Skip to content

Use maintained gon fork to address Apple signing deprecation #1997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ddelnano merged 6 commits into from
Sep 5, 2024
Merged

Use maintained gon fork to address Apple signing deprecation #1997

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4f0e201
Use maintained gon fork to address Apple signing deprecation
ddelnano Aug 28, 2024
8ddbf75
Ensure apple_id.provider is set to the team ID
ddelnano Aug 29, 2024
d2e0e93
Use new apple developer application and cert
ddelnano Sep 3, 2024
ad6f51c
Use correct password mechanism in gon fork (AC_PASSWORD env var)
ddelnano Sep 3, 2024
ff89e27
Ensure artifact_utils functions won't silently fail. Add git safe dir…
ddelnano Sep 4, 2024
50462da
Consolidate set -ex into shebang line
ddelnano Sep 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions .github/workflows/cli_release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,11 +88,11 @@ jobs:
- name: Add pwd to git safe dir
run: git config --global --add safe.directory `pwd`
- name: Install gon
run: brew install mitchellh/gon/gon
run: brew install Bearer/tap/gon
- name: Sign CLI release
env:
REF: ${{ github.event.ref }}
AC_PASSWD: ${{ secrets.APPLE_ID_PASSWORD }}
AC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
CERT_BASE64: ${{ secrets.APPLE_SIGN_CERT_B64 }}
CERT_PASSWORD: ${{ secrets.APPLE_SIGN_CERT_PASSWORD }}
Expand Down Expand Up @@ -135,6 +135,9 @@ jobs:
uses: ./.github/actions/gcloud_creds
with:
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
- name: Add pwd to git safe dir
run: |
git config --global --add safe.directory `pwd`
- name: Upload signed CLI
env:
REF: ${{ github.event.ref }}
Expand Down
4 changes: 1 addition & 3 deletions ci/cli_upload_signed.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/env bash
#!/bin/bash -ex

# Copyright 2018- The Pixie Authors.
#
Expand All @@ -21,8 +21,6 @@ repo_path=$(bazel info workspace)
# shellcheck source=ci/artifact_utils.sh
. "${repo_path}/ci/artifact_utils.sh"

set -ex

printenv

release_tag=${TAG_NAME##*/v}
Expand Down
11 changes: 5 additions & 6 deletions ci/gon.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,16 @@
// using Gon.

source = ["./cli_darwin_amd64", "./cli_darwin_arm64", "cli_darwin_universal"]
bundle_id = "ai.pixielabs.px"
bundle_id = "ai.getcosmic.px"

// TODO(zasgar): Update this to the orders@pixielabs.ai account. It has access to the certs,
// but does not have access to application passwords.
apple_id {
username = "zasgar@gmail.com"
password = "@env:AC_PASSWD"
username = "apple-dev@getcosmic.ai"
# Password is provided via AC_PASSWORD env var
provider = "769M9XJDG6"
}

sign {
application_identity = "Developer ID Application: Pixie Labs Inc. (SZCNTABEXY)"
application_identity = "Developer ID Application: Cosmic Observe, Inc."
}

zip {
Expand Down