Check the current revocation status of a remote IPA

checkipa.sh

# requirements:
# pzb from https://github.com/tihmstar/partialZipBrowser
# plutil (included in macOS)
# wget
# openssl

set -e

printf "$1: "
mytemp=$(mktemp -d)
trap 'rm -rf -- "$mytemp"' EXIT
cd $mytemp
fname=$(pzb -l "$1" | grep "embedded.mobileprovision" | sed 's|.*f \(.*\)$|\1|')
pzb -g "$fname" "$1" >/dev/null 2>&1
openssl smime -verify -noverify -in embedded.mobileprovision -inform DER -out mprov.xml >/dev/null 2>&1
plutil -extract DeveloperCertificates.0 raw mprov.xml 2>/dev/null | base64 -D > cert.pem
wget -q https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
openssl ocsp -issuer AppleWWDRCAG3.cer -cert cert.pem -url ocsp.apple.com/ocsp03-wwdrg301 2>/dev/null | grep -e "cert.pem: " -e "Revocation Time:" | tr -d '\n' | sed 's/cert.pem: //' | sed 's/\tRevocation Time:/ at/'
printf '\n'