From 070c15b681db2d501661357360cf8cb4df55f7e4 Mon Sep 17 00:00:00 2001 From: Jacob Fu <141651335+FuJacob@users.noreply.github.com> Date: Fri, 10 Jul 2026 17:20:45 -0700 Subject: [PATCH] Fix default local development signing --- CONTRIBUTING.md | 21 ++++++++++++--------- Config/Signing.xcconfig | 15 +++++++-------- Cotabby.xcodeproj/project.pbxproj | 6 +++--- project.yml | 14 +++++++------- scripts/dev-setup.sh | 8 ++++---- 5 files changed, 33 insertions(+), 31 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 89985644..57b79b21 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -31,7 +31,8 @@ You need: - Xcode with Command Line Tools installed. - An Apple ID added to Xcode (Settings > Accounts) if you want to launch the app from the IDE. A free account is enough; the paid Apple Developer Program is not required for local development. - Run `scripts/dev-setup.sh` once to configure signing (see Local Setup). + Contributors outside Cotabby's default development team run `scripts/dev-setup.sh` once to + configure a local override (see Local Setup). - SwiftLint for local lint checks. CI installs it with Homebrew when needed. - XcodeGen if you need to change the project structure (targets, build settings, dependencies, or scheme). Install it with `brew install xcodegen`. CI installs it the same way. @@ -40,7 +41,8 @@ Apple Silicon is strongly recommended for local model-runtime work. ## Local Setup -Clone the repo, configure local signing, and open the project: +Clone the repo and open the project. If your Apple ID is not on Cotabby's development team, run the +one-time signing setup first: ```sh git clone https://github.com/FuJacob/Cotabby.git @@ -49,11 +51,12 @@ scripts/dev-setup.sh open Cotabby.xcodeproj ``` -`scripts/dev-setup.sh` writes a gitignored `Config/Signing.local.xcconfig` with your Apple -Development team id, so local builds sign as you. The team is deliberately not hardcoded in -`project.yml`, so the repo builds for any contributor without being on the maintainer's team. If -you have not added an Apple ID to Xcode yet, do that first under Settings > Accounts (a free -account is enough), then re-run the script. To set the team by hand instead, copy +The committed `Config/Signing.xcconfig` defaults to Cotabby's development team, which lets team +members build immediately without Xcode modifying the generated project. `scripts/dev-setup.sh` +writes a gitignored `Config/Signing.local.xcconfig` with a contributor's own Apple Development team +id; that local value overrides the shared default and persists across pulls and project +regeneration. If you have not added an Apple ID to Xcode yet, do that first under Settings > +Accounts (a free account is enough), then re-run the script. To set the team by hand instead, copy `Config/Signing.local.xcconfig.example` to `Config/Signing.local.xcconfig`, or pass it explicitly: `DEVELOPMENT_TEAM=XXXXXXXXXX scripts/dev-setup.sh`. @@ -119,8 +122,8 @@ xcodebuild \ ``` `CODE_SIGNING_ALLOWED=NO` keeps the build command usable on machines that do not have the project -owner's signing certificate. Use Xcode with your own team selected when you need to launch the app -locally. +owner's signing certificate. Use the shared team or your gitignored local override when you need to +launch the app locally. ## Run diff --git a/Config/Signing.xcconfig b/Config/Signing.xcconfig index 57d5e5eb..79f14c5b 100644 --- a/Config/Signing.xcconfig +++ b/Config/Signing.xcconfig @@ -1,17 +1,16 @@ // Code signing for local development. // -// DEVELOPMENT_TEAM is deliberately empty here, and absent from project.yml, so the repo can be -// cloned and built by any contributor rather than only members of the maintainer's Apple team. -// Each developer supplies their own team in Config/Signing.local.xcconfig (gitignored). Generate -// it with +// The shared default is Cotabby's development team so maintainers can pull main and immediately +// run the app without Xcode writing a personal choice into the generated project.pbxproj. A +// contributor who is not on that team overrides it once in Config/Signing.local.xcconfig +// (gitignored). Generate that override with // // scripts/dev-setup.sh // // or copy Config/Signing.local.xcconfig.example and fill it in by hand. // -// The trailing `?` makes the include optional: a fresh clone with no local file still resolves -// (empty team), which is fine for `xcodebuild ... CODE_SIGNING_ALLOWED=NO` compile checks and for -// CI. A real team is only needed to launch the signed app from Xcode. +// The trailing `?` makes the include optional. Unsigned compile checks and CI still pass +// CODE_SIGNING_ALLOWED=NO, so they do not need access to the shared team or a local override. // // This file lives in a subdirectory on purpose. XcodeGen names the group for a root-level file // reference after the checkout directory, which differs between clones and CI and would break the @@ -21,6 +20,6 @@ // DEVELOPMENT_TEAM must not be set in project.yml's build settings either: project-level build // settings outrank an xcconfig, so a value there would silently override this file. -DEVELOPMENT_TEAM = +DEVELOPMENT_TEAM = G946M8K23B #include? "Signing.local.xcconfig" diff --git a/Cotabby.xcodeproj/project.pbxproj b/Cotabby.xcodeproj/project.pbxproj index d2248b8d..c053d0a3 100644 --- a/Cotabby.xcodeproj/project.pbxproj +++ b/Cotabby.xcodeproj/project.pbxproj @@ -1943,15 +1943,15 @@ LastUpgradeCheck = 2600; TargetAttributes = { 59F15B162977174E700D0CAA = { - DevelopmentTeam = ""; + DevelopmentTeam = G946M8K23B; ProvisioningStyle = Automatic; }; 622CFE93F0FE48C8243E060C = { - DevelopmentTeam = ""; + DevelopmentTeam = G946M8K23B; ProvisioningStyle = Automatic; }; AB3DFA4CFA5EBC6161F02A30 = { - DevelopmentTeam = ""; + DevelopmentTeam = G946M8K23B; ProvisioningStyle = Automatic; }; }; diff --git a/project.yml b/project.yml index 8c6fcee2..c933dfbc 100644 --- a/project.yml +++ b/project.yml @@ -84,13 +84,13 @@ settings: ENABLE_NS_ASSERTIONS: NO MTL_ENABLE_DEBUG_INFO: NO SWIFT_COMPILATION_MODE: wholemodule -# Per-developer signing lives in an xcconfig, not here, so any contributor can build the repo -# without being on the maintainer's Apple team. `Config/Signing.xcconfig` (committed) leaves -# DEVELOPMENT_TEAM empty and optionally includes the gitignored `Config/Signing.local.xcconfig` -# that `scripts/dev-setup.sh` writes. It sits in a subdirectory on purpose: a root-level config -# file makes XcodeGen name a group after the checkout directory, which drifts between clones and -# CI. DEVELOPMENT_TEAM must also stay out of the build settings above: project-level settings -# outrank an xcconfig, so a value there would override the local file. +# Signing lives in xcconfig files, not the generated project. `Config/Signing.xcconfig` (committed) +# supplies Cotabby's team as the maintainer-friendly default and optionally includes the gitignored +# `Config/Signing.local.xcconfig` that `scripts/dev-setup.sh` writes for contributors on another +# team. It sits in a subdirectory on purpose: a root-level config file makes XcodeGen name a group +# after the checkout directory, which drifts between clones and CI. DEVELOPMENT_TEAM must also stay +# out of the build settings above: project/target settings outrank an xcconfig and would prevent the +# local override from winning. configFiles: Debug: Config/Signing.xcconfig Release: Config/Signing.xcconfig diff --git a/scripts/dev-setup.sh b/scripts/dev-setup.sh index e9ef8796..8f51a476 100755 --- a/scripts/dev-setup.sh +++ b/scripts/dev-setup.sh @@ -2,10 +2,10 @@ # # dev-setup.sh - generate Config/Signing.local.xcconfig so you can build and run Cotabby locally. # -# Cotabby's project.yml does not hardcode an Apple team, so any contributor can build the repo. -# To launch the signed app from Xcode you supply your own team id once. This script detects it -# from your Apple Development signing certificate and writes the gitignored -# Config/Signing.local.xcconfig. +# Cotabby's shared xcconfig defaults to the maintainer team so its members can build immediately. +# Contributors on another team supply their own team id once. This script detects it from an Apple +# Development signing certificate and writes the gitignored Config/Signing.local.xcconfig, whose +# value overrides the shared default without dirtying the generated Xcode project. # # Usage: # scripts/dev-setup.sh # auto-detect your team id