fix(mobile/ios): secure push relay resolution

.github/workflows/ci.yml

@@ -64,6 +64,7 @@
               - 'scripts/check-file-sizes-core.mjs'
               - 'scripts/check-file-sizes-core.test.mjs'
               - 'mobile/**'
+              - 'crates/buzz-push-gateway/tests/vectors/**'
               - 'scripts/mobile-release.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
@@ -72,6 +73,7 @@
               - 'scripts/test-mobile-release-contract.sh'
               - 'scripts/test-mobile-release-candidate-publisher.sh'
               - 'scripts/test-mobile-worktree-overrides.sh'
+              - 'scripts/test-ios-pbxproj-semantics.py'
               - '.github/workflows/mobile-release-candidate.yml'
               - '.github/workflows/ci.yml'
       - name: Release workflow source contract
@@ -860,9 +862,26 @@
       - name: Build Android debug APK
         run: just mobile-build-android
 
+  mobile-swift:
+    name: Mobile Swift
+    runs-on: macos-latest
+    timeout-minutes: 10
+    needs: [changes]
+    if: needs.changes.outputs.mobile == 'true'
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Build
+        run: swift build --package-path mobile/ios/BuzzPushKit
+      - name: Build release
+        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      - name: Test
+        run: swift test --package-path mobile/ios/BuzzPushKit
+      - name: Validate iOS project semantics
+        run: python3 scripts/test-ios-pbxproj-semantics.py
+
   security:
     name: Security
     runs-on: ubuntu-latest
     timeout-minutes: 20
     needs: [changes]
     if: github.event_name == 'push' || needs.changes.outputs.rust == 'true'

.intersect/sadscan.yaml

@@ -2,3 +2,14 @@
 exclude_rules_for_files:
   sq.pii.cc.visa:
     - Cargo.lock
+  # Self-signed test fixture generated solely to exercise reqwest identity parsing.
+  kingfisher.privkey.2:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"
+  np.pem.1:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"

crates/buzz-push-gateway/Cargo.toml

@@ -7,6 +7,10 @@ rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 
+[features]
+default = []
+dev-app-attest-bypass = []
+
 [lib]
 name = "buzz_push_gateway"
 path = "src/lib.rs"
@@ -29,9 +33,8 @@ getrandom = "0.4"
 metrics = { workspace = true }
 metrics-exporter-prometheus = { workspace = true }
 nostr = { workspace = true }
-p256 = { version = "0.14", features = ["ecdsa", "pem", "pkcs8"] }
 rand = { workspace = true }
-reqwest = { workspace = true }
+reqwest = { workspace = true, features = ["http2"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sqlx = { workspace = true }