Skip to content

Replace gon macos signing with notarytool #1994

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ddelnano wants to merge 5 commits into from
Closed

Replace gon macos signing with notarytool #1994

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
82a7944
Replace gon macos signing with notarytool
ddelnano Aug 26, 2024
253cc0c
Refactor apple and team id to be provided by GitHub actions environme…
ddelnano Aug 26, 2024
2e5feeb
Use xcrun to locate notarytool binary
ddelnano Aug 26, 2024
7f18434
Remove --bundle-id since it is not a flag for the notarytool submit c…
ddelnano Aug 26, 2024
9ee8c2d
Use ditto to package the binaries into a zip file
ddelnano Aug 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/cli_release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,12 +87,12 @@ jobs:
fetch-depth: 0
- name: Add pwd to git safe dir
run: git config --global --add safe.directory `pwd`
- name: Install gon
run: brew install mitchellh/gon/gon
- name: Sign CLI release
env:
REF: ${{ github.event.ref }}
APPLE_ID: "zasgar@gmail.com"
AC_PASSWD: ${{ secrets.APPLE_ID_PASSWORD }}
TEAM_ID: "SZCNTABEXY"
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
CERT_BASE64: ${{ secrets.APPLE_SIGN_CERT_B64 }}
CERT_PASSWORD: ${{ secrets.APPLE_SIGN_CERT_PASSWORD }}
Expand Down
15 changes: 11 additions & 4 deletions ci/cli_merge_sign.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,15 @@ done
# Create a universal binary.
lipo -create -output cli_darwin_universal cli_darwin_arm64 cli_darwin_amd64

gon ci/gon.hcl
export APP_IDENTITY="Developer ID Application: Pixie Labs Inc. (${TEAM_ID})"
codesign -f -v --timestamp --options runtime -s "${APP_IDENTITY}" cli_darwin_universal cli_darwin_arm64 cli_darwin_amd64
Copy link
Member Author

@ddelnano ddelnano Aug 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was modeled off how gon runs codesign (source)


cp cli_darwin_universal "${artifacts_dir}"
cp cli_darwin_amd64 "${artifacts_dir}"
cp cli_darwin_arm64 "${artifacts_dir}"
notary_dir="$(mktemp -d)"
cp cli_darwin_universal "${notary_dir}"
cp cli_darwin_amd64 "${notary_dir}"
cp cli_darwin_arm64 "${notary_dir}"

ditto -c -k "${notary_dir}" notarized-cli.zip
xcrun notarytool submit notarized-cli.zip --apple-id "${APPLE_ID}" --password "${AC_PASSWD}" --team-id "${TEAM_ID}" --progress --verbose --wait

cp "${notary_dir}"/* "${artifacts_dir}"
20 changes: 0 additions & 20 deletions ci/gon.hcl
View file
Open in desktop

This file was deleted.