Fix first launch and package hook as a signed framework

source/build_app.sh

@@ -25,6 +25,7 @@ OUT_DIR=${OUT_DIR:-"$ROOT/out"}
 BUNDLE_ID=${BUNDLE_ID:-com.jbjf.appsmanager}
 DYLIB="$ROOT/hook/AppsManagerHook.dylib"
 APP="$OUT_DIR/AppsManager.app"
+FRAMEWORK="$APP/Frameworks/AppsManagerHook.framework"
 
 if [ ! -f "$DYLIB" ]; then
   echo "Missing $DYLIB; run build_dylib.sh first." >&2
@@ -42,17 +43,55 @@ fi
 rm -rf "$APP"
 mkdir -p "$OUT_DIR"
 cp -R "$APP_SOURCE" "$APP"
-cp "$DYLIB" "$APP/AppsManagerHook.dylib"
+mkdir -p "$FRAMEWORK"
+cp "$DYLIB" "$FRAMEWORK/AppsManagerHook"
 cp "$PROVISION" "$APP/embedded.mobileprovision"
 
 plutil -replace CFBundleIdentifier -string "$BUNDLE_ID" "$APP/Info.plist"
 plutil -replace CFBundleDisplayName -string "Apps Manager" "$APP/Info.plist"
 plutil -replace CFBundleName -string "AppsManager" "$APP/Info.plist"
 
+cat > "$FRAMEWORK/Info.plist" <<'EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleDevelopmentRegion</key>
+    <string>en</string>
+    <key>CFBundleExecutable</key>
+    <string>AppsManagerHook</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.jbjf.appsmanager.hook</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>AppsManagerHook</string>
+    <key>CFBundlePackageType</key>
+    <string>FMWK</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0</string>
+    <key>CFBundleVersion</key>
+    <string>1</string>
+    <key>MinimumOSVersion</key>
+    <string>15.0</string>
+    <key>CFBundleSupportedPlatforms</key>
+    <array>
+        <string>iPhoneOS</string>
+    </array>
+</dict>
+</plist>
+EOF
+
+# Keep the hook in Frameworks so standard signing tools treat it as nested
+# code and re-sign it together with the app.
+install_name_tool -id "@rpath/AppsManagerHook.framework/AppsManagerHook" "$FRAMEWORK/AppsManagerHook"
 cp "$APP/ADManager" "$APP/ADManager.orig"
 "$INSERT_DYLIB" --inplace --overwrite --strip-codesig --all-yes \
-  "@executable_path/AppsManagerHook.dylib" "$APP/ADManager"
+  "@rpath/AppsManagerHook.framework/AppsManagerHook" "$APP/ADManager"
 rm -f "$APP/ADManager.orig"
+if ! otool -l "$APP/ADManager" | grep -q "@executable_path/Frameworks"; then
+  install_name_tool -add_rpath "@executable_path/Frameworks" "$APP/ADManager"
+fi
 
 set -- -f -s "$SIGN_IDENTITY"
 if [ -n "$KEYCHAIN" ]; then
@@ -62,8 +101,9 @@ if [ -n "$ENTITLEMENTS" ]; then
   set -- "$@" --entitlements "$ENTITLEMENTS" --generate-entitlement-der
 fi
 
-codesign "$@" "$APP/AppsManagerHook.dylib"
+codesign "$@" "$FRAMEWORK"
 codesign "$@" "$APP"
 
 echo "built $APP"
 otool -L "$APP/ADManager" | head -8
+otool -l "$APP/ADManager" | grep -A2 LC_RPATH | head -6