From 9bd2261c0f10768ad91977c7591777e2b3ff737a Mon Sep 17 00:00:00 2001
From: Nimrod Gutman <nimrod.g@singular.net>
Date: Thu, 19 Feb 2026 15:48:46 +0800
Subject: [PATCH] fix(ios): auto-generate local signing overrides (#20716)

---
 scripts/ios-configure-signing.sh | 61 ++++++++++++++++++++++++++++++--
 1 file changed, 59 insertions(+), 2 deletions(-)

diff --git a/scripts/ios-configure-signing.sh b/scripts/ios-configure-signing.sh
index ef891632c1b..99219725fe7 100755
--- a/scripts/ios-configure-signing.sh
+++ b/scripts/ios-configure-signing.sh
@@ -6,6 +6,26 @@ IOS_DIR="${ROOT_DIR}/apps/ios"
 TEAM_ID_SCRIPT="${ROOT_DIR}/scripts/ios-team-id.sh"
 LOCAL_SIGNING_FILE="${IOS_DIR}/.local-signing.xcconfig"
 
+sanitize_identifier_segment() {
+  local raw="${1:-}"
+  raw="$(printf '%s' "$raw" | tr '[:upper:]' '[:lower:]')"
+  raw="$(printf '%s' "$raw" | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//; s/-+/-/g')"
+  if [[ -z "$raw" ]]; then
+    raw="local"
+  fi
+  printf '%s\n' "$raw"
+}
+
+normalize_bundle_id() {
+  local raw="${1:-}"
+  raw="$(printf '%s' "$raw" | tr '[:upper:]' '[:lower:]')"
+  raw="$(printf '%s' "$raw" | sed -E 's/[^a-z0-9.-]+/-/g; s/\.+/./g; s/^-+//; s/[.-]+$//')"
+  if [[ -z "$raw" ]]; then
+    raw="ai.openclaw.ios.test.local"
+  fi
+  printf '%s\n' "$raw"
+}
+
 if [[ ! -x "${TEAM_ID_SCRIPT}" ]]; then
   echo "ERROR: Missing team detection helper: ${TEAM_ID_SCRIPT}" >&2
   exit 1
@@ -24,20 +44,57 @@ else
   exit 0
 fi
 
+if [[ -n "${OPENCLAW_IOS_BUNDLE_SUFFIX:-}" ]]; then
+  identity_source="${OPENCLAW_IOS_BUNDLE_SUFFIX}"
+else
+  identity_source="${USER:-}"
+  if [[ -z "${identity_source}" ]]; then
+    identity_source="$(id -un 2>/dev/null || true)"
+  fi
+  team_segment="$(sanitize_identifier_segment "${team_id}")"
+  identity_source="${identity_source}-${team_segment}"
+fi
+bundle_suffix="$(sanitize_identifier_segment "${identity_source}")"
+
+bundle_base="${OPENCLAW_IOS_APP_BUNDLE_ID:-${OPENCLAW_IOS_BUNDLE_ID_BASE:-}}"
+if [[ -z "${bundle_base}" ]]; then
+  bundle_base="ai.openclaw.ios.test.${bundle_suffix}"
+fi
+bundle_base="$(normalize_bundle_id "${bundle_base}")"
+
+share_bundle_id="${OPENCLAW_IOS_SHARE_BUNDLE_ID:-${bundle_base}.share}"
+watch_app_bundle_id="${OPENCLAW_IOS_WATCH_APP_BUNDLE_ID:-${bundle_base}.watchkitapp}"
+watch_extension_bundle_id="${OPENCLAW_IOS_WATCH_EXTENSION_BUNDLE_ID:-${watch_app_bundle_id}.extension}"
+
+code_sign_style="${OPENCLAW_IOS_CODE_SIGN_STYLE:-Automatic}"
+app_profile="${OPENCLAW_IOS_APP_PROFILE:-}"
+share_profile="${OPENCLAW_IOS_SHARE_PROFILE:-}"
+
 tmp_file="$(mktemp "${TMPDIR:-/tmp}/openclaw-ios-signing.XXXXXX")"
 cat >"${tmp_file}" <<EOF
 // Auto-generated by scripts/ios-configure-signing.sh.
 // This file is local-only and should not be committed.
+// Override values with env vars if needed:
+// OPENCLAW_IOS_APP_BUNDLE_ID / OPENCLAW_IOS_BUNDLE_ID_BASE
+// OPENCLAW_IOS_SHARE_BUNDLE_ID / OPENCLAW_IOS_WATCH_APP_BUNDLE_ID / OPENCLAW_IOS_WATCH_EXTENSION_BUNDLE_ID
+// OPENCLAW_IOS_CODE_SIGN_STYLE / OPENCLAW_IOS_APP_PROFILE / OPENCLAW_IOS_SHARE_PROFILE
+OPENCLAW_CODE_SIGN_STYLE = ${code_sign_style}
 OPENCLAW_DEVELOPMENT_TEAM = ${team_id}
 // Keep legacy key for compatibility with older signing config paths.
 OPENCLAW_IOS_SELECTED_TEAM = ${team_id}
+OPENCLAW_APP_BUNDLE_ID = ${bundle_base}
+OPENCLAW_SHARE_BUNDLE_ID = ${share_bundle_id}
+OPENCLAW_WATCH_APP_BUNDLE_ID = ${watch_app_bundle_id}
+OPENCLAW_WATCH_EXTENSION_BUNDLE_ID = ${watch_extension_bundle_id}
+OPENCLAW_APP_PROFILE = ${app_profile}
+OPENCLAW_SHARE_PROFILE = ${share_profile}
 EOF
 
 if [[ -f "${LOCAL_SIGNING_FILE}" ]] && cmp -s "${tmp_file}" "${LOCAL_SIGNING_FILE}"; then
   rm -f "${tmp_file}"
-  echo "iOS signing team already configured: ${team_id}"
+  echo "iOS signing config already up to date: team=${team_id} app=${bundle_base}"
   exit 0
 fi
 
 mv "${tmp_file}" "${LOCAL_SIGNING_FILE}"
-echo "Configured iOS signing team: ${team_id}"
+echo "Configured iOS signing: team=${team_id} app=${bundle_base}"