rorkai/App-Store-Connect-CLI

Review signals: 1 connection review, 5 hardcoded secret, 1 known vulnerability, 1 outside write, 38 sensitive read. 60 static matches retained as context.

Reviewed as expected for a test run: opened pseudo-terminals.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 14 distinct locations. 22 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 4 distinct locations. 5 findings.

OSV reports a known vulnerability in this dependency version. golang.org/x/crypto

Repository processes attempted these writes outside documented output/cache paths. 18 distinct locations. 14 attributed processes.

A repository process attempted to read this sensitive path. 38 distinct locations. 38 findings. 16 attributed processes.

58 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• asc docs show workflows prints the curated workflow recipes: Real input produced the expected result: # Workflow Patterns

  Source: `asc docs show workflows`: curated workflow recipes

  Input: docs show workflows

  Expected: workflow title is printed

  Command: ./asc docs show workflows

  Observed: # Workflow Patterns Use the high-level workflow surfaces deliberately: - `asc publish appstore`: canonical App Store shipping path - `asc publish testflight`: canonical high-level TestFlight publish path - `asc workflow`: user-defined orchestration for repo-specific pipelines To include store assets in a canonical metadata round-trip, select the asset scopes explicitly: ```bash asc metadata pull --app "APP_ID" --version "1.2.3" --dir ./metadata --include localizations,app-clip,previews asc metadata push --app "APP_ID" --version "1.2.3" --dir ./metadata --include localizations,app-clip,prev

• asc docs show reference prints the repo-local quick reference: Real input produced the expected result: # asc cli reference

  Source: `asc docs show reference`: repo-local quick reference template used by `asc init`

  Input: docs show reference

  Expected: reference title is printed

  Command: ./asc docs show reference

  Observed: # asc cli reference Unofficial CLI for the App Store Connect API. AI-friendly command catalog and workflow notes for the asc cli. Use this alongside the asc cli readme (examples) and `asc --help` (source of truth). Generate this file in any repo with `asc init` (or `asc docs init`). ## Command Discovery (Source of Truth) ```bash asc --help asc <command> --help asc <command> <subcommand> --help ``` Do not memorize flags. Always use `--help` for the current interface. ## Core Principles - Explicit flags (prefer `--app` over short flags) - TTY-aware output defaults (`table` in terminals, `j

• asc system-status checks Apple developer services without credentials: Real input produced the expected result: https://developer.apple.com/system-status/

  Source: Check Apple's developer services without credentials: `asc system-status`

  Input: --issues-only

  Expected: status source URL is printed

  Command: ./asc system-status --issues-only

  Observed: https://developer.apple.com/system-status/","summary":{"status":"operational","totalServices":51,"operationalServices":51,"affectedServices":0,"activeIncidents":0},"services":[]}

Examples

• Build and run the short test suite as documented in CONTRIBUTING: Deferred from checker replay: the full short suite takes about 15 minutes and exceeds the replay window. It was run manually in this guest with ASC_BYPASS_KEYCHAIN=1 make test-short and exited 0 (every package ok), log at <guest-path>

  Source: CONTRIBUTING.md

  Input: ASC_BYPASS_KEYCHAIN=1 make test-short

  Expected: short tests run and report a final status

  Observed: Deferred from checker replay: the full short suite takes about 15 minutes and exceeds the replay window. It was run manually in this guest with ASC_BYPASS_KEYCHAIN=1 make test-short and exited 0 (every package ok), log at <guest-path>

• Telemetry can be turned off with an environment variable: command completed successfully

  Source: README.md

  Input: asc telemetry status with ASC_TELEMETRY_DISABLED=1

  Expected: telemetry reports enabled false

  Command: ./asc telemetry status

  Observed: {"path":"<guest-path>","enabled":false,"install_id":"e53c17a2-8b6c-468d-9cbd-c96c864eb89c","reason":"ASC_TELEMETRY_DISABLED","endpoint":"https://rork.com/cf-api/asc/v1/events"}

Cycles

• system-status --watch polls Apple's status page repeatedly until stopped (one poll per cycle, default 30s): Triggered one cycle by hand (run-once: --max-polls 1 caps the loop to a single poll (no fake clock, no wrapper); normal trigger: poll every --poll-interval (default 30s) while --watch is set): {"source":"https://developer.apple.com/system-status/","summary":{"status":"operational","totalServices":51,"operationalServices":51,"affectedServices":0,"activeIncidents":0},"services":[]}

  Source: internal/cli/systemstatus/system_status.go

  Input: --watch --max-polls 1 --poll-interval 30s --issues-only

  Expected: one status snapshot is emitted, then the process exits 0

  Command: ./asc system-status --watch --max-polls 1 --poll-interval 30s --issues-only

  Observed: {"source":"https://developer.apple.com/system-status/","summary":{"status":"operational","totalServices":51,"operationalServices":51,"affectedServices":0,"activeIncidents":0},"services":[]}

Local or hosted: local

Build the asc CLI from source at commit d5ef73a, then run its documented offline commands (asc search, asc docs show, asc system-status, asc telemetry status) and one bounded run of its status watch loop.

cd <guest-path> && ls -la && cat README.md | head -200 && id -u && python3 --version && which go node npm uv 2>&1; cat /etc/os-release | head -3
cd <guest-path> && ls -la .git 2>&1 | head -2; grep -n "^go \|toolchain" go.mod; which go git curl; go version 2>&1; grep -n -i "source\|go install\|make build\|build" README.md | head -40; sed -n 1,80p CONTRIBUTING.md | grep -n -i "go\|make" | head -30; grep -n "^build\|^test" -A4 Makefile | head -30
cd <guest-path> && sed -n 1,40p CONTRIBUTING.md; echo ----; sed -n 1,60p install.sh; echo ----; env | grep -i proxy; curl -sI https://go.dev/dl/go1.27.3.linux-amd64.tar.gz | head -5
cd /tmp && curl -fsSL -o /tmp/go.tgz https://dl.google.com/go/go1.27.3.linux-amd64.tar.gz && mkdir -p <host-path> && rm -rf <host-path> && tar -C <host-path> -xzf /tmp/go.tgz && <host-path> version; echo HOME=$HOME; cd <guest-path> && git init -q && git remote add origin https://github.com/rorkai/App-Store-Connect-CLI && git fetch -q --depth 1 origin d5ef73a79d576c92190f6720043a3d8fd2cfdaf6 && git reset -q --mixed FETCH_HEAD && git log --oneline -1
cd <guest-path> && export PATH=<host-path> && export GOPATH=<guest-path> && make build 2>&1 | tail -20; ls -la asc 2>&1
sudo -n apt-get install -y -q make >/tmp/make-install.log 2>&1 || (sudo -n apt-get update -q >/dev/null 2>&1 && sudo -n apt-get install -y -q make) ; echo rc=$?; which make; tail -3 /tmp/make-install.log
cd <guest-path> && export PATH=<host-path> GOPATH=<guest-path> && make build 2>&1 | tail -20; ls -la asc 2>&1; ./asc version 2>&1 | head -5
cd <guest-path> && sed -n 200,262p README.md; echo ....; sed -n 500,600p README.md
cd <guest-path> && export ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && ./asc telemetry status 2>&1 | head; echo ---; ./asc docs show reference 2>&1 | head -30; echo rc=$?; echo ---; ./asc --help 2>&1 | head -20
cd <guest-path> && export ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && ./asc search "upload a build" --output json 2>&1 | head -c 1500; echo; echo rc=${PIPESTATUS[0]}; ./asc docs show workflows 2>&1 | head -5; grep -rn "asc search" README.md | head
cd <guest-path> && grep -rn -i "\-\-watch\|\-\-once\|\-\-now\|cron\|webhook" README.md docs/*.md commands/*.mdx 2>/dev/null | head -20; echo ---; grep -rln "poll-interval" internal | head; grep -rn '"watch"\|"poll-interval"' internal --include=*.go | grep -v _test | head -5
cd <guest-path> && export ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && timeout 60 ./asc system-status --issues-only 2>&1 | head -c 1200; echo; echo rc=${PIPESTATUS[0]}
mkdir -p <guest-path> && cd /tmp && curl -fsSL https://asccli.sh/install | INSTALL_DIR=<guest-path> bash 2>&1 | tail -15; echo rc=${PIPESTATUS[1]}; ls -la <guest-path> 2>&1
cd <guest-path> && export ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && timeout 12 ./asc system-status --watch --poll-interval 30s --issues-only > <guest-path> 2>&1; echo rc=$?; head -c 1500 <guest-path>; echo; wc -c <guest-path>; grep -rn "watch" internal/cli/status*/*.go 2>/dev/null | grep -i "ticker\|sleep\|for " | head; grep -rln "system-status" internal --include=*.go | grep -v _test | head -3
cd <guest-path> && export ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && ./asc system-status --watch --max-polls 1 --poll-interval 30s --issues-only; echo rc=$?; grep -n "max-polls\|maxPolls\|watch" internal/cli/systemstatus/system_status.go | head -20
cd <guest-path> && export PATH=<host-path> GOPATH=<guest-path> ASC_BYPASS_KEYCHAIN=1 ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 && (nohup make test-short > <guest-path> 2>&1; echo EXIT=$? >> <guest-path>) & sleep 5; echo started; tail -3 <guest-path>
cd <guest-path> && grep -nF "\`asc --help\`: authoritative command and flag surface" README.md; grep -nF "\`asc docs show reference\`: repo-local quick reference template used by \`asc init\`" README.md; grep -nF "Check Apple's developer services without credentials: \`asc system-status\`" README.md; grep -nF "\`ASC_TELEMETRY_DISABLED=1\` and \`DO_NOT_TRACK=1\` also disable telemetry." README.md; grep -nF "for poll := 1; maxPolls == 0 || poll <= maxPolls; poll++ {" internal/cli/systemstatus/system_status.go; grep -c "" README.md; tail -2 <guest-path> | cut -c1-300
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["./asc","search","upload a build","--output","json"],"cwd":"<guest-path>","expected_text":"asc builds upload"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"asc --help shows the authoritative command and flag surface","source":"`asc --help`: authoritative command and flag surface","input":"--help","expected":"CLI description is printed","probe_kind":"cli","argv":["./asc","--help"],"expected_text":"asc is a fast, lightweight CLI for App Store Connect","cwd":"<guest-path>"},
{"kind":"claim","claim":"asc docs show reference prints the repo-local quick reference","source":"`asc docs show reference`: repo-local quick reference template used by `asc init`","input":"docs show reference","expected":"reference title is printed","probe_kind":"cli","argv":["./asc","docs","show","reference"],"expected_text":"# asc cli reference","cwd":"<guest-path>"},
{"kind":"claim","claim":"asc system-status checks Apple developer services without credentials","source":"Check Apple's developer services without credentials: `asc system-status`","input":"--issues-only","expected":"status source URL is printed","probe_kind":"cli","argv":["./asc","system-status","--issues-only"],"expected_text":"https://developer.apple.com/system-status/","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"system-status --watch polls Apple's status page repeatedly until stopped (one poll per cycle, default 30s)","source":"internal/cli/systemstatus/system_status.go","quote":"for poll := 1; maxPolls == 0 || poll <= maxPolls; poll++ {","schedule":"poll every --poll-interval (default 30s) while --watch is set","method":"run-once: --max-polls 1 caps the loop to a single poll (no fake clock, no wrapper)","input":"--watch --max-polls 1 --poll-interval 30s --issues-only","expected":"one status snapshot is emitted, then the process exits 0","kind":"cli","argv":["./asc","system-status","--watch","--max-polls","1","--poll-interval","30s","--issues-only"],"cwd":"<guest-path>","expected_text":"https://developer.apple.com/system-status/"}]}
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Build and run the short test suite as documented in CONTRIBUTING","source":"CONTRIBUTING.md","input":"ASC_BYPASS_KEYCHAIN=1 make test-short","expected":"short tests run and report a final status","argv":["make","test-short"],"cwd":"<guest-path>","env":{"PATH":"<host-path>","ASC_BYPASS_KEYCHAIN":"1","ASC_TELEMETRY_DISABLED":"1","DO_NOT_TRACK":"1"},"expected_text":"Running short tests"},
{"kind":"example","claim":"Telemetry can be turned off with an environment variable","source":"README.md: `ASC_TELEMETRY_DISABLED=1` and `DO_NOT_TRACK=1` also disable telemetry.","input":"asc telemetry status with ASC_TELEMETRY_DISABLED=1","expected":"telemetry reports enabled false","argv":["./asc","telemetry","status"],"cwd":"<guest-path>","env":{"ASC_TELEMETRY_DISABLED":"1","PATH":"/usr/local/bin:/usr/bin:/bin","HOME":"<guest-path>"},"expected_text":"\"enabled\":false"}
]
EOF
for f in probe claims cycles examples; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])" .coldpass/$f.json; done; tail -2 <guest-path> | cut -c1-300
cd <guest-path> && sed -i 's|"source":"README.md: `ASC_TELEMETRY_DISABLED=1` and `DO_NOT_TRACK=1` also disable telemetry."|"source":"README.md"|' .coldpass/examples.json && python3 -I -c "import json;print(json.load(open('.coldpass/examples.json'))[1]['source'])"; for i in $(seq 1 50); do grep -q EXIT= <guest-path> && break; sleep 10; done; tail -c 1500 <guest-path>
for i in $(seq 1 25); do grep -q EXIT= <guest-path> && break; sleep 10; done; tail -c 1200 <guest-path>; echo; ps aux | grep -c "[g]o test"
for i in $(seq 1 27); do grep -q EXIT= <guest-path> && break; sleep 10; done; tail -c 1500 <guest-path>; echo; ps aux | grep "[g]o test\|[g]o_test_shard" | head -3 | cut -c1-200
cd <guest-path> && <env-var>=<guest-path> timeout 3000 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; tail -c 3000 <guest-path>
cd <guest-path> && python3 -I - <<'EOF'
import json,re
t=open('<guest-path>').read()
i=t.find('{')
s=json.loads(t[t.find('"stdout": "')+11:].rsplit('"',2)[0].encode().decode('unicode_escape')) if False else None
print(t[:1500])
EOF
grep -o '"problems[^]]*]' <guest-path> | head -c 1500; echo; grep -o '"verdict": "[a-z]*"' <guest-path> | sort | uniq -c; grep -o 'outcome[^,]*' <guest-path> | head -20 | cut -c1-250
cd <guest-path> && grep -nF "\`asc docs show workflows\`: curated workflow recipes" README.md && ./asc docs show workflows 2>&1 | head -3; cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"asc docs show workflows prints the curated workflow recipes","source":"`asc docs show workflows`: curated workflow recipes","input":"docs show workflows","expected":"workflow title is printed","probe_kind":"cli","argv":["./asc","docs","show","workflows"],"expected_text":"# Workflow Patterns","cwd":"<guest-path>"},
{"kind":"claim","claim":"asc docs show reference prints the repo-local quick reference","source":"`asc docs show reference`: repo-local quick reference template used by `asc init`","input":"docs show reference","expected":"reference title is printed","probe_kind":"cli","argv":["./asc","docs","show","reference"],"expected_text":"# asc cli reference","cwd":"<guest-path>"},
{"kind":"claim","claim":"asc system-status checks Apple developer services without credentials","source":"Check Apple's developer services without credentials: `asc system-status`","input":"--issues-only","expected":"status source URL is printed","probe_kind":"cli","argv":["./asc","system-status","--issues-only"],"expected_text":"https://developer.apple.com/system-status/","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Build and run the short test suite as documented in CONTRIBUTING","source":"CONTRIBUTING.md","input":"ASC_BYPASS_KEYCHAIN=1 make test-short","expected":"short tests run and report a final status","deferred":true,"reason":"Deferred from checker replay: the full short suite takes about 15 minutes and exceeds the replay window. It was run manually in this guest with ASC_BYPASS_KEYCHAIN=1 make test-short and exited 0 (every package ok), log at <guest-path>"},
{"kind":"example","claim":"Telemetry can be turned off with an environment variable","source":"README.md","input":"asc telemetry status with ASC_TELEMETRY_DISABLED=1","expected":"telemetry reports enabled false","argv":["./asc","telemetry","status"],"cwd":"<guest-path>","env":{"ASC_TELEMETRY_DISABLED":"1","PATH":"/usr/local/bin:/usr/bin:/bin","HOME":"<guest-path>"},"expected_text":"\"enabled\":false"}
]
EOF
<env-var>=<guest-path> timeout 3000 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"problems[^]]*]' <guest-path> | head -c 800; echo; grep -o '"valid": [a-z]*' <guest-path>; tail -c 300 <guest-path>
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Build the asc CLI from source at commit d5ef73a, then run its documented offline commands (asc search, asc docs show, asc system-status, asc telemetry status) and one bounded run of its status watch loop.",
  "operation_scope": "Linux x86_64 guest, non-root user (uid 1000), Ubuntu 24.04, Python 3.12.3. Go 1.27.3 (go.mod requirement). No App Store Connect credentials used; commands that need Apple API auth (auth, apps, builds, upload) were not exercised. Telemetry disabled via ASC_TELEMETRY_DISABLED=1 and DO_NOT_TRACK=1.",
  "steps": [
    "git init; git remote add origin https://github.com/rorkai/App-Store-Connect-CLI; git fetch --depth 1 origin d5ef73a79d576c92190f6720043a3d8fd2cfdaf6; git reset --mixed FETCH_HEAD",
    "curl -sSL https://dl.google.com/go/go1.27.3.linux-amd64.tar.gz -> extracted to <host-path> (Go 1.27.3, per go.mod and CONTRIBUTING.md 'Go toolchain')",
    "sudo apt-get install -y make (first attempt reported 'no installation candidate'; after apt-get update the install succeeded)",
    "make build (CONTRIBUTING.md 'Clone and build'); produced ./asc, reports d5ef73a",
    "ASC_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 ./asc telemetry status -> enabled:false",
    "curl -fsSL https://asccli.sh/install | INSTALL_DIR=<guest-path> bash (README 'Install script'); installed released asc 5.16.1 with checksum verified",
    "./asc docs show reference (README 'Commands and Reference')",
    "./asc docs show workflows (README 'Commands and Reference')",
    "./asc search \"upload a build\" --output json (product probe; returns asc builds upload with examples)",
    "./asc system-status --issues-only (README 'Troubleshooting: Apple service health'); returns developer.apple.com status, 51/51 operational at run time",
    "./asc system-status --watch --max-polls 1 --poll-interval 30s --issues-only (one manual cycle of the watch loop)",
    "ASC_BYPASS_KEYCHAIN=1 make test-short (CONTRIBUTING.md 'Run tests'); manual run exited 0 with all packages ok; log at <guest-path>",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay -> valid:true, problems:[]"
  ],
  "deviations": [
    "make was not preinstalled; installed via apt-get after apt-get update (sudo available).",
    "Go 1.27.3 was installed manually from dl.google.com into <host-path> rather than through the go.mod toolchain auto-download described in CONTRIBUTING.md; the outcome is the same toolchain version.",
    "The README install script installed released asc 5.16.1, not the pinned source build. All probes and claims use the source build ./asc from d5ef73a.",
    "The first probe/claim using asc --help was judged help-only by the checker and was replaced with asc docs show workflows.",
    "The full make test-short example (about 15 minutes) exceeds the checker replay window, so it is recorded as deferred with the manual result. It was run once manually and passed.",
    "Telemetry was disabled via environment variables for every run, per the task's privacy instruction. The telemetry status example sets ASC_TELEMETRY_DISABLED=1.",
    "Authenticated commands (asc auth login, apps, builds, upload, etc.) were not exercised because no App Store Connect key was supplied."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "None needed for the exercised operations. Optional: make test-short takes about 15 minutes, so a faster documented smoke target would help CI replay."
}
EOF
python3 -I -c "import json;d=json.load(open('.coldpass/report.json'));print(d['outcome'], len(d['steps']))"; ls -la .coldpass; ps aux | grep "[a]sc system-status\|[a]sc search" | head -2
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"problems": \[[^]]*\]' <guest-path> | head -c 400; echo