Wire Apple KMS release signing

Scripts/apple/profile-entitlements.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Extract signing entitlements from an Apple provisioning profile."""
+
+from __future__ import annotations
+
+import argparse
+import plistlib
+import subprocess
+import sys
+from pathlib import Path
+
+
+def decode_profile(path: Path) -> dict:
+    commands = [
+        ["security", "cms", "-D", "-i", str(path)],
+        ["openssl", "smime", "-inform", "DER", "-verify", "-noverify", "-in", str(path)],
+        ["openssl", "cms", "-inform", "DER", "-verify", "-noverify", "-in", str(path)],
+    ]
+    errors: list[str] = []
+    for command in commands:
+        try:
+            proc = subprocess.run(
+                command,
+                check=False,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+        except FileNotFoundError:
+            continue
+        if proc.returncode == 0 and proc.stdout:
+            return plistlib.loads(proc.stdout)
+        errors.append(f"{command[0]} exited {proc.returncode}: {proc.stderr.decode(errors='replace').strip()}")
+    raise RuntimeError(f"unable to decode provisioning profile {path}: {'; '.join(errors)}")
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("profile", type=Path)
+    parser.add_argument("--output", "-o", type=Path, required=True)
+    args = parser.parse_args(argv)
+
+    profile = decode_profile(args.profile)
+    entitlements = profile.get("Entitlements")
+    if not isinstance(entitlements, dict):
+        raise RuntimeError(f"profile has no Entitlements dictionary: {args.profile}")
+
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_bytes(plistlib.dumps(entitlements, fmt=plistlib.FMT_XML))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))