1

I was trying to search for a quick command to extract the bundle identifier from a provisioning profile. I think I've seen something like that in the past, but I can't find it now.

Inspecting the .mobileprovision file shows that it's a .plist file, but not quite as it is surrounded by some binary data. I tried PlistBuddy, but the binary data causes it to fail with the following error:

Unexpected character 0 at line 1

I think the command I saw in the past was just some regex to extract the wanted value. I know, don't parse XML with regex, but I think this is one of those times when it is acceptable. In fact, I would prefer a regex solution if it means that I do not have to install any dependencies.

Erik B
  • 40,889
  • 25
  • 119
  • 135

2 Answers2

2

TL;DR

security cms -D -i your.mobileprovision | plutil -extract Entitlements.application-identifier xml1 -o - - | grep string | sed 's/^<string>[^\.]*\.\(.*\)<\/string>$/\1/g'

The Details

The key here is that you can extract the plist from the provisioning profile using:

security cms -D -i your.mobileprovision > tmp.plist

Now that you have a proper plist, you can use PlistBuddy as normal. I ended up using plutil instead, because PlistBuddy doesn't support reading from stdin and I didn't want to create a temporary file. Unfortunately plutil outputs XML and not just the value of the property, but the Entitlements.application-identifier property has the Team ID prepended, so I would have anyway needed regex to extract the bundle identifier.

If you have any suggestions on how to improve this command, I'm happy to hear them, but the command is working as expected and has solved my problem. Hopefully, someone else will find it useful as well.

Erik B
  • 40,889
  • 25
  • 119
  • 135
  • Hi Erik, thanks for the great explanation. One question, do you know how to repack a provisioning profile? I'd like to change the device list of the provisioning profile, and repack it, but I don't know the command to "zip" it again? Thanks again – Sep Feb 17 '23 at 09:29
0

On macOS Monterey, this became simpler:

security cms -D -i your.mobileprovision | plutil -extract Entitlements.application-identifier raw -o - -

Finally, plutil can natively print an unencapsulated value. From man plutil:

RAW VALUES AND EXPECTED TYPES

With -extract keypath raw the value printed depends on its type.

Following are the possible expect_type values and how they will be printed when encountered with -extract keypath raw

  • bool = the string "true" or "false"
  • integer = the numeric value
  • float = the floating point value with no specific precision
  • string = the raw unescaped string, UTF8-encoded
  • date = the RFC3339-encoded string representation in UTC time zone
  • data = a base64-encoded string representation of the data
  • array = a number indicating the count of elements in the array
  • dictionary = each key in the dictionary will be printed on a new line in alpha-sorted order

The above expect_type string is itself printed when -type keypath is used.

Pendarin
  • 31
  • 2