AltSign

A Swift library for resigning iOS apps, provisioning developer certificates, and communicating with Apple Developer APIs.

---

Features

• Cryptography & Code Signing: Powered by CodeSignKit for CMS/PKCS#7 signature generation, PKCS#12 archive parsing/export, and Mach-O binary signing.
• Apple SRP & GrandSlam Protocol: uses GSACryptoKit for secure SRP-6a cryptographic handshakes and performs Authentication using GrandSlam Authentication(GSA) flow.
• Streaming Zip Support: High-Speed IPA unpacking and repacking backed by minizip-ng with exact POSIX permission preservation.
• Full Bundle & Extension Resigning: In-Depth resigning support for main executables, app extensions, plugins, and embedded frameworks.

---

Architecture Overview

                                ┌───────────────────┐
                                │      AltSign      │                       ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐
                                │ GSA, portal apis  │ ◀ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ ╌ │    AnisetteKit    |
                                └─────────┬─────────┘                       │  (Local Anisette) │
                                          │                                 └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘
             ┌────────────────────────────┼────────────────────────────┐
             │                            │                            │
             ▼                            ▼                            ▼
     ┌───────────────┐            ┌───────────────┐            ┌───────────────┐
     │  CodeSignKit  │            │ GSACryptoKit  │            │  minizip-ng   │
     │ (CMS, PKCS#12,│            │(SRP-6a Client │            │  (Streaming   │
     │  Mach-O, CD)  │            │  Crypto utils)│            │   Zip Engine) │
     └───────────────┘            └───────────────┘            └───────────────┘

---

Core Capabilities

1. IPA Resigning (ALTSigner)

• Extracts and parses application bundles (.app).
• Resigns Mach-O binaries (thin and FAT architectures) using cryptographic signatures generated by CodeSignKit.
• Injects and embeds active embedded.mobileprovision profiles.
• Dynamically validates and rewrites entitlements (application-identifier, team-identifier, keychain-access-groups).
• Recursively signs nested app extensions, frameworks, and helper tools with correct designated requirements.
• Repackages resigned bundles into release-ready .ipa archives.

2. Certificate Management (CertificatesManager)

• CSR Generation: Generates 2048-bit RSA keys and PKCS#10 Certificate Signing Requests without external CLI or OpenSSL binaries.
• PKCS#12 Handling: Imports, exports, and parses .p12 archives with full support for unencrypted, 3DES, PBES2, and AES cipher suites.
• X.509 Parsing: Extracts certificate serial numbers, common names, validity ranges, and issuer details.

3. Apple Developer API Client (ALTAppleAPI)

• Fetches active developer accounts, teams, and entitlements.
• Registers new bundle IDs (AppIDs) and app groups.
• Registers device UDIDs.
• Submits CSRs to request and download iOS Development certificates.
• Generates and downloads development provisioning profiles.

4. High-Performance Archive Streaming (Archive)

• Reads and writes ZIP/IPA archives via direct Swift wrappers over minizip-ng.
• Preserves executable bits, symbolic links, and POSIX file modes.

---

Swift Package Integration

Add AltSign to your Package.swift:

dependencies: [
    .package(url: "https://github.com/SideStore/AltSign.git", branch: "develop"),
]

Target configuration:

.target(
    name: "YourTarget",
    dependencies: [
        .product(name: "AltSign-Static", package: "AltSign"),
// or   .product(name: "AltSign-Dynamic", package: "AltSign"),
    ]
)

---

Usage Examples

Signing an Application Bundle

import AltSign
import CodeSignKit

let signer = ALTSigner()

let appURL = URL(fileURLWithPath: "/path/to/Payload/MyApp.app")
let certificate = try ALTCertificate(p12Data: p12Data, password: "password")
let profile = try ALTProvisioning个人资料(data: profileData)

let resignSuccess = signer.signApp(
    at: appURL,
    provisioning个人资料s: [profile],
    certificates: [certificate]
)

Generating a Certificate Signing Request (CSR)

import AltSign

let subject = CertificatesManager.CSRSubject(
    country: "US",
    state: "CA",
    locality: "Los Angeles",
    organization: "SideStore",
    commonName: "SideStore Developer"
)

let (csrData, privateKeyData) = try CertificatesManager.generateCSR(subject: subject)

Exporting and Parsing .p12 Files

import AltSign

// Parse X.509 certificate and private key from PKCS#12
let (certPEM, keyPEM) = try CertificatesManager.extractPKCS12(p12Data, password: "password")

// Parse certificate metadata
if let info = CertificatesManager.parseCertificate(certPEM) {
    print("Name: \(info.name), Serial: \(info.serial)")
    print("Expires: \(info.expiryDate ?? Date.distantPast)")
}

---

License

This project is licensed under the terms of the GNU General Public License v3.0 (GPL-3.0).