ci: build and sign xcframework

[itaybre]

📜 Description

Sign xcframework when building it

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

You have to check all boxes before merging:

• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.897%. Comparing base (87e12d9) to head (16c45fd).
Report is 6 commits behind head on main.

Additional details and impacted files

@@              Coverage Diff              @@
##              main     #5271       +/-   ##
=============================================
+ Coverage   92.806%   92.897%   +0.091%     
=============================================
  Files          688       688               
  Lines        86297     86306        +9     
  Branches     30104     31209     +1105     
=============================================
+ Hits         80089     80176       +87     
+ Misses        6113      6029       -84     
- Partials        95       101        +6     

see 21 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 87e12d9...16c45fd. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1231.54 ms	1259.08 ms	27.54 ms
Size	23.76 KiB	821.43 KiB	797.67 KiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
0dfdaaa	1226.88 ms	1248.82 ms	21.94 ms
216bdf9	1196.29 ms	1209.80 ms	13.51 ms
27f970b	1223.48 ms	1239.51 ms	16.03 ms
39b1c35	1244.71 ms	1248.60 ms	3.89 ms
2719ce6	1211.75 ms	1237.16 ms	25.41 ms
716a5b0	1240.21 ms	1265.81 ms	25.60 ms
2b19b82	1226.73 ms	1243.27 ms	16.53 ms
dea0b00	1229.94 ms	1250.43 ms	20.49 ms
8e76be4	1272.67 ms	1286.38 ms	13.71 ms
0204c72	1230.35 ms	1242.04 ms	11.69 ms

App size

Revision	Plain	With Sentry	Diff
0dfdaaa	20.76 KiB	434.56 KiB	413.79 KiB
216bdf9	21.58 KiB	418.13 KiB	396.54 KiB
27f970b	21.58 KiB	706.97 KiB	685.39 KiB
39b1c35	22.85 KiB	408.88 KiB	386.03 KiB
2719ce6	20.76 KiB	435.13 KiB	414.37 KiB
716a5b0	22.31 KiB	756.95 KiB	734.64 KiB
2b19b82	21.58 KiB	542.18 KiB	520.60 KiB
dea0b00	22.31 KiB	821.41 KiB	799.10 KiB
8e76be4	20.76 KiB	427.66 KiB	406.89 KiB
0204c72	21.58 KiB	540.04 KiB	518.46 KiB

Previous results on branch: feature/sign_xcframework

Startup times

Revision	Plain	With Sentry	Diff
c1019a7	1223.35 ms	1245.58 ms	22.24 ms
e32e41e	1226.69 ms	1242.50 ms	15.81 ms
2cab324	1234.12 ms	1251.43 ms	17.30 ms

App size

Revision	Plain	With Sentry	Diff
c1019a7	23.76 KiB	821.30 KiB	797.54 KiB
e32e41e	23.76 KiB	821.30 KiB	797.54 KiB
2cab324	23.76 KiB	821.30 KiB	797.54 KiB

[philprime]

Thanks for looking into this.

1. How long are frameworks signed?
2. What happens when frameworks are not signed anymore?
3. What happens if a certificate is revoked?

We should make sure that older versions of the framework can still be used.

[philipphofmann]

Thanks for doing this. I added a few comments.

[philipphofmann]

Thanks for looking into this.

1. How long are frameworks signed?
2. What happens when frameworks are not signed anymore?
3. What happens if a certificate is revoked?

We should make sure that older versions of the framework can still be used.

We can also answer these questions after merging this PR. We must answer them before using the signed XCFramework in releases.

[philipphofmann]

Thanks for doing this. After merging this, I think a beta release and manually including the signed XCFramwork via SPM in a sample project is mandatory. We also must communicate this change to the Hybrid SDKs and let them try it with this beta release. Only when all this succeeds, I'm confident enough to ship a normal release.