# DevOps 6: Xavfsizlik, Secret Management va Code Signing — Keychain, App Attest va Privacy Manifests

> **Holat:** 2026-yil sentabr. iOS ilovalarini avtomatlashtirilgan CI/CD tizimlarida yig'ishda eng ko'p boshog'riq keltiradigan soha — bu **Code Signing (kodni imzolash)** va **maxfiy kalitlarni (Secret Management) xavfsiz boshqarishdir**. Ushbu darsda Apple kriptografik imzolash tizimining ichki tuzilishi, CI Keychain yaratish, App Attest va Privacy Manifest qoidalariga rioya qilish bo'yicha to'liq qo'llanma beriladi.

## Mundarija

1. [Apple Code Signing arxitekturasi: Sertifikat, Key va Provisioning Profile](#signing-arxitektura)
2. [CI'da Keychain bilan ishlash: Parolsiz imzolash](#ci-keychain)
3. [Gitleaks va Secret Detection: Maxfiy kalitlar sizishini oldini olish](#gitleaks)
4. [Runtime Secrets: xcconfig va Build Flags](#secrets-xcconfig)
5. [Apple Privacy Manifest (`PrivacyInfo.xcprivacy`) tekshiruvi](#privacy-manifests)
6. [DeviceCheck va App Attest: API himoyasi](#app-attest)
7. [Xulosa](#xulosa)
8. [Manbalar](#manbalar)

---

## 1. Apple Code Signing arxitekturasi: Sertifikat, Key va Provisioning Profile {#signing-arxitektura}

iOS tizimida imzolash 3 ta asosiy kriptografik ob'ektga tayanadi:

```text
Private Key (Maxfiy kalit) ──┐
                             ├─► Code Signing (codesign) ──► Imzolangan .app
Apple CA Sertifikati ────────┘                                      │
                                                                    ▼
Provisioning Profile (Entitlements + Ruxsat etilgan qurilmalar) ────┘ (iOS Kernel tekshiradi)
```

1. **Private Key (Maxfiy kalit):** Sizning shaxsiy kalitingiz (hech qachon ochiqqa chiqmasligi shart, faqat `.p12` faylda parol bilan saqlanadi).
2. **Developer Certificate (Sertifikat):** Apple Developer CA tomonidan imzolangan ommaviy kalit.
3. **Provisioning Profile (`embedded.mobileprovision`):** Apple tomonidan kriptografik imzolangan XML plist fayli. U o'z ichida:
   - Ilovaning Bundle ID'sini;
   - Ushbu profilga ruxsat berilgan ishlab chiquvchilar sertifikatlarini;
   - Ad-Hoc / Development uchun ruxsat berilgan qurilmalar UDID ro'yxatini;
   - Entitlements (Push Notifications, Associated Domains, App Groups)ni saqlaydi.

---

## 2. CI'da Keychain bilan ishlash: Parolsiz imzolash {#ci-keychain}

Headless (ekransiz) CI serverlarda (GitHub Actions yoki Mac mini) imzolash jarayoni to'xtab qolmasligi uchun vaqtinchalik Keychain yaratish va unga ruxsat berish skripti:

```bash
#!/bin/bash
set -euo pipefail

KEYCHAIN_PATH="$HOME/Library/Keychains/temp-build.keychain-db"
KEYCHAIN_PWD="temporary_ci_password"

# 1. Vaqtinchalik yangi keychain yaratish:
security create-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"

# 2. Sertifikatni (.p12) keychain'ga yuklash:
# P12_CERT_BASE64 va P12_PASSWORD env o'zgaruvchilari orqali uzatiladi
echo "$P12_CERT_BASE64" | base64 --decode > /tmp/certificate.p12
security import /tmp/certificate.p12 -k "$KEYCHAIN_PATH" -P "$P12_PASSWORD" -T /usr/bin/codesign

# 3. macOS GUI dialogi (UI pop-up) chiqmasligi uchun partition list berish:
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" "$KEYCHAIN_PATH"

echo "Keychain muvaffaqiyatli sozlandi!"
```

Build tugagach (yoki xato bilan to'xtasa ham) tozalash scripti ishga tushadi:

```bash
# Build yakunida keychain'ni o'chirish:
security delete-keychain "$HOME/Library/Keychains/temp-build.keychain-db" || true
rm -f /tmp/certificate.p12
```

---

## 3. Gitleaks va Secret Detection: Maxfiy kalitlar sizishini oldini olish {#gitleaks}

Maxfiy tokenlar (AWS keys, Telegram Bot Token, API Keys) Git tarixiga tushib qolsa, butun infratuzilma xavf ostida qoladi. CI pipeline darajasida **Gitleaks** vositasini majburiy darvoza (gate) qilish:

```yaml
name: Secret Scanning Gate

on: [push, pull_request]

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks orqali kodni tekshirish
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

---

## 4. Runtime Secrets: xcconfig va Build Flags {#secrets-xcconfig}

Maxfiy kalitlarni Swift kodi ichida qattiq yozish (`hardcode`) taqiqlanadi. Professional yondashuv — `.xcconfig` va `Info.plist`:

### `Secrets.xcconfig` (Git'ga qo'shilmaydi, `.gitignore` da turadi):
```text
BACKEND_BASE_URL = https:\/\/api.azimjondev.uz
ANALYTICS_KEY = secret_live_key_abcdef12345
```

### Swift'da xavfsiz o'qish:
```swift
import Foundation

public enum EnvironmentConfig {
  public static var baseURL: URL {
    guard let urlString = Bundle.main.infoDictionary?["BackendURL"] as? String,
          let url = URL(string: urlString) else {
      fatalError("BackendURL sozlanmagan")
    }
    return url
  }
}
```

---

## 5. Apple Privacy Manifest (`PrivacyInfo.xcprivacy`) tekshiruvi {#privacy-manifests}

Apple barcha ilovalar va SDK'lar uchun **Privacy Manifest** faylini majburiy qilgan. Agar ilova "Required Reason API" (masalan, UserDefaults yoki Disk Space) ishlatsa, uning sababi `PrivacyInfo.xcprivacy` da ko'rsatilishi shart:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyCollectedDataTypes</key>
  <array/>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>CA92.1</string>
      </array>
    </dict>
  </array>
</dict>
</plist>
```

CI pipeline'da ushbu faylning mavjudligi `plutil -lint PrivacyInfo.xcprivacy` orqali tekshirilishi kerak.

---

## 6. DeviceCheck va App Attest: API himoyasi {#app-attest}

Serveringizga kelayotgan so'rovlar haqiqiy, buzilmagan (jailbroken yoki soxtalashtirilmagan) ilovadan kelayotganini tekshirish uchun **DCAppAttestService** ishlatiladi:

```swift
import DeviceCheck
import Foundation

public final class AppIntegrityService: Sendable {
  public static let shared = AppIntegrityService()

  public func generateAttestationKey() async throws -> String {
    let service = DCAppAttestService.shared

    guard service.isSupported else {
      throw NSError(domain: "AppAttest", code: 1, userInfo: [NSLocalizedDescriptionKey: "Qurilmada qo'llab-quvvatlanmaydi"])
    }

    // Secure Enclave ichida noyob kriptografik kalit yaratish:
    let keyId = try await service.generateKey()
    return keyId
  }
}
```

Ushbu kalit orqali server har bir API so'rovini tekshiradi va botlar yoki soxta dasturlar serverga yuklama berishining oldi olinadi.

---

## 7. Xulosa {#xulosa}

- CI Keychain to'g'ri izolyatsiya qilingan holda vaqtinchalik yaratilishi va build so'ngida tozalanishi shart.
- Gitleaks maxfiy ma'lumotlar ommaga chiqib ketishidan saqlovchi birinchi darvoza hisoblanadi.
- Privacy Manifest App Store tekshiruvidan muvaffaqiyatli o'tish uchun majburiy audit talabi sanaladi.

---

## 8. Manbalar {#manbalar}

1. [Apple Developer — Code Signing Guide](https://developer.apple.com/support/code-signing/)
2. [Apple Developer — Describing data use with privacy manifests](https://developer.apple.com/documentation/bundleresources/privacy_manifest_files)
3. [Gitleaks Documentation](https://github.com/gitleaks/gitleaks)