diff --git a/.github/assets/entitlements.plist b/.github/assets/entitlements.plist new file mode 100644 index 000000000..6a297d495 --- /dev/null +++ b/.github/assets/entitlements.plist @@ -0,0 +1,18 @@ + + + + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-executable-page-protection + + com.apple.security.cs.allow-dyld-environment-variables + + com.apple.security.cs.disable-library-validation + + com.apple.security.cs.debugger + + + diff --git a/.github/assets/sts4.icns b/.github/assets/sts4.icns new file mode 100644 index 000000000..dc3b53dc9 Binary files /dev/null and b/.github/assets/sts4.icns differ diff --git a/.github/scripts/sign-notarize-osx-distro-file.sh b/.github/scripts/sign-notarize-osx-distro-file.sh new file mode 100644 index 000000000..ce678e183 --- /dev/null +++ b/.github/scripts/sign-notarize-osx-distro-file.sh @@ -0,0 +1,48 @@ +# Takes a .tar.gz file as a parameter, entitlements.plist file path and icns file path +set -e + +file=$1 +entitlements=$2 +icns=$3 +filename="$(basename -- $file)" +dir="$(dirname "$file")" + +echo "****************************************************************" +echo "*** Processing : ${file}" +echo "****************************************************************" +destination_folder_name=extracted_${filename} +echo "Extracting archive ${filename} to ${dir}/${destination_folder_name}" +mkdir ${dir}/${destination_folder_name} +tar -zxf $file --directory ${dir}/${destination_folder_name} +echo "Successfully extracted ${filename}" +echo "About to sign OSX .app file: ${dir}/${destination_folder_name}/SpringToolSuite4.app" +codesign --verbose --deep --force --timestamp --entitlements $entitlements --options=runtime --keychain $KEYCHAIN -s $MACOS_CERTIFICATE_ID ${dir}/${destination_folder_name}/SpringToolSuite4.app + +cd ${dir}/${destination_folder_name} +echo "Generating dmg-config.json..." +echo '{' >> dmg-config.json +echo ' "title": "Spring Tool Suite 4",' >> dmg-config.json +echo ' "icon": "/Users/aboyko/git/sts4/eclipse-distribution/org.springframework.boot.ide.branding/sts4.icns",' >> dmg-config.json +echo ' "contents": [' >> dmg-config.json +echo ' { "x": 192, "y": 100, "type": "file", "path": "./SpringToolSuite4.app" },' >> dmg-config.json +echo ' { "x": 448, "y": 100, "type": "link", "path": "/Applications" },' >> dmg-config.json +echo ' { "x": 1000, "y": 2000, "type": "file", "path": "'$icns'", "name": ".VolumeIcon.icns" }' >> dmg-config.json +echo ' ],' >> dmg-config.json +echo ' "format": "UDZO"' >> dmg-config.json +echo '}' >> dmg-config.json +cat ./dmg-config.json +dmg_filename=${filename%.*.*}.dmg +appdmg ./dmg-config.json ../${dmg_filename} +cd .. +rm -rf ./${destination_folder_name} +rm -f $filename + +echo "Sign $dmg_filename" +codesign --verbose --deep --force --timestamp --keychain $KEYCHAIN -s $MACOS_CERTIFICATE_ID $dmg_filename + +echo "Notarizing $dmg_filename" +xcrun notarytool submit ${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait & + +#echo "Creating checksums sha-256 and md5 for ${file}" +#shasum -a 256 $filename > ${filename}.sha256 +#md5 $filename > ${filename}.md5 diff --git a/.github/workflows/gh-hosted-eclipse-distro-build.yml b/.github/workflows/gh-hosted-eclipse-distro-build.yml index 937f15275..f5c97d17f 100644 --- a/.github/workflows/gh-hosted-eclipse-distro-build.yml +++ b/.github/workflows/gh-hosted-eclipse-distro-build.yml @@ -89,7 +89,7 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_S3_SECRET_KEY }} run: | echo "Uploading Win Zips to S3 for signing..." - aws s3 cp ${{ github.workspace }}/eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target/products s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --exclude "*/*" --no-progress + aws s3 cp ${{ github.workspace }}/eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target/products s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip" --include "spring-tool-suite-4*macosx*.tar.gz" --exclude "*/*" --no-progress - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce with: name: s3-dist-path-${{ github.run_id }}.${{ github.run_attempt }} @@ -97,7 +97,7 @@ jobs: retention-days: 1 - sign-win-executable: + sign-win-distros: needs: eclipse-distro-build runs-on: self-hosted steps: @@ -137,10 +137,65 @@ jobs: echo "Removing old win zip and self extracting jar files from s3..." aws s3 rm s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" echo "Uploading new win zip and self extracting jar files to s3..." - aws s3 mv . s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" --acl public-read --no-progress + aws s3 mv . s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" --acl public-read --no-progress + + sign-osx-distros: + needs: eclipse-distro-build + runs-on: macos-latest + steps: + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 + with: + sparse-checkout: | + .github + - name: Create Keychain. Add Mac App Dev Certificate to Keychain + env: + BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} + P12_PASSWORD: ${{ secrets.P12_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + run: | + CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 + KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db + + echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH + + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN + security set-keychain-settings -lut 21600 $KEYCHAIN + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN + + security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN + security list-keychain -d user -s $KEYCHAIN + - name: Unlock Keychain for OSX signing + run: | + security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} $RUNNER_TEMP/app-signing.keychain-db + - name: Install appdmg + run: | + npm install -g appdmg + - name: Setup Notarization Credentials + run: | + xcrun notarytool store-credentials notarize-app-dmg-profile --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }} + - name: Download OSX tarr.gz files from S3 for Signing/Notarization + env: + AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_S3_ACCESS_KEY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_S3_SECRET_KEY }} + run: | + rm -rf *macosx* + ls + aws s3 mv s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} . --recursive --exclude "*" --include "spring-tool-suite-4*macosx*.tar.gz" --exclude "*/*" --no-progress + - name: Sign .app, Create DMG, Sign and Notarize DMG + env: + MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }} + run: | + KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db + files=`ls spring-tool-suite-4*macosx*.tar.gz` + for file in $files + do + ${{ github.workspace }}/.github/scripts/sign-notarize-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns + done + wait + echo "Done sign and notarization" cleanup: - needs: [ sign-win-executable ] + needs: [ sign-win-distros, sign-osx-distros ] if: ${{ always() }} runs-on: ubuntu-latest steps: