Add verification of Xcode.app

[kenchan0130]

• Verify authority of first signing chain
• Verify team identifier

related #298

[KrauseFx]

This looks good, great idea to add this to xcode-install directly. Few questions before we can merge

1. Have you tested this locally end to end to install a new version of Xcode?
2. We will need a flag to skip the verification, as maybe it will cause issues with some setups. I'm ok with having it be an environment variable
3. The dependency to fastlane felt off at first, but I guess since we're using spaceship already to communicate with , we should be good. No action needed

Thanks for working on this 👍

[kenchan0130]

I was not running the test locally.
Therefore, I pushed again with appropriate modification.

[kenchan0130]

I removed this because this require is duplicated.

[kenchan0130]

Team identifier and authority are constants.

I am concerned whether they can be hard-coded into these line.

[kenchan0130]

I reread the existing code again.

class InstalledXcode
  TEAM_IDENTIFIER = '59GAB85EFG'
  AUTHORITY = 'Apple Mac OS Application Signing'

  def verify_integrity
    verify_app_security_assessment && verify_app_cert
  end

  private

  def verify_app_security_assessment
    puts `/usr/sbin/spctl --assess --verbose=4 --type execute #{@path}`
    $?.exitstatus.zero?
  end

  def verify_app_cert
      cert_info = Fastlane::Actions::VerifyBuildAction.gather_cert_info(@path)
      apple_team_identifier_result = cert_info['team_identifier'] == TEAM_IDENTIFIER
      apple_authority_result = cert_info['authority'].include?(AUTHORITY)
      apple_team_identifier_result && apple_authority_result
  end
end

How about aggregating verification methods into InstalledXcode class like this?

In another PR, I am assuming to be able to add a validation method on components (pkg) in this class.

[kenchan0130]

I tried to fix (ead4020).

[kenchan0130]

@KrauseFx ping. How is this going?

[KrauseFx]

Hey @kenchan0130, what do you need from my side?

[kenchan0130]

@KrauseFx Hi,
I expect you to review my patches which are fab68c5 and fab68c5.
Please check them.

[kenchan0130]

@KrauseFx Thank you for your review!
I'll merge this PR.