eleven / messenger Public

ios: move to the Eleven Messenger Apple Developer team (#108)

Signing moves from the free personal team to the paid Eleven Messenger
team (J5NDF5PCD8, team@elevenmessenger.com), and the app id becomes
com.elevenmessenger.messenger (+ .nse / .mac). The team and bundle id
are now repo defaults in project.yml, so device builds need no
per-machine signing overrides.

Also applies the APNs go-live entitlement (aps-environment) that was
gated on paid signing, points the shared keychain group at the new
team/bundle, and declares NSCameraUsageDescription in project.yml so
xcodegen can no longer drop it from the generated Info.plist.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 4 months ago b7244cc412c9843c34addd22a53b33eb1c146251 parent 9f8d15c

6 files changed, +36 −32

ios/LChat/Info.plist +2 −2
ios/LChat/LChat.entitlements +3 −1
ios/LChat/SharedThreadKeys.swift +1 −1
ios/LChatNSE/LChatNSE.entitlements +1 −1
ios/README.md +22 −24
ios/project.yml +7 −3

diff --git a/ios/LChat/Info.plist b/ios/LChat/Info.plist

index 368e18a..86f31d6 100644

--- a/ios/LChat/Info.plist

+++ b/ios/LChat/Info.plist

@@ -25,6 +25,8 @@

<key>NSAllowsLocalNetworking</key>

<true/>

</dict>

+ <key>NSCameraUsageDescription</key>

+ <string>Camera access is needed to scan QR codes for joining chats</string>

<key>UILaunchScreen</key>

<dict/>

<key>UISupportedInterfaceOrientations</key>

@@ -38,7 +40,5 @@

<string>UIInterfaceOrientationLandscapeLeft</string>

<string>UIInterfaceOrientationLandscapeRight</string>

</array>

- <key>NSCameraUsageDescription</key>

- <string>Camera access is needed to scan QR codes for joining chats</string>

</dict>

</plist>

diff --git a/ios/LChat/LChat.entitlements b/ios/LChat/LChat.entitlements

index e1ed55e..c7a3a2a 100644

--- a/ios/LChat/LChat.entitlements

+++ b/ios/LChat/LChat.entitlements

@@ -8,9 +8,11 @@

<true/>

<key>com.apple.security.network.client</key>

<true/>

+ <key>aps-environment</key>

+ <string>development</string>

<key>keychain-access-groups</key>

<array>

- <string>$(AppIdentifierPrefix)com.rushedsunlight.eleven.shared</string>

+ <string>$(AppIdentifierPrefix)com.elevenmessenger.messenger.shared</string>

</array>

</dict>

</plist>

diff --git a/ios/LChat/SharedThreadKeys.swift b/ios/LChat/SharedThreadKeys.swift

index 5afa92b..60fccae 100644

--- a/ios/LChat/SharedThreadKeys.swift

+++ b/ios/LChat/SharedThreadKeys.swift

@@ -23,7 +23,7 @@ enum SharedThreadKeys {

private static let service = "com.lchat.client.threadkeys"

// TeamID prefix + shared suffix; only valid with the keychain-sharing

// entitlement (paid signing). See the go-live notes in ios/README.md.

- private static let accessGroup = "5ANZE82673.com.rushedsunlight.eleven.shared"

+ private static let accessGroup = "J5NDF5PCD8.com.elevenmessenger.messenger.shared"

static func save(threadID: String, entry: Entry) {

guard let data = try? JSONEncoder().encode(entry) else { return }

diff --git a/ios/LChatNSE/LChatNSE.entitlements b/ios/LChatNSE/LChatNSE.entitlements

index f60a67e..8893321 100644

--- a/ios/LChatNSE/LChatNSE.entitlements

+++ b/ios/LChatNSE/LChatNSE.entitlements

@@ -6,7 +6,7 @@

let the extension decrypt pushed ciphertext on-device. -->

<key>keychain-access-groups</key>

<array>

- <string>$(AppIdentifierPrefix)com.rushedsunlight.eleven.shared</string>

+ <string>$(AppIdentifierPrefix)com.elevenmessenger.messenger.shared</string>

</array>

</dict>

</plist>

diff --git a/ios/README.md b/ios/README.md

index 19b1f84..4c062b1 100644

--- a/ios/README.md

+++ b/ios/README.md

@@ -96,8 +96,10 @@ CoreSimulator), target the SDK directly instead — swap the `-destination` flag

for `-sdk iphonesimulator`. The Mac Catalyst build is the most reliable headless

gate since it never touches the Simulator service.

-To run on a physical iOS device or on the Mac, set your signing team in Xcode

-(Signing & Capabilities) — the bundle id is `com.lchat.client`.

+To run on a physical iOS device or on the Mac, sign in with an Apple ID that's

+a member of the Eleven Messenger team (`J5NDF5PCD8`, set as `DEVELOPMENT_TEAM`

+in `project.yml`) — the bundle id is `com.elevenmessenger.messenger`. Not a

+team member? See the personal-team fallback at the bottom of this file.

### macOS (Mac Catalyst) notes

@@ -172,10 +174,12 @@ To go live (needs a paid Apple Developer membership):

2. Deploy each instance with the extra env (base64 the key to survive env

quoting): `LCHAT_APNS_KEY` (p8 PEM or its base64), `LCHAT_APNS_KEY_ID`,

`LCHAT_APNS_TEAM_ID`, `LCHAT_APNS_TOPIC` (the app bundle id).

-3. In the app project: add the `aps-environment` entitlement to LChat, sign

- LChat + LChatNSE with the paid team, and give BOTH targets the same

- keychain access group (update the constant in `SharedThreadKeys.swift` to

- `<TeamID>.<bundle id>.shared`).

+3. In the app project (already done for the Eleven Messenger team

+ `J5NDF5PCD8` — redo only if the team or bundle id changes): the

+ `aps-environment` entitlement on LChat, the paid team as `DEVELOPMENT_TEAM`

+ in `project.yml`, and the same keychain access group on BOTH targets

+ (`<TeamID>.<bundle id>.shared`, mirrored by the constant in

+ `SharedThreadKeys.swift`).

4. Dev builds register with `sandbox: true` (`#if DEBUG`) and are delivered via

Apple's sandbox gateway; TestFlight/App Store builds use production.

@@ -186,32 +190,26 @@ Connect → Users and Access, **Developer** or Admin role), you build with **you

own Apple ID** — no shared credentials:

1. Xcode → Settings → Accounts → add your Apple ID (the one that was invited).

-2. Sign with the **shared team** and the **existing bundle id** so you reuse the

- already-configured App ID (it carries the Push capability + the shared

- keychain group). Easiest is the command line — automatic signing mints *your*

- development cert and registers your device under the team:

+2. Build with the repo defaults — `project.yml` already sets the team

+ (`J5NDF5PCD8`) and bundle id (`com.elevenmessenger.messenger`), whose App ID

+ carries the Push capability + the shared keychain group. Easiest is the

+ command line — automatic signing mints *your* development cert and registers

+ your device under the team:

```sh

cd ios && xcodegen generate

xcodebuild -project LChat.xcodeproj -scheme LChat -destination 'generic/platform=iOS' \

-derivedDataPath build -allowProvisioningUpdates \

- DEVELOPMENT_TEAM=<TEAM_ID> LCHAT_APP_BUNDLE_ID=com.rushedsunlight.eleven \

CODE_SIGN_STYLE=Automatic build

xcrun devicectl device install app --device <YOUR_UDID> \

build/Build/Products/Debug-iphoneos/LChat.app

```

- In Xcode's UI instead: pick the team in Signing & Capabilities and set the

- bundle id to `com.rushedsunlight.eleven`, then ⌘R.

+ In Xcode's UI instead: just ⌘R — the team and bundle id come from the

+ generated project.

-Do **not** build with the default `com.lchat.client` bundle id against the shared

-team — that would try to mint a new App ID without the Push/keychain setup, and

-enabling push on it needs an Admin. Reusing `com.rushedsunlight.eleven` gives you

-push + on-device decryption with no further config. (`<TEAM_ID>` and the shared

-keychain group's prefix are the same team, so `SharedThreadKeys` matches for

-every member automatically.)

-If you'd rather not join the team, build with your **own** free personal team and

-a unique `LCHAT_APP_BUNDLE_ID` — but first remove `aps-environment` and the

-`keychain-access-groups` from `LChat/LChat.entitlements` (a free team can't

-provision them); you'll lose push locally but everything else runs.

+If you'd rather not join the team, build with your **own** free personal team

+(`DEVELOPMENT_TEAM=<yours>`) and a unique `LCHAT_APP_BUNDLE_ID` — but first

+remove `aps-environment` and the `keychain-access-groups` from

+`LChat/LChat.entitlements` (a free team can't provision them); you'll lose push

+locally but everything else runs.

diff --git a/ios/project.yml b/ios/project.yml

index f0eb713..3c53b14 100644

--- a/ios/project.yml

+++ b/ios/project.yml

@@ -1,6 +1,6 @@

name: LChat

options:

- bundleIdPrefix: com.lchat

+ bundleIdPrefix: com.elevenmessenger

deploymentTarget:

iOS: "17.0"

createIntermediateGroups: true

@@ -10,10 +10,13 @@ settings:

MARKETING_VERSION: "1.0"

CURRENT_PROJECT_VERSION: "1"

TARGETED_DEVICE_FAMILY: "1,2"

+ # The Eleven Messenger Apple Developer team. Overridable on the xcodebuild

+ # line for building with a personal team instead.

+ DEVELOPMENT_TEAM: J5NDF5PCD8

# One knob for the app id; the extension derives from it so a per-machine

# override (e.g. LCHAT_APP_BUNDLE_ID=com.example.mine on the xcodebuild

# line for device signing) can never collide the two bundle ids.

- LCHAT_APP_BUNDLE_ID: com.lchat.client

+ LCHAT_APP_BUNDLE_ID: com.elevenmessenger.messenger

targets:

LChat:

type: application

@@ -36,6 +39,7 @@ targets:

path: LChat/Info.plist

properties:

CFBundleDisplayName: Eleven

+ NSCameraUsageDescription: Camera access is needed to scan QR codes for joining chats

UILaunchScreen: {}

UISupportedInterfaceOrientations:

- UIInterfaceOrientationPortrait

@@ -64,7 +68,7 @@ targets:

settings:

base:

PRODUCT_NAME: Eleven

- PRODUCT_BUNDLE_IDENTIFIER: com.lchat.mac

+ PRODUCT_BUNDLE_IDENTIFIER: com.elevenmessenger.messenger.mac

CODE_SIGN_STYLE: Automatic

CODE_SIGN_ENTITLEMENTS: LChatMac/LChatMac.entitlements

ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon