mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-06-14 01:54:47 -07:00
split sign+notarize into own script
This commit is contained in:
tooomm
parent
c14a008080
commit
e353f4968b
2 changed files with 83 additions and 40 deletions
76
.ci/sign_macos_bundle.sh
Executable file
76
.ci/sign_macos_bundle.sh
Executable file
|
|
@ -0,0 +1,76 @@
|
|||
#!/bin/bash
|
||||
|
||||
# This script is to be used by the ci environment.
|
||||
|
||||
# Signs and notarizes a macOS app bundle
|
||||
# Requires: $1 - path to the app bundle
|
||||
# Environment variables:
|
||||
# - MACOS_CERTIFICATE_NAME: Name of the certificate for signing (optional, skips signing if not set)
|
||||
# - MACOS_CI_KEYCHAIN_PWD: Password for the CI keychain (required if MACOS_CERTIFICATE_NAME is set)
|
||||
# - MACOS_NOTARIZATION_APPLE_ID: Apple ID for notarization (optional, skips notarization if not set)
|
||||
# - MACOS_NOTARIZATION_PWD: Password for notarization (required if MACOS_NOTARIZATION_APPLE_ID is set)
|
||||
# - MACOS_NOTARIZATION_TEAM_ID: Team ID for notarization (required if MACOS_NOTARIZATION_APPLE_ID is set)
|
||||
# exitcode: 1 for failure, 2 for invalid arguments
|
||||
|
||||
set -e
|
||||
|
||||
# Check input arguments
|
||||
if [[ $# -lt 1 ]]; then
|
||||
echo "::error file=$0::No argument passed to the script - provide <path_to_app_bundle>"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
APP_BUNDLE_PATH="$1"
|
||||
|
||||
# Verify that the app bundle exists
|
||||
if [[ ! -e "$APP_BUNDLE_PATH" ]]; then
|
||||
echo "::error file=$0::App bundle not found at: $APP_BUNDLE_PATH"
|
||||
fi
|
||||
|
||||
# Sign the app bundle
|
||||
if [[ -n "$MACOS_CERTIFICATE_NAME" ]]; then
|
||||
echo "::group::Sign app bundle"
|
||||
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
||||
/usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "$APP_BUNDLE_PATH"
|
||||
echo "::endgroup::"
|
||||
else
|
||||
echo "::error file=$0::MACOS_CERTIFICATE_NAME not set. Can not sign the app bundle."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Notarize the app bundle
|
||||
if [[ -n "$MACOS_NOTARIZATION_APPLE_ID" ]]; then
|
||||
echo "::group::Notarize app bundle"
|
||||
# Store the notarization credentials so that we can prevent a UI password dialog from blocking the CI
|
||||
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD"
|
||||
|
||||
# We can't notarize an app bundle directly, but we need to compress it as an archive.
|
||||
# Therefore, we create a zip file containing our app bundle, so that we can send it to the notarization service
|
||||
echo ""
|
||||
echo "Creating temp notarization archive"
|
||||
ditto -c -k --keepParent "$APP_BUNDLE_PATH" "notarization.zip"
|
||||
|
||||
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
||||
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App characteristics.
|
||||
# Visit the Notarization docs for more information and strategies on how to optimize it if you're curious.
|
||||
echo ""
|
||||
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
|
||||
echo "::endgroup::"
|
||||
|
||||
echo "::group::Staple app"
|
||||
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
||||
# validated by macOS even when an internet connection is not available.
|
||||
echo "Attach staple"
|
||||
xcrun stapler staple "$APP_BUNDLE_PATH"
|
||||
echo "::endgroup::"
|
||||
|
||||
echo "::group::Cleanup"
|
||||
# Cleanup keychain and files to avoid leaking credentials
|
||||
echo "Deleting keychain"
|
||||
security delete-keychain build.keychain
|
||||
rm -f certificate.p12 notarization.zip
|
||||
echo "::endgroup::"
|
||||
else
|
||||
echo "::error file=$0::MACOS_NOTARIZATION_APPLE_ID not set. Can not notarize the app bundle."
|
||||
exit 1
|
||||
fi
|
||||
47
.github/workflows/desktop-build.yml
vendored
47
.github/workflows/desktop-build.yml
vendored
|
|
@ -446,8 +446,8 @@ jobs:
|
|||
VCPKG_BINARY_SOURCES: 'clear;files,${{ steps.vcpkg-cache.outputs.path }},readwrite'
|
||||
# macOS-specific environment variables, will be ignored on Windows
|
||||
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
|
||||
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
||||
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
||||
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
||||
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
||||
DEVELOPER_DIR: '/Applications/Xcode_${{matrix.xcode}}.app/Contents/Developer'
|
||||
TARGET_MACOS_VERSION: ${{ matrix.override_target }}
|
||||
|
|
@ -472,50 +472,17 @@ jobs:
|
|||
path: ${{env.CCACHE_DIR}}
|
||||
key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
|
||||
|
||||
- name: Sign app bundle
|
||||
if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
|
||||
id: sign_macos
|
||||
- name: Sign & notarize app bundle
|
||||
# if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
|
||||
if: matrix.os == 'macOS'
|
||||
shell: bash
|
||||
env:
|
||||
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
||||
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
||||
run: |
|
||||
if [[ -n "$MACOS_CERTIFICATE_NAME" ]]
|
||||
then
|
||||
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
||||
/usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{steps.build.outputs.path}}"
|
||||
fi
|
||||
|
||||
- name: Notarize app bundle
|
||||
if: steps.sign_macos.outcome == 'success'
|
||||
env:
|
||||
MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
|
||||
MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
|
||||
MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
|
||||
run: |
|
||||
if [[ -n "$MACOS_NOTARIZATION_APPLE_ID" ]]
|
||||
then
|
||||
# Store the notarization credentials so that we can prevent a UI password dialog from blocking the CI
|
||||
echo "Create keychain profile"
|
||||
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD"
|
||||
|
||||
# We can't notarize an app bundle directly, but we need to compress it as an archive.
|
||||
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
|
||||
# notarization service
|
||||
echo "Creating temp notarization archive"
|
||||
ditto -c -k --keepParent "${{steps.build.outputs.path}}" "notarization.zip"
|
||||
|
||||
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
||||
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
|
||||
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
|
||||
# you're curious
|
||||
echo "Notarize app"
|
||||
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
|
||||
|
||||
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
||||
# validated by macOS even when an internet connection is not available.
|
||||
echo "Attach staple"
|
||||
xcrun stapler staple "${{steps.build.outputs.path}}"
|
||||
fi
|
||||
MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
|
||||
run: .ci/sign_macos_bundle.sh "${{ steps.build.outputs.path }}"
|
||||
|
||||
- name: Upload artifact
|
||||
if: matrix.make_package
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue