Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mac: Enable signing with self signed cert #2944

Merged
merged 1 commit into from
Jun 11, 2023
Merged

Mac: Enable signing with self signed cert #2944

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 31 additions & 2 deletions .github/autobuild/mac.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,27 @@ prepare_signing() {
[[ -n "${MACOS_CERTIFICATE:-}" ]] || return 1
[[ -n "${MACOS_CERTIFICATE_ID:-}" ]] || return 1
[[ -n "${MACOS_CERTIFICATE_PWD:-}" ]] || return 1
[[ -n "${NOTARIZATION_PASSWORD:-}" ]] || return 1
[[ -n "${KEYCHAIN_PASSWORD:-}" ]] || return 1

# Check for notarization (not wanted on self signed build)
if [[ -z "${NOTARIZATION_PASSWORD}" ]]; then
echo "Notarization password not found or empty. This suggests we might run a self signed build."
if [[ -z "${MACOS_CA_PUBLICKEY}" ]]; then
echo "Warning: The CA public key wasn't set or is empty. Skipping signing."
return 1
fi
fi

echo "Signing was requested and all dependencies are satisfied"

# Put the cert to a file
echo "${MACOS_CERTIFICATE}" | base64 --decode > certificate.p12

# If set, put the CA public key into a file
if [[ -n "${MACOS_CA_PUBLICKEY}" ]]; then
echo "${MACOS_CA_PUBLICKEY}" | base64 --decode > CA.cer
fi

# Set up a keychain for the build:
security create-keychain -p "${KEYCHAIN_PASSWORD}" build.keychain
security default-keychain -s build.keychain
Expand All @@ -58,8 +71,24 @@ prepare_signing() {
security import certificate.p12 -k build.keychain -P "${MACOS_CERTIFICATE_PWD}" -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${KEYCHAIN_PASSWORD}" build.keychain

# Tell Github Workflow that we need notarization & stapling:
# Tell Github Workflow that we want signing
echo "macos_signed=true" >> "$GITHUB_OUTPUT"

# If set, import CA key to allow self signed key
if [[ -n "${MACOS_CA_PUBLICKEY}" ]]; then
# bypass any GUI related trusting prompt (https://developer.apple.com/forums/thread/671582)
echo "Importing development only CA"
# shellcheck disable=SC2024
sudo security authorizationdb read com.apple.trust-settings.admin > rights
sudo security authorizationdb write com.apple.trust-settings.admin allow
sudo security add-trusted-cert -d -r trustRoot -k "build.keychain" CA.cer
# shellcheck disable=SC2024
sudo security authorizationdb write com.apple.trust-settings.admin < rights
else
# Tell Github Workflow that we need notarization & stapling (non self signed build)
echo "macos_notarize=true" >> "$GITHUB_OUTPUT"
fi

return 0
}

Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/autobuild.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,7 +365,7 @@ jobs:
MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERT_ID }}
NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}

MACOS_CA_PUBLICKEY: ${{ secrets.MACOS_CA_PUBKEY }}
- name: Post-Build for ${{ matrix.config.config_name }}
id: get-artifacts
run: ${{ matrix.config.base_command }} get-artifacts
Expand Down Expand Up @@ -394,7 +394,8 @@ jobs:
- name: Notarize macOS Release Build
if: >-
steps.build.outputs.macos_signed == 'true' &&
needs.create_release.outputs.publish_to_release == 'true'
needs.create_release.outputs.publish_to_release == 'true' &&
steps.build.outputs.macos_notarize == 'true'
id: notarize-macOS-app
uses: devbotsxyz/xcode-notarize@d7219e1c390b47db8bab0f6b4fc1e3b7943e4b3b
with:
Expand All @@ -406,7 +407,8 @@ jobs:
- name: Staple macOS Release Build
if: >-
steps.build.outputs.macos_signed == 'true' &&
needs.create_release.outputs.publish_to_release == 'true'
needs.create_release.outputs.publish_to_release == 'true' &&
steps.build.outputs.macos_notarize == 'true'
id: staple-macOS-app
uses: devbotsxyz/xcode-staple@ae68b22ca35d15864b7f7923e1a166533b2944bf
with:
Expand Down