DevOps 6: Xavfsizlik, Secret Management va Code Signing — Keychain, App Attest va Privacy Manifests

🛠️ DevOps Engineering

DevOps 6: Xavfsizlik, Secret Management va Code Signing — Keychain, App Attest va Privacy Manifests

Holat: 2026-yil sentabr. iOS ilovalarini avtomatlashtirilgan CI/CD tizimlarida yig'ishda eng ko'p boshog'riq keltiradigan soha — bu Code Signing (kodni imzolash) va maxfiy kalitlarni (Secret Management) xavfsiz boshqarishdir. Ushbu darsda Apple kriptografik imzolash tizimining ichki tuzilishi, CI Keychain yaratish, App Attest va Privacy Manifest qoidalariga rioya qilish bo'yicha to'liq qo'llanma beriladi.

Mundarija

Apple Code Signing arxitekturasi: Sertifikat, Key va Provisioning Profile
CI'da Keychain bilan ishlash: Parolsiz imzolash
Gitleaks va Secret Detection: Maxfiy kalitlar sizishini oldini olish
Runtime Secrets: xcconfig va Build Flags
[Apple Privacy Manifest (PrivacyInfo.xcprivacy) tekshiruvi](#privacy-manifests)
DeviceCheck va App Attest: API himoyasi
Xulosa
Manbalar

1. Apple Code Signing arxitekturasi: Sertifikat, Key va Provisioning Profile {#signing-arxitektura}

iOS tizimida imzolash 3 ta asosiy kriptografik ob'ektga tayanadi:

Private Key (Maxfiy kalit) ──┐
                             ├─► Code Signing (codesign) ──► Imzolangan .app
Apple CA Sertifikati ────────┘                                      │
                                                                    ▼
Provisioning Profile (Entitlements + Ruxsat etilgan qurilmalar) ────┘ (iOS Kernel tekshiradi)

Private Key (Maxfiy kalit): Sizning shaxsiy kalitingiz (hech qachon ochiqqa chiqmasligi shart, faqat .p12 faylda parol bilan saqlanadi).
Developer Certificate (Sertifikat): Apple Developer CA tomonidan imzolangan ommaviy kalit.
**Provisioning Profile (embedded.mobileprovision):** Apple tomonidan kriptografik imzolangan XML plist fayli. U o'z ichida:
Ilovaning Bundle ID'sini;
Ushbu profilga ruxsat berilgan ishlab chiquvchilar sertifikatlarini;
Ad-Hoc / Development uchun ruxsat berilgan qurilmalar UDID ro'yxatini;
Entitlements (Push Notifications, Associated Domains, App Groups)ni saqlaydi.

2. CI'da Keychain bilan ishlash: Parolsiz imzolash {#ci-keychain}

Headless (ekransiz) CI serverlarda (GitHub Actions yoki Mac mini) imzolash jarayoni to'xtab qolmasligi uchun vaqtinchalik Keychain yaratish va unga ruxsat berish skripti:

#!/bin/bash
set -euo pipefail

KEYCHAIN_PATH="$HOME/Library/Keychains/temp-build.keychain-db"
KEYCHAIN_PWD="temporary_ci_password"

# 1. Vaqtinchalik yangi keychain yaratish:
security create-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"

# 2. Sertifikatni (.p12) keychain'ga yuklash:
# P12_CERT_BASE64 va P12_PASSWORD env o'zgaruvchilari orqali uzatiladi
echo "$P12_CERT_BASE64" | base64 --decode > /tmp/certificate.p12
security import /tmp/certificate.p12 -k "$KEYCHAIN_PATH" -P "$P12_PASSWORD" -T /usr/bin/codesign

# 3. macOS GUI dialogi (UI pop-up) chiqmasligi uchun partition list berish:
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"

echo "Keychain muvaffaqiyatli sozlandi!"

Build tugagach (yoki xato bilan to'xtasa ham) tozalash scripti ishga tushadi:

# Build yakunida keychain'ni o'chirish:
security delete-keychain "$HOME/Library/Keychains/temp-build.keychain-db" || true
rm -f /tmp/certificate.p12

3. Gitleaks va Secret Detection: Maxfiy kalitlar sizishini oldini olish {#gitleaks}

Maxfiy tokenlar (AWS keys, Telegram Bot Token, API Keys) Git tarixiga tushib qolsa, butun infratuzilma xavf ostida qoladi. CI pipeline darajasida Gitleaks vositasini majburiy darvoza (gate) qilish:

name: Secret Scanning Gate

on: [push, pull_request]

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks orqali kodni tekshirish
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

4. Runtime Secrets: xcconfig va Build Flags {#secrets-xcconfig}

Maxfiy kalitlarni Swift kodi ichida qattiq yozish (hardcode) taqiqlanadi. Professional yondashuv — .xcconfig va Info.plist:

`Secrets.xcconfig` (Git'ga qo'shilmaydi, `.gitignore` da turadi):

BACKEND_BASE_URL = https:\/\/api.azimjondev.uz
ANALYTICS_KEY = secret_live_key_abcdef12345

Swift'da xavfsiz o'qish:

import Foundation

public enum EnvironmentConfig {
  public static var baseURL: URL {
    guard let urlString = Bundle.main.infoDictionary?["BackendURL"] as? String,
          let url = URL(string: urlString) else {
      fatalError("BackendURL sozlanmagan")
    }
    return url
  }
}

5. Apple Privacy Manifest (`PrivacyInfo.xcprivacy`) tekshiruvi {#privacy-manifests}

Apple barcha ilovalar va SDK'lar uchun Privacy Manifest faylini majburiy qilgan. Agar ilova "Required Reason API" (masalan, UserDefaults yoki Disk Space) ishlatsa, uning sababi PrivacyInfo.xcprivacy da ko'rsatilishi shart:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyCollectedDataTypes</key>
  <array/>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>CA92.1</string>
      </array>
    </dict>
  </array>
</dict>
</plist>

CI pipeline'da ushbu faylning mavjudligi plutil -lint PrivacyInfo.xcprivacy orqali tekshirilishi kerak.

6. DeviceCheck va App Attest: API himoyasi {#app-attest}

Serveringizga kelayotgan so'rovlar haqiqiy, buzilmagan (jailbroken yoki soxtalashtirilmagan) ilovadan kelayotganini tekshirish uchun DCAppAttestService ishlatiladi:

import DeviceCheck
import Foundation

public final class AppIntegrityService: Sendable {
  public static let shared = AppIntegrityService()

  public func generateAttestationKey() async throws -> String {
    let service = DCAppAttestService.shared

    guard service.isSupported else {
      throw NSError(domain: "AppAttest", code: 1, userInfo: [NSLocalizedDescriptionKey: "Qurilmada qo'llab-quvvatlanmaydi"])
    }

    // Secure Enclave ichida noyob kriptografik kalit yaratish:
    let keyId = try await service.generateKey()
    return keyId
  }
}

Ushbu kalit orqali server har bir API so'rovini tekshiradi va botlar yoki soxta dasturlar serverga yuklama berishining oldi olinadi.

7. Xulosa {#xulosa}

CI Keychain to'g'ri izolyatsiya qilingan holda vaqtinchalik yaratilishi va build so'ngida tozalanishi shart.
Gitleaks maxfiy ma'lumotlar ommaga chiqib ketishidan saqlovchi birinchi darvoza hisoblanadi.
Privacy Manifest App Store tekshiruvidan muvaffaqiyatli o'tish uchun majburiy audit talabi sanaladi.

DevOps 6: Xavfsizlik, Secret Management va Code Signing — Keychain, App Attest va Privacy Manifests