[kabiroberai]

What does this PR do?

How was it tested?

AI tool usage

How much of this PR was AI-assisted? (check one)

• 0 - No AI was used to write code
• 1 - I was assisted by AI. I reviewed the finished result.
• 2 - I set the AI going and left it to it; nobody has read the result - no review, or AI review only

Summary by CodeRabbit

• Updated Signing
  • App signing now uses a new signing engine and supports both certificate-based and ad hoc signing.
  • Entitlement data is passed through during signing, including data supplied from entitlement files.
• Validation
  • Signing rejects invalid app or entitlement file paths and duplicate entitlement paths.
• Compatibility
  • Signing setup no longer requires selecting a signer when creating a signing context.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f06d9603-49e7-4625-8d55-beced0b8c664

📥 Commits

Reviewing files that changed from the base of the PR and between 6083ec1 and 63db7fd.

⛔ Files ignored due to path filters: 1

• Package.resolved is excluded by !**/Package.resolved

📒 Files selected for processing: 9

• Package.swift
• Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift
• Sources/XKit/Integration/IntegratedInstaller.swift
• Sources/XKit/Signer/AutoSigner.swift
• Sources/XKit/Signer/RCodesignSigner.swift
• Sources/XKit/Signer/Signer.swift
• Sources/XKit/Signer/SignerImpl.swift
• Sources/XKit/Signer/SigningContext.swift
• Sources/XToolSupport/DevCommand.swift

💤 Files with no reviewable changes: 1

• Sources/XKit/Signer/SignerImpl.swift

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

Walkthrough

The change replaces the zsign integration with RCodesign, adds a dependency-injected signer interface, and updates signing and executable-analysis call sites to use it.

Changes: Signer backend migration

Layer / File(s)	Summary
Signer interface and context Sources/XKit/Signer/Signer.swift, Sources/XKit/Signer/SignerImpl.swift, Sources/XKit/Signer/SigningContext.swift	A signer protocol, identity type, and dependency value replace signer discovery through SigningContext. The previous Signer implementation is removed.
RCodesign implementation Package.swift, Sources/XKit/Signer/RCodesignSigner.swift	The package replaces zsign with swift-rcodesign. RCodesignSigner validates signing paths, maps identities and entitlements, and delegates signing and executable analysis to RCodesign.
Signing and analysis call sites Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift, Sources/XKit/Signer/AutoSigner.swift, Sources/XToolSupport/DevCommand.swift, Sources/XKit/Integration/IntegratedInstaller.swift	Call sites use the injected signer. AutoSigner encodes entitlement data as XML property-list data and passes shallow: false. SigningContext initialization no longer throws.

Priority: Pending latest changes

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Refactor

Sequence Diagram(s)

sequenceDiagram
  participant AutoSigner
  participant RCodesignSigner
  participant RCodesign
  AutoSigner->>RCodesignSigner: sign with encoded entitlements and real identity
  RCodesignSigner->>RCodesign: sign app with entitlement map and shallow option
  RCodesign-->>RCodesignSigner: return signing result or error
  RCodesignSigner-->>AutoSigner: return signing result or error

Loading

Possibly related issues

• xtool-org/xtool#379 — This change replaces zsign in the signing path, which is the component named in the issue’s reported signing failure.

Possibly related PRs

• xtool-org/xtool#375 — This PR changes DevCommand.swift to use the d.signer accessor introduced by that PR.

Merge Risk: Minimal · previous review 63db7

No specific signing regression has been established. Complete normal build and signing checks before merging.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: replacing zsign with RCodesign.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kabiroberai]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• signer: replace zsign with RCodesign #389 👈 (View in Graphite)
• xcode: track paths on XcodeProject #388
• utils: better XToolCache location #409
• utils: tweaks #387
• cli: IO dependencies #375
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.