Signing files where your pipeline can reach them.
Keep keystores, .p12 certificates, provisioning profiles and service files encrypted in one place, per app and environment, and download them into CI only when it's time to sign.
Upload once, download where you sign.
Replace a file in the dashboard and the next download gets the new version.
- 01
Upload your files
Add keystores, .p12, .mobileprovision, .json, .env or .yaml files from the dashboard, up to 1 MB each.
- 02
Create an API token
Scope it to an app and environment, with an expiry date and the fingerprints allowed to use it.
- 03
Download in CI
download_files_with_token writes the files into your runner right before the signing step.
Your pipeline pulls what it needs.
Use your own session on a laptop, and an API token in CI.
smart-grow login
smart-grow download_files # pick app, environment and file# Downloads every file of the environment when --file-id is omitted.
- name: Download signing files
run: smart-grow download_files_with_token --output ./signing
env:
SMARTGROW_ONPREMISE_API_TOKEN: ${{ secrets.SMARTGROW_API_TOKEN }}
SMARTGROW_ONPREMISE_APP_ID: ${{ vars.SMARTGROW_APP_ID }}
SMARTGROW_ONPREMISE_ENV_ID: ${{ vars.SMARTGROW_ENV_ID }}What you get.
Every item here is something the product does today.
-
Any signing or config file
.keystore, .p12, .pfx, .mobileprovision, .pem, .crt, .key, .json, .env and .yaml, up to 1 MB each.
-
Per app and environment
Debug and release signing material stay separate.
-
Encrypted at rest
Files are stored encrypted and delivered over a post-quantum channel on top of HTTPS.
-
Tokens made for CI
API tokens per app and environment, with an expiry date and allowed fingerprints.
-
Replace, don't re-share
Upload a new version in the dashboard; the next download gets it.
-
Roles and audit log
Uploads, updates and deletions are recorded in the audit log.