Answered

CRITICAL: iOS xcframework invalid signature

  • 8 April 2024
  • 7 replies
  • 512 views
D
Userlevel 1

All xcFrameworks on Intercom github have invalid signature hence apps using Intercom SDK can not compile at all

 

 

icon

Best answer by Mike M11 8 April 2024, 20:15

View original

7 replies

G

Hello,

Just want to underscore the severity of this issue. Your customers cannot push new builds because of Intercom SDK. 

This means nobody can fix any bugs or release new versions of their code due to problems on your end. This should never happen, please fix it with extreme urgency. 

 

M

Hi. My name is Mike and I’m an iOS Engineer on our Messenger team. I’d like to sincerely apologise to anyone impacted by this issue. We’ve been working today to get this solved as quickly as we can. Here are details about what happened, what we’ve done to mitigate the issue, and what you can do to get the framework working again: 

 

A certificate used to sign our SDK was accidentally revoked on April 5th, leading to the invalidation of previously released SDK versions. This incident has caused errors during the integration of our SDK. We sincerely apologise for any inconvenience caused.
 

To address this issue, we have re-signed and updated all impacted versions to address these issues.
 
Below are detailed instructions to help you resolve the issue if you are impacted:

 

For Customers Integrating via Cocoapods:

1. Begin by removing the current version of the Intercom pod. This is achieved by commenting out the Intercom pod line in your Podfile, then running pod install. The output should indicate "Removing Intercom."
2. Next, clear the cached versions of the Intercom SDK by running pod cache clean 'Intercom' --all in your repository.
3. Re-include the Intercom pod in your Podfile by uncommenting the previously commented line.
4. Finally, run pod install again. A new, valid copy of the SDK will be installed.

If any issues arise during this process, running pod repo update before reinstalling the pod may be beneficial. This ensures that you have the latest podspecs from the CocoaPods repository.

 

For Customers Using Swift Package Manager (SPM):

1. Begin by removing the Intercom package from your project.
2. In Terminal, execute the following commands to remove caching related to the Intercom framework, which may be causing persistent errors:
    
    rm ~/Library/org.swift.swiftpm/security/fingerprints/intercom-ios-sp*; rm -rf ~/Library/Caches/org.swift.swiftpm/repositories/intercom-ios-sp*
    
3. Re-add the desired version of Intercom via SPM. (Please ensure that you are using https://github.com/intercom/intercom-ios-sp instead of https://github.com/intercom/intercom-ios when integrating Intercom as a Swift Package.) 
Note that a "Package Resolution Failed" error might occur. If so, selecting "Add Anyway" will resolve the package correctly and address the issue.

 

For Customers Manually Integrating the SDK:

1. Please re-download the SDK from our GitHub page. Specific versions can be found on this page. 
2. Use the newly downloaded version to replace the existing copy in your project. The updated SDK will have valid signing.
 

G

Thanks Mike. Can you tell me what steps Intercom is taking to ensure this doesn’t happen again in the future. It’s really a problem when we can’t push updates to our own applications because of an SDK signing issue. Given that we rely on Intercom for support, just removing the SDK when it’s impacted is of course not an option.

Appreciate the follow up.

Brian B11
Userlevel 2
Badge +2

Hi @getkarmaplus 

We’ll be doing a detailed review of what happened here over the coming days. We’ll post an update here once we’ve concluded it.

Thanks for your patience and understanding.

Brian

H

Hello!

 

How can we reset the issue with SPM on CI machines like Azure?

Tried adding the lines: 

rm ~/Library/org.swift.swiftpm/security/fingerprints/intercom-ios-sp*
rm -rf ~/Library/Caches/org.swift.swiftpm/repositories/intercom-ios-sp*

into a command line step but all I got was:

rm: /Users/runner/Library/org.swift.swiftpm/security/fingerprints/intercom-ios-sp*: No such file or directory

but it still fails with:

checksum of downloaded artifact of binary target 'Intercom' (02c5acb0cedfa55a75e5878afebabc9304407fabdce945d21d93408840927df0) does not match checksum specified by the manifest (fa615003f8184f10b7f8bd96ee1e2ff8a9ddf6b8169d51f9e36577dcbe125273)fatalError2024-04-10 08:30:21.700 xcodebuild[3000:12945] Writing error result bundle to /var/folders/m8/zh9fv9zn2dd56m30mrjx20t80000gn/T/ResultBundle_2024-10-04_08-30-0021.xcresult
xcodebuild: error: Could not resolve package dependencies:
  checksum of downloaded artifact of binary target 'Intercom' (02c5acb0cedfa55a75e5878afebabc9304407fabdce945d21d93408840927df0) does not match checksum specified by the manifest (fa615003f8184f10b7f8bd96ee1e2ff8a9ddf6b8169d51f9e36577dcbe125273)
  fatalError
[08:30:23]: Exit status: 74

Also the fix for SwiftPM in Xcode did not work. I did remove all ~/Library/org.swift.swiftpm/ and ~/Library/Caches/org.swift.swiftpm folders and the issue is still there

 

Thank you!

H

UPDATE: I did forgot to redownload from https://github.com/intercom/intercom-ios-sp instead of the old url. Using this url fixed the issue. Thank you!

H

UPDATE: I did forgot to redownload from https://github.com/intercom/intercom-ios-sp instead of the old url. Using this url fixed the issue. Thank you!

However with the new framework a build error is thrown when importing Intercom:

 

Update: Of course I forgot to choose the target when adding the package :) please ignore this

Reply


Terms & ConditionsCookie settings