pass --verify-entitlements to assemble_bundle if flag is present

Summary:
Pass --verify-entitlements to assemble_bundle.py if the attribute is present and set to true.

In a later diff, we will actually call check_entitlements.py from assemble_bundle when the flag is passed.

Reviewed By: milend

Differential Revision: D91254251

fbshipit-source-id: be988a7717af9b2d0a038f561b00087087cceb73

Author: watwars

prelude/apple/apple_bundle_part.bzl

@@ -219,14 +219,16 @@ def assemble_bundle(
         codesign_manifest.as_output(),
     ]
 
+    verify_entitlements_args = ["--verify-entitlements"] if ctx.attrs.entitlements_verification_check_enabled else []
+
     command = cmd_args(
         [
             tool,
             "--output",
             bundle.as_output(),
             "--spec",
             spec_file,
-        ] + codesign_args + codesign_bundle_extra_args + platform_args + swift_args,
+        ] + codesign_args + codesign_bundle_extra_args + verify_entitlements_args + platform_args + swift_args,
         hidden =
             [part.source for part in all_parts] +
             [part.codesign_entitlements for part in all_parts if part.codesign_entitlements] +

prelude/apple/tools/bundling/main.py

@@ -196,6 +196,11 @@ def _args_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Create symlinks for versioned macOS bundle",
     )
+    parser.add_argument(
+        "--verify-entitlements",
+        action="store_true",
+        help="Verify that the bundle's entitlements match the provisioning profile",
+    )
 
     add_args_for_signing_context(parser)