IPA file – An in-depth view

An IPA file extension is used to represent an archive containing Apple app bundle. The IPA file is a zip archive, so that when the file extension .ipa is changed to .zip, the archive can be opened and files can be extracted. The IPA file contains a ‘Payload’ folder and an iTunesArtwork file. The iTunesArtwork file is used to show the app icon in the App Store and iTunes and contains a 512×512 PNG image. Payload folder contains all data related to the app. An iTunesMetadata.plist can be seen inside the IPA file, which contains details such as Apple ID, artist name, buy-only (can be set true or false), version, price, publisher and all other information regarding the app. A PLIST file is an XML file.

When opening a Payload folder, there is a .app folder which represents the name of the application. In this folder, all data related to the app can be found. There are a lot of .lproj folders which represents languages such as English, Spanish etc. The .lproj are folders holding localizations and each .lproj contains a Localizable.strings file. The Localizable.strings file is also an XML file. An executable file (with no file extension) is present in the .app. Executable files are specified using Info.plist.

Two Localizable.strings file samples (a part of the file) are given below, one located in en.lproj (English),

and the other in fr.lproj (French).

There will be a .bundle folder inside an IPA file, such as Settings.bundle or FBConnect.bundle. Settings.bundle stores setting page files.

Information Property Lists (Info.plist) in an IPA File

Information Property Lists can be seen inside the root folder of an IPA bundle. The contents of a sample Info.plist is given below:

All keys used in Info.plist file, and its values can be seen at About Info.plist Keys and Values.

Code Signing

Some IPA files uses Code Signing. Code signature is used to determine whether the code is modified by any person other than the one who signed the app. An update can be identified by the system as the same app if the same unique identifier is used to sign the new version. Signed code can be seen in .ipa\Payload\.app\_CodeSignature\CodeResources.

A sample signed code is shown below. The signed code is an XML code.

Code signature consists of:

• Seal: Seal is a collection of hashes of various parts of the code.
• Digital signature: A digital signature is used to sign the seal.
• Unique identifier: A unique identifier is provided in the code signature for identifying the code.

Code signing is used mainly for three purposes, to determine whether:

1. A piece of code is modified,
2. The different versions of code come from the same source, and
3. The app is reliable (for example, whether the app access keychain).

PkgInfo

PkgInfo file is used to alternatively specify the application type (4 bytes) followed by signature (4 bytes). For example, a PkgInfo file contains “APPLtxtt” for TextEdit application. This file is not required, and the information in it can be given inside the information property list within the IPA file.