fix: trust pinned Swift source plugin on CI workers

Signed-off-by: Tom Brow <tomb@block.xyz>

scripts/trust-ios-package-plugin.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Trust only Buzz's reviewed, pinned Swift build plugin on a build worker."""
+import argparse
+import json
+from pathlib import Path
+
+
+def trust_plugin(destination, root):
+    """Preserve other trust entries and reject an unreviewed package revision."""
+    entry = {
+        "fingerprint": "e70a10e036a55fffea31568f0af92d69b6d449cd",
+        "packageIdentity": "swift-secp256k1",
+        "targetName": "SharedSourcesPlugin",
+    }
+    lock = json.loads((root / "mobile/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved").read_text())
+    pin = next(pin for pin in lock["pins"] if pin["identity"] == entry["packageIdentity"])
+    if pin["state"]["revision"] != entry["fingerprint"]:
+        raise ValueError("Review the changed Swift plugin before updating its trusted fingerprint")
+    entries = json.loads(destination.read_text()) if destination.exists() else []
+    if not isinstance(entries, list):
+        raise ValueError("Expected a Swift plugin trust list")
+    if entry not in entries:
+        entries.append(entry)
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        destination.write_text(json.dumps(entries, indent=2) + "\n")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--trust-file", type=Path, required=True)
+    args = parser.parse_args()
+    trust_plugin(args.trust_file, Path(__file__).resolve().parent.parent)