fix(ci): switch to signed IPA build via APPLE_SIGNING group

Replace unsigned CODE_SIGNING_ALLOWED=NO build with proper ad-hoc
signed archive using keychain, certificate, and provisioning profile.
Update xtool.yml schema to match current xtool v1 format.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

altstore-source.json

@@ -11,7 +11,7 @@
       "name": "SilverApple",
       "bundleIdentifier": "uk.silverlabs.silverapple",
       "developerName": "SilverLABS",
-      "downloadURL": "https://git.silverlabs.uk/SilverLABS/SilverApple/releases/download//SilverApple.ipa",
+      "downloadURL": "https://git.silverlabs.uk/SilverLABS/SilverApple/releases/download/v0.1.1/SilverApple.ipa",
       "subtitle": "Privacy companion for iOS",
       "localizedDescription": "SilverApple integrates your device with the SilverLABS ecosystem — MDM enrollment, privacy hardening checks, and Passport authentication.",
       "iconURL": "https://git.silverlabs.uk/SilverLABS/SilverApple/raw/branch/main/SilverApple/Assets.xcassets/AppIcon.appiconset/Icon-60@2x.png",
@@ -19,12 +19,12 @@
       "category": "utilities",
       "versions": [
         {
-          "version": "",
-          "buildVersion": "",
-          "date": "2026-04-06T21:09:48Z",
+          "version": "0.1.1",
+          "buildVersion": "0.1.1",
+          "date": "2026-04-06T21:22:41Z",
           "localizedDescription": "See release notes.",
-          "downloadURL": "https://git.silverlabs.uk/SilverLABS/SilverApple/releases/download//SilverApple.ipa",
-          "sha256": "30e7d3cdd5f5c6e88fbf16cfe20cf646f4ced79e84a8b321702861182744b83e",
+          "downloadURL": "https://git.silverlabs.uk/SilverLABS/SilverApple/releases/download/v0.1.1/SilverApple.ipa",
+          "sha256": "fa2004dee56567a11b134461bc3736417a2f84f015bf2944e6872fda020e0399",
           "size": 91467
         }
       ]

codemagic.yaml

@@ -15,6 +15,7 @@ workflows:
       xcode: latest
       groups:
         - SLABS
+        - APPLE_SIGNING
       vars:
         BUNDLE_ID: uk.silverlabs.silverapple
         GITEA_REPO: SilverLABS/SilverApple
@@ -26,7 +27,26 @@ workflows:
           brew install xcodegen
           xcodegen generate --spec project.yml
 
-      - name: Build (unsigned)
+      - name: Initialize keychain
+        script: keychain initialize
+
+      - name: Install signing certificate
+        script: |
+          echo $CM_CERTIFICATE | base64 --decode > /tmp/cert.p12
+          keychain add-certificates \
+            --certificate /tmp/cert.p12 \
+            --certificate-password $CM_CERTIFICATE_PASSWORD
+
+      - name: Install provisioning profile
+        script: |
+          echo $CM_PROVISIONING_PROFILE | base64 --decode > /tmp/profile.mobileprovision
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp /tmp/profile.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/
+
+      - name: Configure Xcode signing
+        script: xcode-project use-profiles
+
+      - name: Build (signed)
         script: |
           xcodebuild archive \
             -project SilverApple.xcodeproj \
@@ -34,26 +54,28 @@ workflows:
             -destination "generic/platform=iOS" \
             -configuration Release \
             -archivePath "$CM_BUILD_DIR/SilverApple.xcarchive" \
-            CODE_SIGNING_ALLOWED=NO \
-            CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGN_IDENTITY="" \
-            PROVISIONING_PROFILE=""
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
+            CODE_SIGN_STYLE=Manual
 
-      - name: Package IPA
+      - name: Export signed IPA
         script: |
-          cd "$CM_BUILD_DIR"
-          APP=$(find SilverApple.xcarchive/Products -name "*.app" -type d | head -1)
-          if [ -z "$APP" ]; then
-            echo "ERROR: No .app found in xcarchive. Contents:"
-            find SilverApple.xcarchive -type d | head -30
-            exit 1
-          fi
-          echo "Packaging: $APP"
-          mkdir -p Payload
-          cp -r "$APP" Payload/
-          zip -r SilverApple.ipa Payload/
-          rm -rf Payload
-          echo "IPA size: $(du -sh SilverApple.ipa | cut -f1)"
+          cat > /tmp/ExportOptions.plist << 'EOF'
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <plist version="1.0">
+          <dict>
+            <key>method</key>
+            <string>ad-hoc</string>
+            <key>signingStyle</key>
+            <string>manual</string>
+          </dict>
+          </plist>
+          EOF
+          xcodebuild -exportArchive \
+            -archivePath "$CM_BUILD_DIR/SilverApple.xcarchive" \
+            -exportPath "$CM_BUILD_DIR/export" \
+            -exportOptionsPlist /tmp/ExportOptions.plist
+          cp "$CM_BUILD_DIR/export/SilverApple.ipa" "$CM_BUILD_DIR/SilverApple.ipa"
 
       - name: Publish to Gitea
         script: |

servers.json

@@ -0,0 +1,8 @@
+{
+  "servers": [
+    {
+      "name": "SilverLABS Anisette",
+      "address": "https://anisette.silverlabs.uk"
+    }
+  ]
+}

xtool.yml

@@ -1,13 +1,8 @@
 # xTool configuration — https://xtool.sh
-# Run `xtool configure` once to set up your Apple ID credentials and Darwin SDK.
-# Then: `xtool run` to build and install directly to a connected device.
+# Run `xtool setup` once to configure your Apple ID credentials and extract the Darwin SDK.
+# Then: `xtool dev` to build and deploy directly to a connected USB device.
 
-targets:
-  SilverApple:
-    bundleIdentifier: uk.silverlabs.silverapple
-    # Fill in your Apple Developer Team ID (10-char string from developer.apple.com)
-    teamID: ""
-    infoPlist: SilverApple/Info.plist
-    entitlements: SilverApple/SilverApple.entitlements
-    deploymentTarget: "16.0"
-    deviceFamily: [iphone]
+version: 1
+bundleID: uk.silverlabs.silverapple
+infoPath: SilverApple/Info.plist
+entitlementsPath: SilverApple/SilverApple.entitlements