
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
app_signer is a tool to re-sign iOS .app files to create a new .ipa with a given provisioning profile and certificate.
app_path
- Path to the iOS .app file to be signed.provisioning_profile_path
- Path to the provisioning profile to be used to
sign the ipa.signing_identity
- Common name in the certificate to be used to sign the
ipa. This can be found by opening the keychain, right clicking the certificate,
and clicking 'get info'.signing_identity_SHA1
- SHA1 of the certificate to be used to sign the app.
This can be found by opening the keychain, right clicking the certificate,
and clicking 'get info'. This is needed because it's possible to have two
certificates with the same common name.generated_ipa_name
- Name to use for the generated ipa filebundle_id
- Used to changed the bundle id during re-signing. (optional)require 'app_signer'
# Create signer
signer = AppSigner::Signer.new
# Set needed params
signer.app_path = # path to .app
signer.provisioning_profile_path = # path to provisioning profile
signer.signing_identity = # signing identity common name
signer.signing_identity_SHA1 = # signing identity SHA1
signer.generated_ipa_name = # name for generated ipa
signer.bundle_id = # optional new bundle id to use in info plist
# Create new ipa
signer.sign
app_signer --app-path PATH_TO_APP\
--profile-path PATH_TO_PROVISIONING_PROFILE\
--signing-identity SIGNING_IDENTITY\
--signing-identity-SHA1 SIGNING_IDENTITY_SHA1\
--ipa-name IPA_NAME\
--bundle-id OPTIONAL_NEW_BUNDLE_ID
FAQs
Unknown package
We found that app_signer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.