# Reading Build Settings ## Commands Use `-target App` for the App target alone. `-scheme App` also works, but it prints every target in the scheme's build action. ```bash # SPM or CocoaPods: the App target's evaluated settings xcodebuild -showBuildSettings -json \ -project ios/App/App.xcodeproj -target App -configuration Release > /tmp/app-release.json xcodebuild -showBuildSettings -json \ -project ios/App/App.xcodeproj -target App -configuration Debug > /tmp/app-debug.json # Scheme form, as most docs show it xcodebuild -showBuildSettings -project ios/App/App.xcodeproj -scheme App ``` Notes: - On SPM projects the first call may resolve packages, which can take a minute. - On CocoaPods projects, run `npx cap sync ios` (or `pod install`) first. The App target's base xcconfig is `Pods-App.<config>.xcconfig`. If it is missing, the command warns and the values are incomplete. - The output is a JSON array of `{ "target": "...", "action": "...", "buildSettings": { ... } }`. Values are evaluated, so `$(inherited)` and macros are already resolved. - Evaluated values do not tell you **where** a value comes from. To tell "Xcode default" from "someone set it", search the sources: ```bash grep -nE 'ENABLE_ENHANCED_SECURITY|ENABLE_POINTER_AUTHENTICATION|GCC_WARN_|CLANG_WARN_|CLANG_ANALYZER_|ENABLE_USER_SCRIPT_SANDBOXING' \ ios/App/App.xcodeproj/project.pbxproj grep -rnE 'ENABLE_|GCC_WARN_|CLANG_' ios --include='*.xcconfig' | grep -v '/Pods/' ``` ## The audit script ```bash node <skill>/scripts/audit-build-settings.mjs /tmp/app-release.json \ --pbxproj ios/App/App.xcodeproj/project.pbxproj [--target App] [--unhardened] ``` It prints one row per tracked setting: `status KEY=value [explicit: pbxproj lines]`. Statuses: - `hardened`: the value is `YES`, `YES_AGGRESSIVE`, `YES_ERROR`, or the expected non-boolean value. - `default-off`: not hardened, and the key does not appear in the pbxproj. This is a candidate to enable. - `DISABLED`: not hardened, and the key is set explicitly in the pbxproj. Ask why before you change it. - `info`: a context value such as `CODE_SIGN_ENTITLEMENTS` or `IPHONEOS_DEPLOYMENT_TARGET`. `DISABLED` is a heuristic. It means the key appears somewhere in `project.pbxproj`, maybe in another configuration or target. Open the cited lines before you conclude anything. ## Predicates - **Already hardened**: the evaluated value matches the catalog value. - **Default off**: not hardened, and there is no match in `project.pbxproj` or in a team-owned `.xcconfig`. - **Deliberately disabled**: not hardened, and set explicitly somewhere. Check the decision log for a reason. If there is none, ask the user. Never re-enable silently. ## Where to write settings in a Capacitor project | Source | Write here? | |---|---| | `App.xcodeproj` project-level Debug/Release (Xcode project > Build Settings) | Yes. Default choice | | `App.xcodeproj` App target level | Only for target-specific overrides (pointer-auth opt-out, entitlements path) | | A team-owned xcconfig already wired as a base configuration | Yes, if the project already uses one | | `ios/debug.xcconfig` (SPM template) | No. The CLI manages it and it applies only to Debug | | `Pods/Target Support Files/**.xcconfig` | No. Regenerated by `pod install` | | `ios/App/CapApp-SPM/Package.swift` | No. Regenerated by `npx cap sync` | Do not introduce a new configuration method the project does not use already.