苹果签名全流程指南：从开发者账号到应用签名实战

# 检查 Apple ID 是否已开启双重认证
curl -X POST "https://appleid.apple.com/account/manage/section/security/"

{
  "team": {
    "name": "Your Company Name",
    "type": "Company/Organization",
    "DUNS": "123456789",
    "members": [
      {
        "role": "Admin",
        "permissions": ["certificate", "profile", "app"]
      }
    ]
  }
}

# 使用 OpenSSL 生成私钥
openssl genrsa -out ios_development.key 2048
 
# 生成 CSR 文件
openssl req -new -key ios_development.key -out ios_development.csr \
  -subj "/emailAddress=dev@example.com, CN=Your Name, C=CN"
 
# 验证 CSR 文件内容
openssl req -text -in ios_development.csr -noout

// 在 Xcode 项目中启用自动签名
// Target -> Signing & Capabilities
// 勾选 "Automatically manage signing"
 
// Xcode 会自动处理以下任务：
// 1. 证书申请和更新
// 2. Provisioning Profile 生成
// 3. 设备注册管理

# 安装证书到钥匙串
security add-certificates -k ~/Library/Keychains/login.keychain ios_development.cer
 
# 验证证书有效性
security find-certificate -c "iPhone Developer" -a
 
# 导出 p12 文件（用于共享或备份）
openssl pkcs12 -export -in ios_development.cer -inkey ios_development.key \
  -out ios_development.p12 -name "iOS Development Certificate"

# App ID 配置示例
{
  "identifier": "com.yourcompany.awesomeapp",
  "description": "Awesome iOS Application",
  "capabilities": [
    "Push Notifications",
    "In-App Purchase",
    "Keychain Sharing",
    "App Groups"
  ],
  "appServices": {
    "gameCenter": true,
    "icloud": "CloudKit",
    "wallet": false
  }
}

// 推荐的 Bundle ID 命名规范
com.company.product.platform
 
// 示例：
com.tencent.wechat.ios      // 微信 iOS 版
com.alibaba.taobao.iphone   // 淘宝 iPhone 版
com.baidu.map.ipad          // 百度地图 iPad 版

# 连接设备后使用 Xcode 获取
xcrun xctrace list devices

# 使用 system_profiler 命令
system_profiler SPUSBDataType | grep "Serial Number"

<!-- 开发配置文件示例 -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>AppIDName</key>
    <string>Awesome App Development</string>
    <key>ApplicationIdentifierPrefix</key>
    <array>
        <string>ABCD123456</string>
    </array>
    <key>CreationDate</key>
    <date>2024-01-01T00:00:00Z</date>
    <key>Platform</key>
    <array>
        <string>iOS</string>
    </array>
</dict>
</plist>

# 使用 fastlane 自动化管理
# Fastfile 配置示例
lane :sync_profiles do
  match(
    type: "development",
    app_identifier: "com.company.app",
    git_url: "git@github.com:company/certificates.git",
    username: "dev@company.com"
  )
end
 
# 执行同步
fastlane sync_profiles

// 在 Xcode 中配置签名
// Target -> Signing & Capabilities
 
// 团队选择
Signing Team: "Your Company Name (ABCD123456)"
 
// Bundle Identifier
Bundle Identifier: "com.company.awesomeapp"
 
// 签名证书
Signing Certificate: "Apple Development: Your Name (ABCD123456)"
 
// Provisioning Profile
Provisioning Profile: "iOS Team Provisioning Profile: com.company.awesomeapp"

// 使用 Xcode Configuration 管理多环境
#if DEBUG
    let apiEndpoint = "https://api-dev.example.com"
    let logLevel = .verbose
#elseif RELEASE
    let apiEndpoint = "https://api.example.com"
    let logLevel = .error
#endif
 
// 在 Build Settings 中配置：
// SWIFT_ACTIVE_COMPILATION_CONDITIONS
// Debug: DEBUG
// Release: RELEASE

<!-- 为不同 Target 设置不同签名 -->
<!-- 主应用 Target -->
<key>CFBundleIdentifier</key>
<string>com.company.mainapp</string>
 
<!-- 扩展 Target -->
<key>CFBundleIdentifier</key>
<string>com.company.mainapp.extension</string>
 
<!-- Watch App Target -->
<key>CFBundleIdentifier</key>
<string>com.company.mainapp.watch</string>

# 使用 xcodebuild 命令行构建
xcodebuild -workspace AwesomeApp.xcworkspace \
  -scheme AwesomeApp \
  -configuration Release \
  -destination 'generic/platform=iOS' \
  -archivePath build/AwesomeApp.xcarchive \
  archive
 
# 导出 IPA 文件
xcodebuild -exportArchive \
  -archivePath build/AwesomeApp.xcarchive \
  -exportPath build/ipa \
  -exportOptionsPlist exportOptions.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>app-store</string>
    <key>teamID</key>
    <string>ABCD123456</string>
    <key>uploadBitcode</key>
    <false/>
    <key>uploadSymbols</key>
    <true/>
</dict>
</plist>

# 验证应用签名
codesign -dv --verbose=4 AwesomeApp.app
 
# 检查签名信息
codesign -vv AwesomeApp.app
 
# 验证 Provisioning Profile
security cms -D -i AwesomeApp.app/embedded.mobileprovision

# 企业账号申请要求：
# 1. 合法注册的企业实体
# 2. DUNS 编号
# 3. 企业网站和邮箱
# 4. 年费：299 美元

# 创建企业发布证书
openssl req -new -key enterprise.key -out enterprise.csr \
  -subj "/emailAddress=enterprise@company.com, CN=Enterprise Distribution, O=Company Name, C=CN"

<!-- 企业配置文件特殊要求 -->
<key>ProvisionsAllDevices</key>
<true/>
<key>TeamIdentifier</key>
<array>
    <string>ENTERPRISE_TEAM_ID</string>
</array>

# 企业签名打包
xcodebuild -workspace EnterpriseApp.xcworkspace \
  -scheme EnterpriseApp \
  -configuration Enterprise \
  -archivePath build/EnterpriseApp.xcarchive \
  archive DEVELOPMENT_TEAM=ENTERPRISE_TEAM_ID

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>items</key>
    <array>
        <dict>
            <key>assets</key>
            <array>
                <dict>
                    <key>kind</key>
                    <string>software-package</string>
                    <key>url</key>
                    <string>https://enterprise.company.com/apps/EnterpriseApp.ipa</string>
                </dict>
            </array>
            <key>metadata</key>
            <dict>
                <key>bundle-identifier</key>
                <string>com.company.enterpriseapp</string>
                <key>bundle-version</key>
                <string>1.0.0</string>
                <key>kind</key>
                <string>software</string>
                <key>title</key>
                <string>Enterprise Application</string>
            </dict>
        </dict>
    </array>
</dict>
</plist>

<!DOCTYPE html>
<html>
<head>
    <title>企业应用分发</title>
</head>
<body>
    <h1>企业应用下载</h1>
    <a href="itms-services://?action=download-manifest&url=https://enterprise.company.com/manifest.plist">
        点击安装应用
    </a>
</body>
</html>

# 企业证书权限控制
chmod 600 enterprise_distribution.p12
chown root:admin enterprise_distribution.p12
 
# 证书使用审计
security find-certificate -a -c "iPhone Distribution: Enterprise" -p

// 在应用启动时验证签名
func validateEnterpriseSignature() -> Bool {
    guard let bundle = Bundle.main.bundleIdentifier,
          bundle.hasPrefix("com.company.") else {
        return false
    }
    
    // 验证企业证书有效性
    return SecurityWrapper.verifyEnterpriseCertificate()
}

# Nginx 配置访问控制
location /apps/ {
    auth_basic "Enterprise Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    # IP 白名单
    allow 192.168.1.0/24;
    deny all;
}

// TRAE IDE 自动检测代码示例
class SigningEnvironmentChecker {
    func performCompleteCheck() -> SigningReport {
        let report = SigningReport()
        
        // 检测证书状态
        report.certificateStatus = checkCertificateValidity()
        
        // 验证 Provisioning Profile
        report.profileStatus = validateProvisioningProfile()
        
        // 检查 Bundle ID 一致性
        report.bundleIdConsistency = verifyBundleIdentifier()
        
        // 设备注册状态
        report.deviceRegistration = checkDeviceStatus()
        
        return report
    }
}

# TRAE IDE 智能修复命令
trae ios signing --auto-fix
 
# 输出示例：
# 🔍 检测到证书过期
# 🔄 正在自动申请新证书...
# ✅ 证书更新成功
# 🔍 发现 Profile 不匹配
# 🔄 正在重新生成 Profile...
# ✅ Profile 更新完成
# 🎉 签名环境已修复

# TRAE IDE 团队配置共享
team_signing:
  shared_certificates:
    - name: "iOS Development"
      type: "development"
      auto_update: true
  
  shared_profiles:
    - bundle_id: "com.company.*"
      type: "wildcard"
      devices: "auto_sync"
  
  access_control:
    admin:
      - "team_lead@company.com"
    developer:
      - "dev1@company.com"
      - "dev2@company.com"

// TRAE IDE 实时同步代码
class TeamSigningSync {
    func syncSigningAssets() {
        // 监听证书变化
        CertificateWatcher.shared.onChange = { certificate in
            self.notifyTeamMembers(certificate)
        }
        
        // 自动同步新设备
        DeviceManager.shared.onDeviceAdded = { device in
            self.updateTeamProvisioningProfiles(device)
        }
    }
}

// TRAE IDE AI 优化器
class SigningOptimizer {
    func optimizeSigningProcess() {
        let aiAnalysis = AIEngine.analyze(project: currentProject)
        
        // 推荐最优签名策略
        if aiAnalysis.shouldUseAutomaticSigning {
            enableAutomaticSigning()
        } else {
            configureManualSigning(bestPractice: aiAnalysis.recommendation)
        }
        
        // 预测潜在问题
        let potentialIssues = aiAnalysis.predictIssues()
        showPreventionSuggestions(issues: potentialIssues)
    }
}

# TRAE IDE 智能构建
trae build ios --smart-cache
 
# 功能特性：
# - 智能缓存签名结果
# - 并行处理多架构编译
# - 增量更新机制
# - 构建时间减少 60%

// TRAE IDE 可视化界面
struct SigningDashboard: View {
    var body: some View {
        VStack {
            // 证书状态仪表盘
            CertificateStatusView()
            
            // Profile 管理界面
            ProfileManagerView()
            
            // 设备注册面板
            DeviceRegistrationPanel()
            
            // 一键修复按钮
            AutoFixButton()
        }
    }
}

// TRAE IDE 调试集成
class SigningDebugger {
    func debugSigningIssue() {
        // 实时签名日志
        let logs = getRealtimeSigningLogs()
        
        // 智能错误定位
        let errorLocation = AIEngine.locateError(logs: logs)
        
        // 提供修复建议
        let suggestions = AIEngine.generateFixSuggestions(error: errorLocation)
        
        // 一键应用修复
        applyFixes(suggestions: suggestions)
    }
}

# 诊断步骤
security find-certificate -a -c "iPhone Developer" -p | openssl x509 -text | grep "Not After"
 
# 解决方案
# 1. 登录 Apple Developer Portal
# 2. 撤销过期证书
# 3. 生成新证书
# 4. 更新所有相关 Profile

# 检查证书链
security verify-cert -c certificate.cer
 
# 修复证书链
security add-certificates -k ~/Library/Keychains/login.keychain-chain certificate.cer

# 详细诊断
security cms -D -i profile.mobileprovision | grep -A 5 -B 5 "Entitlements"
 
# 常见原因及解决
# 1. Bundle ID 不匹配 -> 检查并统一 Bundle ID
# 2. 设备未注册 -> 添加设备 UDID
# 3. 证书不匹配 -> 重新生成 Profile

# 获取设备 UDID
instruments -s devices
 
# 检查 Profile 包含的设备
security cms -D -i profile.mobileprovision | grep -A 10 "ProvisionedDevices"

# 详细日志分析
tail -f ~/Library/Logs/DiagnosticReports/
 
# 清理构建缓存
rm -rf ~/Library/Developer/Xcode/DerivedData
rm -rf ~/Library/MobileDevice/Provisioning Profiles

# 环境变量检查
printenv | grep -i "DEVELOPER_DIR"
 
# 手动指定签名文件
xcodebuild -project App.xcodeproj \
  -scheme App \
  -configuration Release \
  CODE_SIGN_IDENTITY="iPhone Distribution: Company Name" \
  PROVISIONING_PROFILE_SPECIFIER="App Store Distribution"

# 查看系统签名日志
log stream --predicate 'subsystem == "com.apple.security"' --level debug
 
# 查看 MobileDevice 日志
log stream --predicate 'subsystem == "com.apple.mobile"' --level debug

# 检查 Apple 服务器连接
nc -z developer.apple.com 443
 
# 检查证书吊销列表
openssl ocsp -issuer AppleWWDRCAG3.cer -cert developer.cer -url http://ocsp.apple.com

#!/bin/bash
# iOS 签名环境健康检查脚本
 
echo "🔍 开始签名环境健康检查..."
 
# 检查证书有效期
echo "📋 检查证书有效期..."
security find-certificate -a -c "iPhone" -p | while read cert; do
    echo "$cert" | openssl x509 -noout -dates
done
 
# 检查 Profile 状态
echo "📋 检查 Provisioning Profile..."
ls ~/Library/MobileDevice/Provisioning\\ Profiles/ | while read profile; do
    echo "Profile: $profile"
    security cms -D -i "$profile" 2>/dev/null | grep -E "(Name|UUID|CreationDate|ExpirationDate)" || echo "无法读取 Profile"
done
 
# 检查设备注册
echo "📱 检查设备注册状态..."
system_profiler SPUSBDataType | grep "iPhone" -A 5 -B 5
 
echo "✅ 健康检查完成"

// 签名状态监控器
class SigningHealthMonitor {
    func startMonitoring() {
        // 证书过期监控
        Timer.scheduledTimer(withTimeInterval: 86400, repeats: true) { _ in
            self.checkCertificateExpiration()
        }
        
        // Profile 更新监控
        NotificationCenter.default.addObserver(
            self,
            selector: #selector(profileUpdated),
            name: .provisioningProfileUpdated,
            object: nil
        )
    }
    
    func checkCertificateExpiration() {
        let certificates = getAllCertificates()
        for certificate in certificates {
            if certificate.daysUntilExpiration < 30 {
                sendWarningAlert(certificate: certificate)
            }
        }
    }
}

// 使用 Configuration 管理多环境
struct AppConfig {
    static var baseURL: String {
        #if DEBUG
        return "https://api-dev.example.com"
        #elseif STAGING
        return "https://api-staging.example.com"
        #else
        return "https://api.example.com"
        #endif
    }
}

#!/bin/bash
# 标准化发布脚本
 
echo "🚀 开始 iOS 应用发布流程..."
 
# 1. 环境检查
echo "1️⃣ 检查签名环境..."
./scripts/check_signing_environment.sh
 
# 2. 版本验证
echo "2️⃣ 验证版本信息..."
./scripts/validate_version.sh
 
# 3. 构建应用
echo "3️⃣ 构建应用..."
fastlane build_release
 
# 4. 签名验证
echo "4️⃣ 验证签名..."
./scripts/validate_signature.sh
 
# 5. 上传 App Store
echo "5️⃣ 上传 App Store..."
fastlane upload_to_app_store
 
echo "✅ 发布流程完成"

# 使用 Git 管理证书（加密存储）
git-crypt init
echo "*.p12 filter=git-crypt diff=git-crypt" > .gitattributes
git add certificates/
git commit -m "Add encrypted certificates"

# GitHub Actions 配置示例
name: iOS Build and Deploy
on:
  push:
    branches: [ main ]
 
jobs:
  build:
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Setup signing
      run: |
        echo "${{ secrets.CERTIFICATES_P12 }}" | base64 --decode > certificates.p12
        echo "${{ secrets.PROVISIONING_PROFILE }}" | base64 --decode > profile.mobileprovision
    
    - name: Build and sign
      run: |
        xcodebuild -project App.xcodeproj -scheme App -configuration Release archive

// 使用 TODO 标记跟踪签名相关问题
// TODO: [Signing] 迁移到自动签名
// FIXME: [Signing] 更新过期证书
// NOTE: [Signing] 企业签名需要合规审查