WIP: one-tap iBridge Mobile bootstrap

.github/workflows/mobile.yml

@@ -0,0 +1,115 @@
+name: Build iBridge Mobile
+
+on:
+  push:
+    branches:
+      - "*"
+  pull_request:
+    branches:
+      - "*"
+  workflow_dispatch:
+  release:
+    types: [published]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  mobile:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust iOS target
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-ios
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install frontend dependencies
+        run: bun i --frozen-lockfile
+
+      - name: Initialize Tauri iOS project
+        run: bun tauri ios init --ci
+
+      - name: Build frontend assets
+        run: bun run build
+
+      - name: Compile unsigned Tauri iOS app
+        shell: bash
+        run: |
+          set -euo pipefail
+          PROJECT=$(find src-tauri/gen/apple -maxdepth 1 -name '*.xcodeproj' -print -quit)
+          if [ -z "$PROJECT" ]; then
+            echo "Generated Xcode project not found" >&2
+            exit 1
+          fi
+
+          SCHEME=$(xcodebuild -project "$PROJECT" -list -json | python3 -c '
+          import json, sys
+          data = json.load(sys.stdin)
+          schemes = data.get("project", {}).get("schemes", [])
+          scheme = next((value for value in schemes if value.endswith("_iOS")), None)
+          if not scheme:
+              raise SystemExit("No generated iOS scheme found")
+          print(scheme)
+          ')
+
+          mkdir -p mobile-ci/app
+          xcodebuild \
+            -project "$PROJECT" \
+            -scheme "$SCHEME" \
+            -configuration release \
+            -sdk iphoneos \
+            -destination 'generic/platform=iOS' \
+            CODE_SIGNING_ALLOWED=NO \
+            CODE_SIGNING_REQUIRED=NO \
+            DEVELOPMENT_TEAM= \
+            ARCHS=arm64 \
+            ONLY_ACTIVE_ARCH=YES \
+            CONFIGURATION_BUILD_DIR="$PWD/mobile-ci/app" \
+            build
+
+      - name: Package resignable IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          APP=$(find mobile-ci/app -maxdepth 1 -type d -name '*.app' -print -quit)
+          if [ -z "$APP" ]; then
+            echo "Built iOS app not found" >&2
+            exit 1
+          fi
+
+          if [ ! -d "$APP/PlugIns/IBridgeTunnelProvider.appex" ]; then
+            echo "Embedded IBridgeTunnelProvider.appex not found" >&2
+            find "$APP" -maxdepth 3 -print
+            exit 1
+          fi
+
+          mkdir -p mobile-ci/Payload
+          cp -R "$APP" mobile-ci/Payload/iBridge.app
+          (
+            cd mobile-ci
+            zip -qry iBridge-Mobile.ipa Payload
+          )
+          test -s mobile-ci/iBridge-Mobile.ipa
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: iBridge-Mobile
+          path: mobile-ci/iBridge-Mobile.ipa
+          if-no-files-found: error
+
+      - name: Attach IPA to release
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" mobile-ci/iBridge-Mobile.ipa --clobber

.github/workflows/test.yml

@@ -0,0 +1,40 @@
+name: Test iBridge
+
+on:
+  push:
+    branches:
+      - "*"
+  pull_request:
+    branches:
+      - "*"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf perl make
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install frontend dependencies
+        run: bun i --frozen-lockfile
+
+      - name: Rust tests
+        run: cargo test --manifest-path src-tauri/Cargo.toml
+
+      - name: Frontend build
+        run: bun run build

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,50 @@
+# Third-party notices
+
+## StosVPN packet reflection technique
+
+iBridge Mobile contains an adapted packet-reflection implementation in
+`src-tauri/ios/IBridgeTunnelProvider/PacketTunnelProvider.swift` based on
+[SideStore/StosVPN](https://github.com/SideStore/StosVPN), specifically the
+`PacketTunnelProvider.swift` implementation authored by the SideStore Team.
+
+iBridge is not StosVPN and does not imply endorsement by the SideStore Team.
+The adapted code is used only as the local `NEPacketTunnelProvider` transport
+inside iBridge Mobile.
+
+Source reference: SideStore/StosVPN commit
+`010bc141e6c2303b218924686f830e3249c66842`.
+
+### StosVPN License
+
+Copyright (c) 2025 SideStore Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+**Attribution is clearly given** to the original project and author(s) in a
+prominent place (e.g., README, About page, or documentation).
+
+Any derived project **must clearly state** that it is **based on** or **uses
+code from** the original project.
+
+Redistribution, rebranding, or publishing of the **entire project** (or a
+substantially similar copy) under the same or similar name or branding,
+**without explicit written permission**, is **prohibited**.
+
+This clause is intended to prevent unauthorized re-uploads, clones, or
+misrepresentation of the original work.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mobile/iBridgeMobile/Bootstrap.swift

@@ -0,0 +1,102 @@
+import Foundation
+
+struct BootstrapPayload: Codable {
+    let schema: String
+    let deviceUdid: String
+    let deviceName: String
+    let deviceVersion: String
+    let appleId: String
+    let anisetteServer: String
+    let pairingPath: String
+    let secretPath: String
+    let createdAt: String
+}
+
+struct AccountSecretPayload: Codable {
+    let schema: String
+    let appleId: String
+    let password: String
+}
+
+struct MobileConfiguration {
+    let appleID: String
+    let anisetteServer: String
+    let deviceUDID: String
+    let deviceName: String
+    let deviceVersion: String
+
+    static func load() -> MobileConfiguration? {
+        let defaults = UserDefaults.standard
+        guard
+            let appleID = defaults.string(forKey: "bootstrap.appleID"),
+            let anisetteServer = defaults.string(forKey: "bootstrap.anisetteServer"),
+            let deviceUDID = defaults.string(forKey: "bootstrap.deviceUDID"),
+            let deviceName = defaults.string(forKey: "bootstrap.deviceName"),
+            let deviceVersion = defaults.string(forKey: "bootstrap.deviceVersion")
+        else { return nil }
+        return MobileConfiguration(
+            appleID: appleID,
+            anisetteServer: anisetteServer,
+            deviceUDID: deviceUDID,
+            deviceName: deviceName,
+            deviceVersion: deviceVersion
+        )
+    }
+}
+
+enum BootstrapImporter {
+    static let pairingAccount = "devicePairing"
+    static let passwordAccount = "applePassword"
+
+    static func importIfPresent() throws {
+        let documents = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)[0]
+        let directory = documents.appendingPathComponent("iBridgeBootstrap", isDirectory: true)
+        let payloadURL = directory.appendingPathComponent("bootstrap.json")
+        guard FileManager.default.fileExists(atPath: payloadURL.path) else { return }
+
+        let payload = try JSONDecoder().decode(BootstrapPayload.self, from: Data(contentsOf: payloadURL))
+        guard payload.schema == "ibridge.mobile-bootstrap/1" else {
+            throw NSError(
+                domain: "iBridgeBootstrap",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Unsupported bootstrap schema"]
+            )
+        }
+
+        let pairingURL = documents.appendingPathComponent(payload.pairingPath)
+        let secretURL = documents.appendingPathComponent(payload.secretPath)
+        let pairing = try Data(contentsOf: pairingURL)
+        let secret = try JSONDecoder().decode(AccountSecretPayload.self, from: Data(contentsOf: secretURL))
+
+        guard secret.schema == "ibridge.mobile-account-secret/1" else {
+            throw NSError(
+                domain: "iBridgeBootstrap",
+                code: 2,
+                userInfo: [NSLocalizedDescriptionKey: "Unsupported account secret schema"]
+            )
+        }
+        guard secret.appleId.caseInsensitiveCompare(payload.appleId) == .orderedSame else {
+            throw NSError(
+                domain: "iBridgeBootstrap",
+                code: 3,
+                userInfo: [NSLocalizedDescriptionKey: "Bootstrap account identity did not match"]
+            )
+        }
+
+        try KeychainStore.set(pairing, account: pairingAccount)
+        try KeychainStore.setString(secret.password, account: passwordAccount)
+
+        let defaults = UserDefaults.standard
+        defaults.set(payload.appleId, forKey: "bootstrap.appleID")
+        defaults.set(payload.anisetteServer, forKey: "bootstrap.anisetteServer")
+        defaults.set(payload.deviceUdid, forKey: "bootstrap.deviceUDID")
+        defaults.set(payload.deviceName, forKey: "bootstrap.deviceName")
+        defaults.set(payload.deviceVersion, forKey: "bootstrap.deviceVersion")
+        defaults.set(payload.createdAt, forKey: "bootstrap.createdAt")
+
+        try? FileManager.default.removeItem(at: secretURL)
+        try? FileManager.default.removeItem(at: pairingURL)
+        try? FileManager.default.removeItem(at: payloadURL)
+        try? FileManager.default.removeItem(at: directory)
+    }
+}

mobile/iBridgeMobile/BridgingHeader.h

@@ -0,0 +1,7 @@
+#ifndef IBRIDGE_CORE_H
+#define IBRIDGE_CORE_H
+
+char *ibridge_sign_and_install(const char *request_json);
+void ibridge_string_free(char *value);
+
+#endif