Auto Registration
It is possible to add an individual app signing certificate with auto-registration, simply by using the -autoReg option when adding the certificate. If this property is added for a particular certificate then this means that any app that is signed with it will be automatically registered and there is no need to add a specific registration for it, as detailed in Managing Registrations. This makes it easier to develop and debug using Approov, and also means that the process of releasing new app versions to the app store is easier as there is no Approov registration step required.
If you have previously added the same certificate and then want to make it auto-registering, then you will need to add it again with the -autoReg option. You will receive an error if it is already added, and you must use approov appsigncert -remove to remove it briefly before adding it again.
Note you can use the feature for force failing specific app versions if you wish to ensure specific versions do not pass attestation even if they are signed with an auto-registering app signing certificate.
Apps built to run on the iOS/watchOS simulator are not code signed and thus auto-registration does not work for them. In this case you can consider forcing a device ID to pass to get a valid attestation. Note also that the feature requires use of an SDK of version 3.1.0 or above.
Forcing Failure of Specific App Versions
You may wish to force particular app versions to fail, even if they are signed with a valid app signing certificate that is marked as auto-registering. One motivation might be to prevent an obsolete version of an app from connecting to API end points that are still running.
You can do this simply by adding the app package/bundle name and the version number you wish to block as follows:
approov forcefail -addApp io.approov.shapes -appVersion "3.0(3)"
Note that if the version number contains brackets then you must include it as quotes as shown to allow correct command line parsing.
An admin role and confirmation is required as follows:
WARNING: forcing an app version failure will have an immediate impact on your apps in production
ATTENTION: If you wish to continue then please type YES and return: YES
successfully added the app io.approov.shapes, version 3.0(3)
Any further attestations by app instances of that specific version will then be rejected.
For Android apps you must include the version number and the specific version code in brackets. For iOS/watchOS you should only include the version number, and thus no quotes are required. The iOS/watchOS build number is not required.
You can see the full list of blocked apps as follows:
approov forcefail -listApps
In this example, only a single app version is blocked:
io.approov.shapes: 3.0(3)
Finally, you can remove any app version using the following command:
approov forcefail -removeApp io.approov.shapes -appVersion "3.0(3)"
An admin role and confirmation is required as follows:
WARNING: removing an app version fail will have an immediate impact on your apps in production
ATTENTION: If you wish to continue then please type YES and return: YES
successfully removed the app io.approov.shapes, version 3.0(3)
Only a maximum of 100 different app versions may be added by default.