search

XcodesOrg / xcodes

The best command-line tool to install and switch between multiple versions of Xcode.
MIT License
3.68k stars 126 forks source link

Allow for automated use in CI for 2FA accounts #141

Closed tahirmt closed 1 year ago

tahirmt commented 3 years ago

We can use other things using fastlane and FASTLANE_SESSION to authenticate for CI. Is there a way to do that through environment variables?

senmu commented 3 years ago

Thanks for opening this issue, @tahirmt! There are likely things from Fastlane we can leverage to automate this, but to fully understand the motivation behind this, can you describe how xcodes plays in your CI environment? Is this lack of support for 2FA currently blocking you right now?

tahirmt commented 3 years ago

@senmu I'm using fastlane's xcode_install lane currently but xcodes is faster in terms of setting up an Xcode. We are managing our CI ourselves and I want to use xcodes in place of fastlane for the Xcode setup on the machine. No it is not a current blocker since there is an alternative we can use.

senmu commented 3 years ago

Thanks for the insight, @tahirmt. At the moment our focus at Robots & Pencils is to ensure that the experience around manual use is taken care of first, so we won't have time to look into this in the near future. However if someone were to issue a PR for this, it would be welcomed.

In the meantime, we'll keep it in the back of our minds and continue to think about how it can be integrated in such a way that it's done in a secure manner for when that time comes.

fkorotkov commented 3 years ago

I think a viable workaround for the issue can be #145. One can manually put an Xcode XIP in the same network as CI nodes and install it from there.

FYI it seems it's now not possible to download Xcode without 2FA and xcode-install has the same issue. It might be a good opportunity for xcodes to be the only tool that can be used in CIs.

tejassharma96 commented 2 years ago

would also love to see an option for an install that requires no manual input (ie by using environment variables to represent the developer email, password, and session)

tahirmt commented 2 years ago

I found a way to do this by making xcodes use the cookie generated by fastlane spaceauth. This allows for one login per 30 days. Which is how I'm managing our CI right now.

  1. Use fastlane spaceauth -u 'email' to generate a fastlane cookie
  2. If cookie isn't expired, run fastlane spaceauth -u 'email' again when reading cookies. (This is crucial because while the main cookie is valid, another cookie is only valid for 24 hours but running this doesn't require 2FA code. This bumps up the cookie time from 24 hours to 30 days.
  3. Using a ruby script to load the cookies from the file stored by spaceauth into a json file that swift can read.
  4. Load up the cookies into HTTPCookieStorage for URLSession to use.
  5. xcodes now uses the cookies that were originally generated by spaceauth.

I'm sure there is a way to optimize some of this and maybe even make xcodes handle most of these things internally but for my use case I wanted to read the cookie already generated by fastlane.

tahirmt commented 1 year ago

With #215 in, I don't think this is needed anymore

omarzl commented 1 year ago

I think this issue should be reopened now that Apple blocked the non-authenticated download workaround 😢 If possible @tahirmt could you share the code snippet to load the cookie into HTTPCookieStorage?

omarzl commented 1 year ago

Opened https://github.com/RobotsAndPencils/xcodes/pull/265 with a modified version of @tahirmt solution, hope you can give it a review, thanks!

tahirmt commented 1 year ago

I had opened this new issue #248 to track it. Thanks for the PR. When I worked on it originally I didn't know what fastlane used internally so I ended up using ruby but your solution is much cleaner!