Difference between Xcode and git for resolving swift packages - swift

Question

So the background is this: I have an Xcode project that depends on a swift package that's in a private repository on github. Of course, this requires a key to access. So far, I've managed to configure CI such that I can ssh into the instance and git clone the required repository for the swift package. Unfortunately when running it with xcbuild as CI does, it doesn't work and I get this message:
static:ios distiller$ xcodebuild -showBuildSettings -workspace ./Project.xcworkspace \
-scheme App\ Prod
Resolve Package Graph
Fetching git#github.com:company-uk/ProjectDependency.git
xcodebuild: error: Could not resolve package dependencies:
Authentication failed because the credentials were rejected
In contrast, git clone will happily fetch this repo as seen here:
static:ios distiller$ git clone git#github.com:company-uk/ProjectDependency.git
Cloning into 'ProjectDependency'...
Warning: Permanently added the RSA host key for IP address '11.22.33.44' to the list of known hosts.
remote: Enumerating objects: 263, done.
remote: Counting objects: 100% (263/263), done.
remote: Compressing objects: 100% (171/171), done.
remote: Total 1335 (delta 165), reused 174 (delta 86), pack-reused 1072
Receiving objects: 100% (1335/1335), 1.11 MiB | 5.67 MiB/s, done.
Resolving deltas: 100% (681/681), done.
For a bit more context, this is running on CircleCI, set up with a Deploy key on GitHub, which has been added to the Job on CI.
Any suggestions about what might be different between the way Xcode tries to fetch dependencies and the way vanilla git does it would be great. Thanks.

Answer 1

For CI pipelines where you cannot sign into GitHub or other repository hosts this is the solution I found that bypasses the restrictions/bugs of Xcode around private Swift packages.
Use https urls for the private dependencies because the ssh config is currently ignored by xcodebuild even though the documentation says otherwise.
Once you can build locally with https go to your repository host and create a personal access token (PAT). For GitHub instructions are found here.
With your CI system add this PAT as a secret environment variable. In the script below it is referred to as GITHUB_PAT.
Then in your CI pipeline before you run xcodebuild make sure you run an appropriately modified version of this bash script:
for FILE in $(grep -Ril "https://github.com/[org_name]" .); do
sed -i '' "s/https:\/\/github.com\/[org_name]/https:\/\/${GITHUB_PAT}#github.com\/[org_name]/g" ${FILE}
done
This script will find all https references and inject the PAT into it so it can be used without a password.
Don't forget:
Replace [org_name] with your organization name.
Replace ${GITHUB_PAT} with the name of your CI Secret if you named it differently.
Configure the grep command to ignore any paths you don't want modified by the script.

Answer 2

This seems to be a bug in Xcode 11 with SSH. Switching to HTTPS for resolving Swift Packages fixes the issue:
So from this:
E29801192303068A00018344 /* XCRemoteSwiftPackageReference "ProjectDependency" */ = {
isa = XCRemoteSwiftPackageReference;
repositoryURL = "git#github.com:company-uk/ProjectDependency.git";
requirement = {
branch = "debug";
kind = branch;
};
};
to:
E29801192303068A00018344 /* XCRemoteSwiftPackageReference "ProjectDependency" */ = {
isa = XCRemoteSwiftPackageReference;
repositoryURL = "https://github.com/company-uk/ProjectDependency.git";
requirement = {
branch = "debug";
kind = branch;
};
};
Also, now that Xcode 12 is out, you can use that, where it's fixed.

Answer 3

In order to get private swift packages working with GitHub actions I had to add the following:
I had to add an SSH key to my secrets
On the xcodebuild step, I had to add the flag: -usePackageSupportBuiltinSCM
right before executing the xcodebuild step, I had to add the following run script:
- name: Add CI SSH Key
run: ssh-add - <<< "${{ secrets.YOUR_SECRET_SSH_KEY }}"

Answer 4

You can resolve this issue in a CI environment with Xcode 12 by adding your GitHub account to Accounts within Xcode.
Sign in with your GitHub account name and a personal access token you created on Github.
We are using Jenkins with Fastlane tools and when xcodebuild is invoked, it will use the access token to authenticate into the repos using HTTPS.

Answer 5

I had the same issue, the root cause for me is: the default github ssh key type is ed25519 ssh-keygen -t ed25519 -C "your_email#example.com".
But XCode doesn't support ed25519. Changed to RSA key works: ssh-keygen -t rsa -b 4096 -C "your_email#example.com"
https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
You can see the error under XCode Preference > Accounts > Github

Answer 6

I was able to build with a package from a private repo in GitHub actions with HTTPS URLs by creating a .netrc file using the extractions/netrc#v1 action.
Build:
runs-on: macos-12
steps:
- uses: actions/checkout#v3
- uses: extractions/netrc#v1
with:
machine: github.com
username: user
password: ${{ secrets.SWIFT_PACKAGE_MANAGER_PAT }}
- uses: extractions/netrc#v1
with:
machine: api.github.com
username: user
password: ${{ secrets.SWIFT_PACKAGE_MANAGER_PAT }}
After this, xcodebuild will use the PAT when accessing the private repo.
I tried to use GITHUB_TOKEN, but it seems that it is restricted to the current repo only. So I created a PAT for my GitHub account and added that to the repo secrets.