{-# LANGUAGE ExtendedDefaultRules #-} {-# LANGUAGE OverloadedStrings #-} {-# OPTIONS_GHC -fno-warn-type-defaults #-} {- |This module provides different functions to sign a Passbook 'Pass'. /Please read the documentation!/ One set of functions uses the @signpass@ tool included in Apple's Passbook Support Materials to sign the pass. This uses the system keychain directly, but works on OS X only. The other set of functions uses OpenSSL instead, in this case you need to export your certificate using the process described in the OpenSSL section of this document. If you want to use this module with an existing .pkpass file, you can import it using the function 'loadPass'. Please note that you still need to provide the assets in a separate directory, 'loadPass' only parses the @pass.json@ file. Using these function is very simple, assuming you have created a 'Pass' called @myPass@ and you have the related assets (e.g. the logo.png and icon.png files) stored in a folder named @myPass/@. You want the signed pass to be stored in a folder called @passes/@. You call 'signpass' like this: > (path, passId) <- signpass "myPass" "passes" myPass You will find the pass at @path@ with the filename @passId.pkpass@. Using the types from "Passbook.Types" ensures that passes are generated correctly. Please note that an @icon.png@ file /must be/ present in your asset folder, otherwise the generated pass will not work. This is /not/ checked by this module. Refer to Apple's Passbook documentation at <https://developer.apple.com/passbook/> for more information or to retrieve the @signpass@ tool which is included in the Passbook Support Materials. (iOS Developer Membership necessary) -} module Passbook ( -- * Sign using signpass -- $signpass signpass , signpassWithId , signpassWithModifier -- * Sign using OpenSSL -- $openssl , signOpen , signOpenWithModifier , signOpenWithId -- * Helper functions , genPassId , updateBarcode , loadPass , module Passbook.Types ) where import Codec.Archive.Zip import Control.Monad (liftM) import Control.Monad.IO.Class (liftIO) import Data.Aeson import qualified Data.ByteString.Lazy as LB import Data.Conduit import Data.Conduit.Binary hiding (sinkFile) import Data.Conduit.Filesystem import qualified Data.Text as ST import Data.Text.Lazy (Text) import qualified Data.Text.Lazy as LT import Data.UUID import Filesystem.Path (filename) import Filesystem.Path.CurrentOS (encodeString) import Passbook.Types import Prelude hiding (FilePath) import Shelly import System.Directory (doesFileExist) import System.Random default (LT.Text) -- $signpass -- These functions sign a 'Pass' using the @signpass@ tool provided by Apple in the -- Passbook Support Materials. You can find those at <https://developer.apple.com/passbook/> -- however, an iOS Developer Membership is necessary for the download. -- -- The signpass utility needs access to your keychain. OS X will prompt you for this the first -- time you run the tool. -- -- Please make sure that the @signpass@ tool is within your $PATH. These functions work on OS X -- only. -- |Takes the filepaths to the folder containing the path assets -- and the output folder, a 'Pass' and uses a random UUID to -- create and sign the pass. -- -- /Important:/ OS X only! signpass :: FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output file path -> Pass -- ^ The pass to sign -> IO (FilePath, ST.Text) -- ^ The filepath of the signed .pkpass and its UUID signpass passIn passOut pass = do passId <- genPassId passPath <- signpassWithId passId passIn passOut pass return (passPath, passId) -- |Works like 'signpass', except for the fourth argument which is a -- modifier function that updates the pass with the generated UUID. -- This is useful for cases where you want to store the UUID in the barcode -- or some other field on the pass as well. -- -- An example function for use with this is 'updateBarcode'. -- -- /Important:/ OS X only! signpassWithModifier :: FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output file path -> Pass -- ^ The pass to sign -> (ST.Text -> Pass -> Pass) -- ^ Modifier function -> IO (FilePath, ST.Text) -- ^ The filepath of the signed .pkpass and its UUID signpassWithModifier passIn passOut pass modifier = do passId <- genPassId passPath <- signpassWithId passId passIn passOut $ modifier passId pass return (passPath, passId) -- |Updates the barcode in a pass with the UUID. This can be passed to 'signpassWithModifier' -- or 'signOpenWithModifier'. updateBarcode :: ST.Text -> Pass -> Pass updateBarcode n p = case barcode p of Nothing -> p -- This pass has no barcode. Just ob -> p { barcode = Just ob { altText = Just n , message = n } } -- |Signs the 'Pass' using the provided ID, no random UUID generation happens here. -- -- /Important:/ OS X only! signpassWithId :: ST.Text -- ^ The pass ID -> FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output file path -> Pass -- ^ The pass to sign -> IO FilePath signpassWithId passId passIn passOut pass = shelly $ do let tmp = passOut </> passId lazyId = LT.fromStrict passId cp_r passIn tmp liftIO $ renderPass (tmp </> "pass.json") pass { serialNumber = passId } signcmd lazyId tmp passOut rm_rf tmp return (passOut </> LT.append lazyId ".pkpass") -- |Helper function to generate a hash genHash :: FilePath -> Sh (Text, Text) genHash file = do rawhash <- run "openssl" ["sha1", toTextIgnore file] let hash = LT.drop 1 $ LT.dropWhile (/= ' ') rawhash return (toTextIgnore $ filename file, LT.filter (/= '\n') hash) -- |Render JSON and put it in a file saveJSON :: ToJSON a => a -> FilePath -> IO () saveJSON json path = LB.writeFile (LT.unpack $ toTextIgnore path) $ encode json -- |Helper function to sign the manifest sslSign :: FilePath -- ^ Certificate -> FilePath -- ^ Key -> FilePath -- ^ Temporary directory containing manifest.json -> Sh Text sslSign cert key tmp = run "openssl" [ "smime", "-binary" , "-sign" , "-signer", toTextIgnore cert , "-inkey" , toTextIgnore key , "-in", "manifest.json" , "-out", "signature" , "-outform", "DER" ] -- $openssl -- These functions sign a 'Pass' using OpenSSL. They work on operating systems -- other than OS X as well. To use these you need to export your certificate -- from the keychain. Assuming you have saved the certificatea as @cert.p12@ -- , the conversion works like this: -- -- > $ openssl pkcs12 -in cert.p12 -clcerts -nokeys -out certificate.pem -- > $ openssl pkcs12 -in cert.p12 -nocerts -out keypw.pem -- -- Enter a password for your key file, you will only need this once in the next step. -- Then strip the password from your key file using: -- -- > $ openssl rsa -in keypw.pem -out key.pem -- -- /Important:/ All paths passed to these functions /must/ be absolute. -- |Takes the filepaths to the folder containing the path assets -- and the output folder, the paths to the certificate and the key, -- a 'Pass' and uses a random UUID to create and sign the pass. signOpen :: FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output folder -> FilePath -- ^ Certificate -> FilePath -- ^ Certificate key -> Pass -- ^ The pass to sign -> IO (FilePath, ST.Text) -- ^ The signed .pkpass file and ID signOpen passIn passOut cert key pass = do passId <- genPassId passPath <- signOpenWithId passIn passOut cert key pass passId return (passPath, passId) -- |Works like 'signOpen', except for the fourth argument which is a -- modifier function that updates the pass with the generated UUID. -- This is useful for cases where you want to store the UUID in the barcode -- or some other field on the pass as well. -- -- An example function for use with this is 'updateBarcode'. signOpenWithModifier :: FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output folder -> FilePath -- ^ Certificate -> FilePath -- ^ Certificate key -> Pass -- ^ The pass to sign -> (ST.Text -> Pass -> Pass) -- ^ Modifier function -> IO (FilePath, ST.Text) -- ^ The signed .pkpass file and ID signOpenWithModifier passIn passOut cert key pass f = do passId <- genPassId passPath <- signOpenWithId passIn passOut cert key (f passId pass) passId return (passPath, passId) -- |Signs the 'Pass' using the provided ID, no random UUID generation happens here. signOpenWithId :: FilePath -- ^ Input file path (asset directory) -> FilePath -- ^ Output folder -> FilePath -- ^ Certificate -> FilePath -- ^ Certificate key -> Pass -- ^ The pass to sign -> ST.Text -- ^ The pass ID -> IO FilePath -- ^ The signed .pkpass file signOpenWithId passIn passOut cert key pass passId = shelly $ silently $ do let tmp = passOut </> passId passFile = LT.append (LT.fromStrict $ passId) ".pkpass" cp_r passIn tmp liftIO $ renderPass (tmp </> "pass.json") (pass { serialNumber = passId }) cd tmp manifest <- liftM Manifest $ pwd >>= ls >>= mapM genHash liftIO $ saveJSON manifest (tmp </> "manifest.json") sslSign cert key tmp files <- liftM (map (toTextIgnore . filename)) $ ls =<< pwd run "zip" ((toTextIgnore $ passOut </> passFile) : files) rm_rf tmp return (passOut </> passFile) -- |Generates a random UUID for a Pass using "Data.UUID" and "System.Random" genPassId :: IO ST.Text genPassId = liftM (ST.pack . toString) randomIO -- |Render and store a pass.json at the desired location. renderPass :: FilePath -> Pass -> IO () renderPass path pass = let rendered = sourceLbs $ encode pass in runResourceT $ rendered $$ sinkFile path -- |Call the signpass tool. signcmd :: Text -- ^ The pass identifier / serial number to uniquely identify the pass -> FilePath -- ^ The temporary asset folder. -> FilePath -- ^ The output folder for all .pkpass files -> Sh () signcmd uuid assetFolder passOut = run_ "signpass" [ "-p", toTextIgnore assetFolder -- The input folder , "-o", toTextIgnore $ passOut </> LT.append uuid ".pkpass" ] -- Name of the output file -- |Tries to parse the pass.json file contained in a .pkpass into a valid -- 'Pass'. If Passbook accepts the .pkpass file, this function should never -- return @Nothing@. loadPass :: FilePath -- ^ Location of the .pkpass file -> IO (Maybe Pass) loadPass path = do archive <- liftM toArchive $ LB.readFile $ encodeString path case findEntryByPath "pass.json" archive of Nothing -> return Nothing Just pass -> return $ decode $ fromEntry pass