[GH-ISSUE #733] feat(signing): Phase 1 Git-backed encrypted readonly sync (match-style MVP) #201

New issue

Closed

opened 2026-02-26 21:33:59 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:33:59 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Feb 23, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/733

Problem

asc has strong API-level signing commands (certificates, profiles, devices, signing fetch), but it does not yet provide the core fastlane match value: team-wide, shared, encrypted signing state with one-command sync.

Without this, teams still do manual signing bootstrapping per machine/CI runner and risk configuration drift.

Phase 1 Goal

Ship a Git-backed, encrypted, readonly signing sync MVP that can bootstrap a machine/CI runner from an existing signing repository.

Proposed CLI (Phase 1)

asc signing sync \
  --bundle-id com.example.app \
  --profile-type IOS_APP_STORE \
  --git-url "git@github.com:org/signing.git" \
  --git-branch main \
  --readonly \
  --passphrase-env ASC_SIGNING_PASSPHRASE \
  --output ./signing

Optional flags for local profile installation:

--install-profiles (bool)
--install-dir (defaults to macOS provisioning profiles dir)

Scope

Add asc signing sync command (readonly path only).
Implement Git storage adapter for pull/checkout of signing repo.
Implement encrypted store read/decrypt layer for signing artifacts.
Resolve matching profile + certificates from decrypted store for requested bundle/profile type.
Materialize files to --output and optionally install provisioning profile locally.
Emit deterministic JSON/table/markdown summary output.

Implementation Notes

Keep CLI non-interactive.
Require passphrase via env variable/flag indirection (--passphrase-env) rather than prompt.
Use explicit long flags only.
Use shared.ContextWithTimeout for network operations.
Keep filesystem operations symlink-safe and non-overwriting by default.

Suggested package boundaries:

internal/cli/signing/sync.go (command + orchestration)
internal/signing/store/git (clone/pull/branch handling)
internal/signing/crypto (decrypt read path)
internal/signing/reconcile (artifact matching)

Test Plan (TDD)

Command validation tests:
- missing required flags -> exit code 2
- invalid profile type -> exit code 2
Git adapter tests:
- clone/read branch success path
- missing branch/auth failure errors are actionable
Crypto tests:
- decrypt success
- wrong passphrase error path
Sync tests:
- deterministic output ordering
- no file overwrite without explicit force mode
Local install tests:
- profile install path handling on macOS
- non-macOS requires explicit --install-dir

Always run:

make format
make lint
ASC_BYPASS_KEYCHAIN=1 make test

Acceptance Criteria

asc signing sync exists and is documented in --help.
Readonly sync works end-to-end from existing Git encrypted signing repo.
Outputs include profile/certificate IDs and local file paths.
No interactive prompts.
Validation errors return exit code 2.
Tests and lint/format pass.

Out of Scope (Phase 2+)

Creating missing profiles/certificates.
Pushing changes back to Git.
Non-Git backends (S3/GCS/GitLab).
Keychain certificate (.p12) installation.

Originally created by @rudrankriyam on GitHub (Feb 23, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/733 ## Problem `asc` has strong API-level signing commands (`certificates`, `profiles`, `devices`, `signing fetch`), but it does not yet provide the core `fastlane match` value: **team-wide, shared, encrypted signing state with one-command sync**. Without this, teams still do manual signing bootstrapping per machine/CI runner and risk configuration drift. ## Phase 1 Goal Ship a **Git-backed, encrypted, readonly signing sync** MVP that can bootstrap a machine/CI runner from an existing signing repository. ## Proposed CLI (Phase 1) ~~~bash asc signing sync \ --bundle-id com.example.app \ --profile-type IOS_APP_STORE \ --git-url "git@github.com:org/signing.git" \ --git-branch main \ --readonly \ --passphrase-env ASC_SIGNING_PASSPHRASE \ --output ./signing ~~~ Optional flags for local profile installation: - `--install-profiles` (bool) - `--install-dir` (defaults to macOS provisioning profiles dir) ## Scope 1. Add `asc signing sync` command (readonly path only). 2. Implement Git storage adapter for pull/checkout of signing repo. 3. Implement encrypted store read/decrypt layer for signing artifacts. 4. Resolve matching profile + certificates from decrypted store for requested bundle/profile type. 5. Materialize files to `--output` and optionally install provisioning profile locally. 6. Emit deterministic JSON/table/markdown summary output. ## Implementation Notes - Keep CLI non-interactive. - Require passphrase via env variable/flag indirection (`--passphrase-env`) rather than prompt. - Use explicit long flags only. - Use `shared.ContextWithTimeout` for network operations. - Keep filesystem operations symlink-safe and non-overwriting by default. Suggested package boundaries: - `internal/cli/signing/sync.go` (command + orchestration) - `internal/signing/store/git` (clone/pull/branch handling) - `internal/signing/crypto` (decrypt read path) - `internal/signing/reconcile` (artifact matching) ## Test Plan (TDD) - Command validation tests: - missing required flags -> exit code `2` - invalid profile type -> exit code `2` - Git adapter tests: - clone/read branch success path - missing branch/auth failure errors are actionable - Crypto tests: - decrypt success - wrong passphrase error path - Sync tests: - deterministic output ordering - no file overwrite without explicit force mode - Local install tests: - profile install path handling on macOS - non-macOS requires explicit `--install-dir` Always run: - `make format` - `make lint` - `ASC_BYPASS_KEYCHAIN=1 make test` ## Acceptance Criteria - [ ] `asc signing sync` exists and is documented in `--help`. - [ ] Readonly sync works end-to-end from existing Git encrypted signing repo. - [ ] Outputs include profile/certificate IDs and local file paths. - [ ] No interactive prompts. - [ ] Validation errors return exit code `2`. - [ ] Tests and lint/format pass. ## Out of Scope (Phase 2+) - Creating missing profiles/certificates. - Pushing changes back to Git. - Non-Git backends (S3/GCS/GitLab). - Keychain certificate (`.p12`) installation.

kerem

2026-02-26 21:33:59 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-26 21:33:59 +03:00

Author

Owner

@rudrankriyam commented on GitHub (Feb 26, 2026):

Closing for now due scope/priority. We can reopen when this work is prioritized again.

@rudrankriyam commented on GitHub (Feb 26, 2026): Closing for now due scope/priority. We can reopen when this work is prioritized again.

kerem referenced this issue

2026-02-26 21:34:47 +03:00

[PR #216] [MERGED] Add app tags CLI support #360