UDID Tools Website

The official UDID Tools marketing website and free Safari-based utility for retrieving an iPhone or iPad UDID. It is also a public integration example for @udid-tools/core and @udid-tools/device-info.

Local development

Use Node.js 22.14.0 or newer and the npm version declared in package.json.

npm ci --ignore-scripts --no-audit --no-fund
cp .env.example .env.local
npm run dev

Local development defaults to unsigned configuration profiles and development-only cryptographic keys. Production and preview deployments must configure their own signing, response-verification, challenge, and result-token secrets.

Run the full quality gate before proposing a change:

npm run verify
npm audit --audit-level=high
npm audit signatures

Release integrity

Releases contain the exact archived .vercel/output directory deployed to production, its checksum, CycloneDX SBOM, and portable Sigstore attestation bundles. Verify a downloaded artifact with:

gh attestation verify website-v1.0.0.vercel-output.tar.gz --repo udid-tools/website
sha256sum --check website-v1.0.0.vercel-output.tar.gz.sha256

Production deployment rebuilds nothing: Vercel receives the verified release artifact through vercel deploy --prebuilt. The release build also embeds its validated signed tag and exact commit SHA in that artifact. The footer links the tag to the corresponding GitHub Release and the full SHA to the immutable commit; preview builds show only their commit, while local builds make no deployment-source claim.

Security

Never report a vulnerability or share a real device identifier, result link, profile response, certificate, private key, or passphrase in a public issue. Use private vulnerability reporting.

License

MIT © UDID Tools contributors.