How does TestFlight do it?

Question

TestFlight offers over-the-air beta distribution of iOS apps (on non-jailbroken devices). How can this be done? Is this an iOS feature, or a vulnerability exploit?

Solution 1

This was possible before TestFlight rolled out a service. The technique stemmed out of the enterprise distribution mechanism. Since 4.0 devices have supported install from web.

Remember - you still need to sign the beta distribution for a select set of UDIDs you can't just willy nilly install it on any device. All they are doing is taking the email the IPA step out of things.

See:

• http://www.alexcurylo.com/blog/2010/08/27/wireless-ad-hoc-distribution/

Update: I want to say that Test Flight is one of the most helpful tools I've used when developing though. Just taking the IPA emailing out of the picture was an understatement- I was just trying to call out the technical mechanism. They do a fantastic job managing the whole beta process. Getting new devices enrolled. Notifying users etc.

Solution 2

This article showed how Apples OTA implementation works and can be used outside enterprises as well: ios wireless app distribution

The complete process is documented by Apple. Apple also published documentation and sample code for registering devices and get the UDID by using profiles, so your website can detect which device is calling.

Some additional solutions with different strenghts:

• iOS Beta Builder, a Mac Application to create the website by using a build. Simply upload the resulting files to your webserver.

• Diawi: Simple Web service. Upload your IPA file, optionally set a password and send a link to your testers.

• AppSendr: Web service for beta build hosting, similar to Testflight, but does not include the device registration process. But provides deployment utilities to automatically upload new versions.

• HockeyKit: Open source project for hosting beta versions on your own PHP5 server with additional functionalities like an client for In-App-Updates, automatic device specific web sites and handling multiple applications. Completely file and directory based.

• HockeyApp: Web Service for beta build hosting, In-App-Updates, Statistics, and including device registration, invite and recruitment. Also provides server side crash report collection, symbolication (for all threads) and crash grouping for beta and app store apps (iOS + Mac). SDKs are open source, using HockeyKit, QuincyKit and PLCrashReporter (which is the only safe solution on how to do crash report collection on iOS, see this article.

Note: I am the main developer of HockeyKit and QuincyKit, and one of the developers of HockeyApp.

Solution 3

Testflight basically uses the normal Ad Hoc as already stated.

For this to work, you need the UDID for every device in order to add it to the Ad Hoc profile, re-compile the app with the new profile an redistribute the new build.

You can get the UDID with the help of the OTA Authentication Request. This is actually a step that is done in MDM before the actual profile is rolled out to the device. It basically asks the device for further information about itself and send it back to a self specified server.

The first step is documented here: Apple OTA Configuration

I guess Testflight uses this right after the registration process to collect the UDID, phone name, ...

Solution 4

Yes this is a core feature of iOS for Enterprise Customers who wish to distribute OTA.

Presumably you would pass your UDID over to TestFlight along with the app and they use their Enterprise Licence to send the app to you. I'm sure I'm missing a lot of the technical details but if you want to know more, Apple has a video on this from WWDC 2010.

Login to developer.apple.com, go to WWDC 2010 Videos and use the link to get to the vidoes. The video you want is "Session 108 - Managing Mobile Devices". It is very informative about what is possible with OTA and the steps you have to take to do OTA provisioning.

View more solutions

Comments

[Moshe]

Great question, but I'm not sure if this is on topic. It's borderline, IMO. That said, I'd love to know the answer to this too, so +1

[hpique]

If it's an iOS feature, it will surely help me to understand provisioning better.

[Besi]

@Moshe: Can you explain why you think this is off-topic?

[Moshe]

Thus question is related to a distribution tool, not in any way to writing code. That said, I wrote my comment nearly a year ago. The environment on SO was a little different.

[Proud Member]

This is a very good question.

[Arvind]

You can use buildtry.com supports both iOS and Android builds

[joel prithivi]

You can use buildtry.com just upload IPA file and share the link with testers. Also it displays provisioning profile details. Supports android APK as well

[Jonathan.]

how do they make money, it says free on the homepage?

[Nick]

I imagine they will start some kind of premium offering in the future. It's free now and the new SDK is really impressive. It can gather crash logs and usage information directly from your test clients and even symbolicate them if you are comfortable uploading your dsyms.

[Jonathan.]

It is quite impressive, just I'm used to "If it's too good to be true it usually is" on the internet :)

[Nils]

I suspect they will make money by charging for their services in production, and keep beta services free. They don't officially support production use today, and they keep alluding to an upcoming "solution for production" in their support forums.

[Besi]

@Nick I think your answer is not entirely correct. You still need to sign the beta distribution for a select set of UDIDs you can't just willy nilly install it on any device. For an enterprise distribution provisioning profile you don't have to specify the devices and you can (at least technically) install the binary on any device. However, the license restricts you to only install it within the company that the distribution profile was issued to.

[occulus]

TestFlight supports Enterprise builds -- in which case you don't need any UDIDs. Note you're only allowed to distribute such builds to people inside your own organisation.

[Marcus Adams]

The problem with charging is that as soon as they start charging they'll have a lot of competitors springing up doing the same thing for a slice of the pie.

[anders]

TestFlight is extremely powerful and I highly recommend it. Why would you complain about it being free? They have a solid product that happens to be free that I use on a daily basis what more can you ask for? They do state somewhere on their website that when the time comes they will have a paid service released.

[CalZone]

Another +1 for Willy nilly install

[mahi]

You do not UDID's for new testflight, More info on their home page or here: infoq.com/news/2014/06/apple-ios8-testflight