать сертификат
+  security import "$P12_TMP_PATH" -k login.keychain -P "$CERTIFICATES_PASSWORD" -T /usr/bin/codesign
+  security set-key-partition-list -S apple-tool:,apple: -s -k "$CERTIFICATES_PASSWORD" login.keychain
+
+
+  IDENTITY="Apple Distribution: ITVIO, OOO (VL68C36HYS)"
+  P12_TMP_PATH="certs/distribution.p12"
+
+  # 🛡️ Ensure signing identity is available
+  if ! security find-identity -v -p codesigning | grep -q "${IDENTITY}"; then
+    echo "📦 Extracting certificate from GitHub Secrets..."
+    mkdir -p certs
+    echo "$CERTIFICATES_FILE_BASE64" | base64 --decode -o "$P12_TMP_PATH"
+
+    echo "🔑 Importing .p12 certificate..."
+    security import "$P12_TMP_PATH" -k login.keychain -P "$CERTIFICATES_PASSWORD" -T /usr/bin/codesign || {
+      echo "❌ Failed to import .p12"
+      exit 1
+    }
+
+    security set-key-partition-list -S apple-tool:,apple: -s -k "$CERTIFICATES_PASSWORD" login.keychain
+  fi
+
   local app_path="${ARCHIVE_PATH}/Products/Applications/Runner.app"
   local frameworks_path="${app_path}/Frameworks"
 
@@ -52,17 +92,17 @@ function resign_frameworks() {
   codesign --remove-signature "${frameworks_path}/Flutter.framework/Flutter"
 
   echo "🔐 Resigning App.framework..."
-  codesign -f --deep --no-strict -s "${identity}" \
+  codesign -f --deep --no-strict -s "${IDENTITY}" \
     --preserve-metadata=entitlements,identifier,flags \
     "${frameworks_path}/App.framework/App"
 
   echo "🔐 Resigning Flutter.framework..."
-  codesign -f --deep --no-strict -s "${identity}" \
+  codesign -f --deep --no-strict -s "${IDENTITY}" \
     --preserve-metadata=entitlements,identifier,flags \
     "${frameworks_path}/Flutter.framework/Flutter"
 
   echo "🔐 Resigning Runner.app..."
-  codesign -f --deep --no-strict -s "${identity}" \
+  codesign -f --deep --no-strict -s "${IDENTITY}" \
     --preserve-metadata=entitlements,identifier,flags \
     "${app_path}"
 
@@ -71,29 +111,29 @@ function resign_frameworks() {
 
 # Archive the build
 xcrun xcodebuild \
-    -workspace "${WORKSPACE}" \
-    -scheme "${SCHEME}" \
-    -configuration "${CONFIGURATION}" \
-    -sdk "${SDK}" \
-    -parallelizeTargets \
-    -showBuildTimingSummary \
-    -derivedDataPath "${DERIVED_DATA_PATH}" \
-    -archivePath "${ARCHIVE_PATH}" \
-    -resultBundlePath "${RESULT_BUNDLE_PATH}" \
-    -allowProvisioningUpdates \
-    CURRENT_PROJECT_VERSION="${CURRENT_PROJECT_VERSION}" \
-    CODE_SIGNING_ALLOWED=NO \
-    DEVELOPMENT_TEAM=VL68C36HYS \
-    archive || { echo "Xcode archive failed"; exit 1; }
+  -workspace "${WORKSPACE}" \
+  -scheme "${SCHEME}" \
+  -configuration "${CONFIGURATION}" \
+  -sdk "${SDK}" \
+  -parallelizeTargets \
+  -showBuildTimingSummary \
+  -derivedDataPath "${DERIVED_DATA_PATH}" \
+  -archivePath "${ARCHIVE_PATH}" \
+  -resultBundlePath "${RESULT_BUNDLE_PATH}" \
+  -allowProvisioningUpdates \
+  CURRENT_PROJECT_VERSION="${CURRENT_PROJECT_VERSION}" \
+  CODE_SIGNING_ALLOWED=NO \
+  DEVELOPMENT_TEAM=VL68C36HYS \
+  archive || { echo "Xcode archive failed"; exit 1; }
 
 resign_frameworks
 
 # Export the build to .ipa
 xcrun xcodebuild \
-    -exportArchive \
-    -exportOptionsPlist "${EXPORT_OPTIONS_FILE}" \
-    -archivePath "${ARCHIVE_PATH}" \
-    -exportPath "${ARTIFACT_PATH}/${SCHEME}.ipa" || { echo "Export to IPA failed"; exit 1; }
+  -exportArchive \
+  -exportOptionsPlist "${EXPORT_OPTIONS_FILE}" \
+  -archivePath "${ARCHIVE_PATH}" \
+  -exportPath "${ARTIFACT_PATH}/${SCHEME}.ipa" || { echo "Export to IPA failed"; exit 1; }
 
 # Zip the archive
 if [[ -d "${ARCHIVE_PATH}" ]]; then