How do I trust a swift macro target for Xcode Cloud builds?

Question

I just added my first Xcode 15, Swift 5.9 macro from an open source package that I'm referencing via Swift Package Manager. The first time I compiled locally, I had to trust the macro's package via a dialog box, which is fine for a local build. However, now my app doesn't build on Xcode Cloud, with the error "Target must be enabled before it can be used."

How do I tell Xcode Cloud to trust the macro's target?

Erotic

Answer 1

The suggestion provided by slavikus does work, but it poses a security risk because it enables any macro, allowing for the inclusion of malicious code in your Xcode build.

A safer approach could be to inform Xcode Cloud about the Macros you have explicitly enabled in your project, which are stored at ~/Library/org.swift.swiftpm/security/macros.json, by creating a post-clone script that copies this file into an internal location within Xcode Cloud.

Here are the steps to implement this solution:

1. Create a folder called ci_scripts in your project's root directory.
2. In this folder, create a script named ci_post_clone.sh with the following content:

#!/bin/zsh 

mkdir -p ~/Library/org.swift.swiftpm/security/
cp macros.json ~/Library/org.swift.swiftpm/security/

3. Copy file ~/Library/org.swift.swiftpm/security/macros.json into the same folder.

This script will be executed after your project is cloned from the repo and before Xcode Cloud starts building the project.

For more details about writing custom scripts to enhance Xcode Cloud workflows: https://developer.apple.com/documentation/xcode/writing-custom-build-scripts

Apyretic

I did this but on Xcode Cloud am getting Running ci_post_clone.sh script failed (exited with code 1). macros.json is in ci_scripts folder - any idea? – Swamy

That might be due to the ~/Library/org.swift.swiftpm/security/ folder has not been created. Adding mkdir -p ~/Library/org.swift.swiftpm/security/ to the script might solve the issue. – Apyretic

I've updated my post with the command to create the folder. – Apyretic

In my case, I had updated some of my macros since they were enabled. This meant the fingerprints were outdated in macros.json, in turn meaning Xcode Cloud was still unable to build my project despite having the above script. Since I'm using SPM, to resolve this I went through each package used in my Package.resolved file and copy over its corresponding SHA to my macros.json file - after doing this, my build passed. I'm sure there's a way this could be automated though! – Knuckle

Answer 2

I ran into same problem, and quickly discovered an additional defaults key that bypasses macro validation (same as -skipMacroValidation xcodebuild command line option):

defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES

Kavita

This should be put in the ci_post_clone.sh file – Erotic

Hello, Can you explain step by step? how can I do this way? – Layout

@Layout To create the ci_scripts directory: Open your project or workspace in Xcode and navigate to the Project navigator. In the Project navigator, Control-click your project and choose New Group to create the group and its corresponding directory. Name the new group ci_scripts. Then create a shell script, named ci_post_clone, input the above command in it. developer.apple.com/documentation/xcode/… – Conditioning

Answer 3

I stumbled across this question after my Bitrise (not Xcode cloud) builds started failing when I integrated Swiftlint via SPM.

The solution for me was to add the following as a Script step in Bitrise:

defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidatation -bool YES

The following didn't work:

• adding -skipMacroValidation to the xcodebuild command
• setting the IDESkipMacroFingerprintValidation key

So I wonder if something has changed since the other answers were posted.

Also: IDESkipPackagePluginFingerprintValidatation is not a typo. I suspect this may be fixed at some point 😅

Elinaelinor