From a1f2e225629fbae095cad61f0d44667c7eb889a9 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 19 May 2026 18:40:29 -0400
Subject: [PATCH] Add headerless-body and DER-wrap strategies to ASC key
 normalizer

The .p8 file from Apple has no PEM headers, just the raw base64
body. Add strategies for: headerless body wrapped with PEM headers,
base64-decoded DER re-wrapped as PEM, and double-decoded DER. Also
show hex bytes in diagnostics for better binary data analysis.
Secret has been re-set with properly PEM-wrapped + base64-encoded
content matching the reusable workflow's expected format.
---
 mobile/fastlane/Fastfile | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/mobile/fastlane/Fastfile b/mobile/fastlane/Fastfile
index f8f72a9..c281c3f 100644
--- a/mobile/fastlane/Fastfile
+++ b/mobile/fastlane/Fastfile
@@ -27,6 +27,12 @@ def normalize_p8_key(raw)
     candidates << ["rewrapped PEM", rewrapped]
   end
 
+  unless with_newlines.include?("BEGIN")
+    body = cleaned.strip.gsub(/\s+/, '')
+    pem = "-----BEGIN PRIVATE KEY-----\n#{body.scan(/.{1,64}/).join("\n")}\n-----END PRIVATE KEY-----\n"
+    candidates << ["headerless body → PEM", pem]
+  end
+
   begin
     decoded = Base64.decode64(cleaned.strip)
     if decoded.include?("BEGIN")
@@ -37,6 +43,8 @@ def normalize_p8_key(raw)
       candidates << ["base64→PEM rewrapped", rewrapped]
     elsif decoded.length.between?(32, 256)
       candidates << ["base64→DER", decoded]
+      der_pem = "-----BEGIN PRIVATE KEY-----\n#{Base64.strict_encode64(decoded).scan(/.{1,64}/).join("\n")}\n-----END PRIVATE KEY-----\n"
+      candidates << ["base64→DER→PEM", der_pem]
     end
   rescue StandardError
     # not valid base64
@@ -46,6 +54,9 @@ def normalize_p8_key(raw)
     double = Base64.decode64(Base64.decode64(cleaned.strip).strip)
     if double.include?("BEGIN")
       candidates << ["double-base64→PEM", double.gsub("\r", "")]
+    elsif double.length.between?(32, 256)
+      der_pem = "-----BEGIN PRIVATE KEY-----\n#{Base64.strict_encode64(double).scan(/.{1,64}/).join("\n")}\n-----END PRIVATE KEY-----\n"
+      candidates << ["double-base64→DER→PEM", der_pem]
     end
   rescue StandardError
     # not double-encoded
@@ -72,7 +83,8 @@ def normalize_p8_key(raw)
   UI.error("Header (first 27 chars): #{raw[0..26]}")
   begin
     d = Base64.decode64(raw.strip)
-    UI.error("After base64 decode — length: #{d.bytesize}, header: #{d[0..26]}")
+    hex = d.bytes[0..15].map { |b| format('%02x', b) }.join(' ')
+    UI.error("After base64 decode — length: #{d.bytesize}, first 16 bytes hex: #{hex}")
   rescue StandardError
     UI.error("base64 decode raised an exception")
   end