fix(tvos): sign simulator consumers with real Keychain entitlements

Author: sachk

README.md

@@ -11,60 +11,6 @@
   10-foot / remote navigation: build around GridView / ListView + FocusScope + KeyNavigation + Keys. KeyNavigation is specifically for arrow/tab-based focus jumps, and FocusScope exists to keep reusable focus regions sane, which is exactly the problem space for D-pad TV UIs.
   HTTP asset caching: QNetworkDiskCache for posters, backdrops, and image responses. It is basic, but it plugs directly into QNetworkAccessManager; just remember it is basic by design and defaults to a 50 MB limit, so you will probably want to raise that.
 
-## Apple TV review branch
-
-`feature/tvos` contains the Apple TV target independently of the iOS target.
-Qt does **not** list tvOS among its officially supported/tested platforms.
-The branch source-builds the pinned Qt UIKit port for `CMAKE_SYSTEM_NAME=tvOS`;
-an iOS binary kit or macOS Qt library cannot be substituted. See the upstream
-[platform matrix](https://doc.qt.io/qt-6/supported-platforms.html) and
-[UIKit platform source](https://github.com/qt/qtbase/tree/6.11/src/plugins/platforms/ios).
-
-**Validation status:** this is not yet a working or shippable tvOS build.
-The native Xcode CI attempt currently fails while compiling Qt's UIKit
-platform plugin because it references iOS-only orientation APIs. QtCore,
-QtGui, QtNetwork, and QtOpenGL compilation alone is not application/playback
-proof. There is no successful Apple TV application link or simulator/device
-smoke result, and this target must not be included in release support claims.
-
-On macOS with Xcode's Apple TV SDK installed:
-
-```sh
-brew install cmake ninja meson pkg-config bash python imagemagick
-# Install matching pinned macOS host Qt tools (Qt Online Installer or aqt).
-export QT_HOST_PATH=/absolute/path/to/Qt/macos
-APPLE_SDK=appletvsimulator APPLE_ARCH=arm64 bash tools/build-tvos.sh
-bash tools/apple/smoke-tvos.sh \
-  build/tvos/appletvsimulator-arm64/install/Spool.app
-```
-
-The build verifies source digests, builds Qt and the static mpv/media closure
-for the selected SDK, generates the Apple TV layered icon/Top Shelf artwork,
-and packages `Spool.app`. Set `APPLE_SDK=appletvos`, `APPLE_ARCH=arm64`,
-`CODE_SIGNING_ALLOWED=YES`, and `APPLE_DEVELOPMENT_TEAM` for a signed device
-build. Archive/export using Xcode with your provisioning profile; a simulator
-bundle is not an App Store artifact. The dedicated `tvOS source build`
-workflow builds and runs the existing UI and video-render consumer smoke tests
-in an isolated Apple TV simulator. Simulator success does not establish
-physical-device decoder/audio performance, Siri Remote gesture feel, VoiceOver,
-HDR/frame-rate matching, signing, or App Store acceptance.
-
-The target reuses TV focus, hold-to-open-options, and directional navigation.
-Clickpad directions/Select arrive through Qt's UIKit mapping; indirect swipes
-step focus without turning the remote into a pointer. Back/Menu dismisses
-overlays or navigates back and remains unhandled at the root for tvOS to return
-to the launcher. Play/Pause toggles playback. Siri, TV/Home, and volume remain
-system-owned. Video pauses when hidden/suspended; audio uses the playback
-session and system Now Playing/remote controls. Idle inhibition applies only
-while media is active. Account secrets use device-only Keychain records.
-Database/artwork/log storage is purgeable on tvOS; local filesystem browsing
-and self-updating are not enabled.
-
-Every tvOS build enables `SPOOL_APPLE_APP_STORE`: only provider pins explicitly
-approved with `appleAppStore: true` are embedded, all local overrides are
-rejected, and runtime provider-code downloads are disabled. Provider updates
-therefore arrive only with app updates, not through a curated download store.
-
 ## Local sibling providers
 
 Keep the app checkout and provider repositories together, for example
@@ -667,6 +613,11 @@ PRs restore without publishing caches. Only `spool-tvos-device-arm64` is a publi
 release artifact. Simulator apps and smoke results use
 `internal-tvos-simulator-arm64` and are never offered as installable downloads.
 
+Before installation, the smoke helper ad-hoc signs both simulator bundles with
+matching local application and Keychain access-group entitlements. This requires
+no Apple developer certificate, exercises the real sandboxed Keychain consumer,
+and does not sign or provision the separately built device IPA.
+
 ## Android development
 
 The Android toolchain is pinned to SDK 36, Build Tools 36.0.0 and NDK

tools/apple/smoke-tvos.sh

@@ -12,26 +12,46 @@ cleanup() { xcrun simctl shutdown "$device" >/dev/null 2>&1 || true; xcrun simct
 trap cleanup EXIT
 xcrun simctl boot "$device"
 xcrun simctl bootstatus "$device" -b
-xcrun simctl install "$device" "$app"
 # simctl's console mode returns after process exit. Parse only the exact
 # credential-free consumer-test result, never dump full app/provider logs.
 python3 - "$device" "$app" "$result" <<'PY'
-import json, os, re, subprocess, sys
+import json, os, plistlib, re, subprocess, sys, tempfile
 from pathlib import Path
 
 device, app, output = sys.argv[1:]
 output = Path(output)
+app = Path(app)
+smoke = app.parent / "smoke" / "spool-tvos-playback-smoke.app"
+bundle_ids = []
+with tempfile.TemporaryDirectory(prefix="spool-tvos-sign-") as signing:
+    for bundle in (app, smoke):
+        with (bundle / "Info.plist").open("rb") as metadata:
+            identifier = plistlib.load(metadata)["CFBundleIdentifier"]
+        bundle_ids.append(identifier)
+        # Simulator Keychain still enforces signed application/access-group
+        # entitlements. A local ad-hoc identity needs no developer certificate
+        # and is not a signing identity for device/App Store distribution.
+        application = "SPOOLSMOKE." + identifier
+        entitlements = Path(signing) / (identifier + ".plist")
+        with entitlements.open("wb") as file:
+            plistlib.dump({
+                "application-identifier": application,
+                "com.apple.developer.team-identifier": "SPOOLSMOKE",
+                "keychain-access-groups": [application],
+            }, file)
+        subprocess.run(["codesign", "--force", "--sign", "-", "--timestamp=none",
+                        "--entitlements", str(entitlements), "--generate-entitlement-der", str(bundle)], check=True)
+        subprocess.run(["xcrun", "simctl", "install", device, str(bundle)], check=True)
+app_id, smoke_id = bundle_ids
 checks = [
-    ("com.sachk.spool", ["--launch-test"], "launch test: application UI rendered"),
-    ("com.sachk.spool.playback-smoke", ["mpv-video-item"],
+    (app_id, ["--launch-test"], "launch test: application UI rendered"),
+    (smoke_id, ["mpv-video-item"],
      "mpv video smoke: upright frames and OSD rendered across detach and resize"),
-    ("com.sachk.spool.playback-smoke", ["tvos-audio"],
+    (smoke_id, ["tvos-audio"],
      "tvOS audio smoke: AudioUnit output advanced with exclusive playback session"),
-    ("com.sachk.spool.playback-smoke", ["tvos-credentials"],
+    (smoke_id, ["tvos-credentials"],
      "tvOS credentials smoke: Keychain roundtrip and sandbox file persistence passed"),
 ]
-smoke = Path(app).parent / "smoke" / "spool-tvos-playback-smoke.app"
-subprocess.run(["xcrun", "simctl", "install", device, str(smoke)], check=True)
 results = {}
 for bundle, arguments, expected in checks:
     environment = os.environ.copy()