Make iOS app be built by Nix derivation

[jakubgs]

Description

Currently the way iOS is built is by calling Fastlane in a Nix shell. To make it match Android it should be built by a derivation.

Details

Currently when you call make release-ios we start a Nix shell for TARGET=ios: https://github.com/status-im/status-react/blob/fe5b5ab4bc1cf4baf554406b2885c61424becdaf/Makefile#L168-L173 Which is different form how we build it via CI:

    nix.shell(
      "bundle exec --gemfile=fastlane/Gemfile fastlane ios ${target}",
      keepEnv: [
        'FASTLANE_DISABLE_COLORS',
        'FASTLANE_PASSWORD', 'KEYCHAIN_PASSWORD',
        'MATCH_PASSWORD', 'FASTLANE_APPLE_ID',
      ],
      attr: 'shells.ios'
    )

https://github.com/status-im/status-react-jenkins/blob/1aef5c941161647bbb62986405f52edd1140b7b1/vars/ios.groovy#L44-L52

But Android build essentially just calls nix-build with a bunch of arguments related to signing: https://github.com/status-im/status-react/blob/fe5b5ab4bc1cf4baf554406b2885c61424becdaf/scripts/release-android.sh#L81

The derivation will have to combine elements of nix/mobile/ios/pod-shell.nix and nix/mobile/ios/default.nix. It might also require a wrapper script like scripts/release-android.sh to provide the env variables like FASTLANE_PASSWORD or FASTLANE_APPLE_ID.

Possible Issues

The build cannot be run using Nix sandbox because Fastlane Match requires network connection to fetch the certificates and keys from our ios-certificates repo.

Acceptance Criteria

Being able to build iOS app with:

 > nix-build --no-out-link -A targets.mobile.ios.release

And make release-ios does the same thing via nix/scripts/build.sh.

[jakubgs]

This is a considerable amount of work, and should probably wait till https://github.com/status-im/status-react/pull/10936 is done.

[churik]

is it still relevant @jakubgs ?

[jakubgs]

It would be nice to have, yes. Currently we build just by running commands in nix-shell, but a more structured build would be more reproducible.

[churik]

@jakubgs still relevant?

[jakubgs]

Yes.