fix: signing fixes for TIX / Chimera(jbs.app) (#29)

* fix: ChimeraPatch(jbsapp) & TIX signing improperly

* chore: rename this lol

* fix(?): unc0ver drm from not triggering

* some cleanup

* fix(?): disable hidpi awareness on windows

issue is that wxdragon (framework im using) doesnt support converting `Size` object to DIP variations, so for now we can just disable this until it is supported.

Author: claration

README.md

@@ -1,7 +1,7 @@
 # PlumeImpactor
 
 [![GitHub Release](https://img.shields.io/github/v/release/khcrysalis/PlumeImpactor?include_prereleases)](https://github.com/khcrysalis/PlumeImpactor/releases)
-[![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/khcrysalis/PlumeImpactor/total)](https://github.com/khcrysalis/feather/releases)
+[![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/khcrysalis/PlumeImpactor/total)](https://github.com/khcrysalis/PlumeImpactor/releases)
 [![GitHub License](https://img.shields.io/github/license/khcrysalis/PlumeImpactor?color=%23C96FAD)](https://github.com/khcrysalis/PlumeImpactor/blob/main/LICENSE)
 [![Sponsor Me](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/khcrysalis)
 

apps/plumeimpactor/build.rs

@@ -19,7 +19,7 @@ fn embed_windows_manifest(name: &str) {
             .supported_os(Windows7..=Windows10)
             .active_code_page(ActiveCodePage::Utf8)
             .heap_type(embed_manifest::manifest::HeapType::SegmentHeap)
-            .dpi_awareness(embed_manifest::manifest::DpiAwareness::PerMonitorV2)
+            .dpi_awareness(embed_manifest::manifest::DpiAwareness::Unaware)
             .long_path_aware(Setting::Enabled);
 
         embed_manifest(manifest).unwrap();

crates/core/src/utils/provision.rs

@@ -83,6 +83,17 @@ impl MobileProvision {
             );
         }
 
+        // this is granted by default.
+        if let Some(Value::Array(groups)) = self.entitlements.get_mut("keychain-access-groups") {
+            groups.retain(|group| {
+                if let Value::String(s) = group {
+                    !s.starts_with("com.apple.token")
+                } else {
+                    true
+                }
+            });
+        }
+
         let new_team_id = self
             .entitlements
             .get("com.apple.developer.team-identifier")

crates/utils/src/bundle.rs

@@ -177,12 +177,27 @@ fn collect_embeded_bundles_from_dir(dir: &PathBuf) -> Result<Vec<Bundle>, Error>
             false
         }
     }
+    
+    fn is_dylib_file(name: &str) -> bool {
+        name.ends_with(".dylib")
+    }
 
     for entry in fs::read_dir(dir)? {
         let entry = entry.map_err(Error::Io)?;
         let path = entry.path();
 
         if let Some(name) = path.file_name().and_then(|n| n.to_str()) {
+            // Handle dylib files as bundles (even though they don't have Info.plist)
+            if path.is_file() && is_dylib_file(name) {
+                // Create a pseudo-bundle for dylib files
+                bundles.push(Bundle {
+                    dir: path,
+                    _type: BundleType::Dylib,
+                    info_plist_file: PathBuf::new(), // Empty for dylibs
+                });
+                continue;
+            }
+            
             if is_bundle_dir(name) {
                 if let Ok(bundle) = Bundle::new(&path) {
                     bundles.push(bundle.clone());
@@ -212,6 +227,7 @@ pub enum BundleType {
     App,
     AppExtension,
     Framework,
+    Dylib,
     Unknown
 }
 
@@ -221,7 +237,18 @@ impl BundleType {
             "app" => Some(BundleType::App),
             "appex" => Some(BundleType::AppExtension),
             "framework" => Some(BundleType::Framework),
+            "dylib" => Some(BundleType::Dylib),
             _ => Some(BundleType::Unknown),
         }
     }
+    
+    /// Returns true if this bundle type should be signed with entitlements
+    pub fn should_have_entitlements(&self) -> bool {
+        matches!(self, BundleType::App | BundleType::AppExtension)
+    }
+    
+    /// Returns true if this bundle type should be code signed
+    pub fn should_be_signed(&self) -> bool {
+        !matches!(self, BundleType::Unknown)
+    }
 }

crates/utils/src/signer.rs

@@ -54,7 +54,10 @@ impl Signer {
     }
 
     pub async fn modify_bundle(&mut self, bundle: &Bundle, team_id: &Option<String>) -> Result<(), Error> {
-        let bundles = bundle.collect_bundles_sorted()?;
+        let bundles = bundle.collect_bundles_sorted()?
+            .into_iter()
+            .filter(|b| b.bundle_type().should_have_entitlements())
+            .collect::<Vec<_>>();
 
         if let Some(new_name) = self.options.custom_name.as_ref() {
             bundle.set_name(new_name)?;
@@ -141,7 +144,10 @@ impl Signer {
         team_id: &String,
     ) -> Result<(), Error> {
 
-        let bundles = bundle.collect_bundles_sorted()?;
+        let bundles = bundle.collect_bundles_sorted()?
+            .into_iter()
+            .filter(|b| b.bundle_type().should_have_entitlements())
+            .collect::<Vec<_>>();
         let signer_settings = &self.options;
 
         let bundle_arc = Arc::new(bundle.clone());
@@ -241,6 +247,9 @@ impl Signer {
         certificate: Option<&CertificateIdentity>,
         provisioning_files: &[MobileProvision],
     ) -> Result<(), Error> {
+        if *bundle.bundle_type() == BundleType::Unknown {
+            return Ok(());
+        }
 
         let mut settings = Self::build_base_settings(certificate)?;
 
@@ -251,11 +260,9 @@ impl Signer {
 </plist>
 "#.to_string();
 
-        if 
-            (*bundle.bundle_type() == BundleType::AppExtension
-            || *bundle.bundle_type() == BundleType::App)
-            && !provisioning_files.is_empty()
-        {
+        // Only Apps and AppExtensions should have entitlements from provisioning profiles
+        // Dylibs, frameworks, and other components should be signed without entitlements
+        if bundle.bundle_type().should_have_entitlements() && !provisioning_files.is_empty() {
             let mut matched_prov = None;
 
             for prov in provisioning_files {
@@ -291,7 +298,6 @@ impl Signer {
         }
 
         settings.set_entitlements_xml(SettingsScope::Main, entitlements_xml)?;
-
         UnifiedSigner::new(settings).sign_path_in_place(bundle.bundle_dir())?;
 
         Ok(())