fix(cli/ios): produce App Store-ready IPA from dx bundle (closes #3817)

[mirkobozzetto]

Summary

Adds end-to-end App Store support to dx bundle --platform=ios --release. Closes #3817 (open since 2025-03-01, 6 reactions). A new opt-in --appstore flag switches signing to Apple Distribution; existing dev signing behavior is unchanged when the flag is absent.

Verified against a real app (FlowFlow, already shipping on TestFlight): xcrun altool --validate-app returns VERIFY SUCCEEDED with no errors.

Problem

dx bundle --platform=ios --release produces an .ipa Apple Transporter / altool rejects. The original report (#3817) shows Validation failed (409) Incorrect Platform, but full validation surfaces a chain of related gaps:

• Info.plist is missing the DT* / MinimumOSVersion / CFBundlePackageType keys Apple injects from the Xcode toolchain
• CFBundleSupportedPlatforms ships as [iPhoneOS, iPadOS] (Apple requires a single value)
• UILaunchStoryboardName=LaunchScreen references a storyboard the build never produces (Apple rejects iPad-supporting bundles for this)
• Codesigning auto-detects "Apple Development" only — App Store needs "Apple Distribution"
• Provisioning profile auto-discovery picks any matching profile, including dev profiles tied to specific devices
• Generated entitlements always include get-task-allow=true (Apple ITMS rejects on App Store upload)
• Nested .appex extensions under PlugIns/ ship unsigned (or with stale dev certs)
• AppIcon.xcassets is never compiled — Apple rejects bundles missing the 120x120 iPhone icon
• PrivacyInfo.xcprivacy is never copied into the bundle (required since 2024)
• Widget Info.plists are missing version parity, DT*, supported platforms, and required device capabilities

The bash workaround most users land on (e.g. FlowFlow's Makefile) reproduces this exact chain — this PR upstreams it.

Changes

Three commits, ordered so each compiles standalone:

1. fix(cli/ios): modernize Info.plist defaults for App Store compliance — template-only changes. ITSAppUsesNonExemptEncryption=false, modern UILaunchScreen dict (iOS 14+), single iPhoneOS in CFBundleSupportedPlatforms, handlebars {{#if}} slots for the DT* values the next commit populates.

2. feat(cli/ios): probe Xcode toolchain to populate Info.plist DT* metadata — adds IosDtMetadata + collect_ios_dt_metadata (xcrun / defaults / sw_vers probes). Best-effort: empty fields are dropped by the template guards, so machines without a full Xcode install still produce a .app. MinimumOSVersion reads from Dioxus.toml's [ios].deployment_target (default 15.0).

3. feat(cli/ios): produce App Store-ready IPA via --appstore flag (closes #3817) — adds the --appstore clap flag (packages/cli/src/cli/target.rs) and wires it through BuildRequest. When set: cert pattern switches to Apple Distribution, profile auto-discovery filters out profiles with ProvisionedDevices, generated entitlements use get-task-allow=false, and should_codesign is forced on. Independently of the flag (every iOS bundle benefits), iOS pre-sign now:

   • signs every PlugIns/*.appex inside-out with its own provisioning profile,
   • compiles AppIcon.xcassets at the crate root via xcrun actool and merges the partial Info.plist back into the main one,
   • copies ios/PrivacyInfo.xcprivacy into the .app if present,
   • patches each .appex Info.plist with the DT*, version strings (CFBundleVersion + CFBundleShortVersionString parity), LSRequiresIPhoneOS, CFBundleSupportedPlatforms=[iPhoneOS], and UIRequiredDeviceCapabilities=[arm64] the main bundle carries.

Default behavior (no flag, no widget, no xcassets, no PrivacyInfo) is identical to today's CLI — every new code path is gated behind feature detection or the explicit flag.

Proof

End-to-end validation against FlowFlow, using xcrun altool --validate-app against Apple's server-side validator:

$ xcrun altool --validate-app \
  -f target/dx/flowflow/bundle/ios/ipa/Flowflow_0.1.0_aarch64.ipa \
  -t ios -u <apple-id> -p <app-spec-password> --output-format json
...
==========================================
VERIFY SUCCEEDED with no errors
==========================================
{
  "success-message": "No errors validating archive at '.../Flowflow_0.1.0_aarch64.ipa'",
  "os-version": "Version 26.5 (Build 25F71)",
  "tool-version": "26.30.4 (173004)"
}

The bundle Apple validated contains a Live Activity widget extension (recording_widget.appex), background audio mode, and PrivacyInfo.xcprivacy — i.e. all the non-trivial App Store features the PR touches.

Out of scope

These keep the PR focused; happy to follow up:

• CFBundleVersion auto-bump strategy (compile-time / Cargo.toml / external counter)
• Macros / config for AppIcon catalog generation from a single PNG
• TestFlight-only signing variant (e.g. Ad-Hoc profiles)

Test plan

• cargo build -p dioxus-cli clean
• cargo fmt -p dioxus-cli --check clean
• cargo clippy -p dioxus-cli --no-deps no findings
• dx bundle --platform=ios --release without --appstore: behavior unchanged (dev signing, no Apple Distribution lookup, get-task-allow stays true)
• dx bundle --platform=ios --release --appstore: produces IPA Apple altool accepts (see Proof)
• App with no widget / no xcassets / no PrivacyInfo: all new code paths no-op cleanly