From b94c25425f12757535887fa07d117ae775598403 Mon Sep 17 00:00:00 2001 From: aboyko Date: Wed, 19 Jul 2023 20:54:28 -0400 Subject: [PATCH] GHA: osx notarization wait and parallelize --- .github/scripts/notarize-osx-distro-file.sh | 16 ++++ ...distro-file.sh => sign-osx-distro-file.sh} | 11 +-- .../gh-hosted-eclipse-distro-build.yml | 79 ++++++++++--------- 3 files changed, 61 insertions(+), 45 deletions(-) create mode 100755 .github/scripts/notarize-osx-distro-file.sh rename .github/scripts/{sign-notarize-osx-distro-file.sh => sign-osx-distro-file.sh} (83%) diff --git a/.github/scripts/notarize-osx-distro-file.sh b/.github/scripts/notarize-osx-distro-file.sh new file mode 100755 index 000000000..2653e7531 --- /dev/null +++ b/.github/scripts/notarize-osx-distro-file.sh @@ -0,0 +1,16 @@ +# Takes a DMG file as parameter +set -e + +$dmg_file=$1 +dmg_filename="$(basename -- $dmg_file)" +dir="$(dirname "$dmg_file")" + +echo "****************************************************************" +echo "*** Notarizing: ${dmg_filename}" +echo "****************************************************************" +cd $dir +xcrun notarytool submit ./${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait +echo "Staple and generate checksums for ${dmg_filename}" +xcrun stapler staple $dmg_filename +shasum -a 256 $dmg_filename > ${dmg_filename}.sha256 +md5 $dmg_filename > ${dmg_filename}.md5) \ No newline at end of file diff --git a/.github/scripts/sign-notarize-osx-distro-file.sh b/.github/scripts/sign-osx-distro-file.sh similarity index 83% rename from .github/scripts/sign-notarize-osx-distro-file.sh rename to .github/scripts/sign-osx-distro-file.sh index 7d20f0f6f..3580bf2f5 100755 --- a/.github/scripts/sign-notarize-osx-distro-file.sh +++ b/.github/scripts/sign-osx-distro-file.sh @@ -8,7 +8,7 @@ filename="$(basename -- $file)" dir="$(dirname "$file")" echo "****************************************************************" -echo "*** Processing : ${file}" +echo "*** Signing and creating DMG for: ${file}" echo "****************************************************************" destination_folder_name=extracted_${filename} echo "Extracting archive ${filename} to ${dir}/${destination_folder_name}" @@ -44,11 +44,4 @@ rm -f $filename echo "Sign ${dmg_filename}" echo 'codesign --verbose --deep --force --timestamp --keychain "'${KEYCHAIN}'" -s "'${MACOS_CERTIFICATE_ID}'" ./$dmg_filename' -codesign --verbose --deep --force --timestamp --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ./$dmg_filename - -echo "Notarizing $dmg_filename" -(xcrun notarytool submit ./${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait \ -&& echo "Staple and generate checksums for ${dmg_filename}" \ -&& xcrun stapler staple $dmg_filename \ -&& shasum -a 256 $dmg_filename > ${dmg_filename}.sha256 \ -&& md5 $dmg_filename > ${dmg_filename}.md5) & \ No newline at end of file +codesign --verbose --deep --force --timestamp --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ./$dmg_filename \ No newline at end of file diff --git a/.github/workflows/gh-hosted-eclipse-distro-build.yml b/.github/workflows/gh-hosted-eclipse-distro-build.yml index 01f94a9f9..b8202ed96 100644 --- a/.github/workflows/gh-hosted-eclipse-distro-build.yml +++ b/.github/workflows/gh-hosted-eclipse-distro-build.yml @@ -41,47 +41,47 @@ jobs: run: | echo "${{ secrets.GPG_PRIVATE_KEY }}" > gpg.asc echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --import gpg.asc - - name: Create Keychain. Add Mac App Dev Certificate to Keychain - env: - BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} - P12_PASSWORD: ${{ secrets.P12_PASSWORD }} - KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} - run: | - CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 - KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db - - echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH - - security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN - security set-keychain-settings -lut 21600 $KEYCHAIN - security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN - - security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN - security list-keychain -d user -s $KEYCHAIN - - name: Unlock Keychain for OSX signing - run: | - security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} $RUNNER_TEMP/app-signing.keychain-db - - name: Install appdmg - run: | - npm install -g appdmg - - name: Create Temp Directory Structure for Notarization Service - run: | - cd /tmp - mkdir -p macos-notarization-service/pending-files +# - name: Create Keychain. Add Mac App Dev Certificate to Keychain +# env: +# BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} +# P12_PASSWORD: ${{ secrets.P12_PASSWORD }} +# KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} +# run: | +# CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 +# KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db +# +# echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH +# +# security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN +# security set-keychain-settings -lut 21600 $KEYCHAIN +# security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN +# +# security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN +# security list-keychain -d user -s $KEYCHAIN +# - name: Unlock Keychain for OSX signing +# run: | +# security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} $RUNNER_TEMP/app-signing.keychain-db +# - name: Install appdmg +# run: | +# npm install -g appdmg +# - name: Create Temp Directory Structure for Notarization Service +# run: | +# cd /tmp +# mkdir -p macos-notarization-service/pending-files - name: Build Eclipse Distro env: tools_s3_access_key: ${{ secrets.TOOLS_S3_ACCESS_KEY }} tools_s3_secret_key: ${{ secrets.TOOLS_S3_SECRET_KEY }} gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }} gpg_keyname: ${{ secrets.GPG_KEYID }} - MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }} - MACOS_NOTARIZATION_SERVICE_URL: http://localhost:8080 - AC_USERNAME: ${{ secrets.AC_USERNAME }} - AC_PASSWORD: ${{ secrets.AC_PASSWORD }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} +# MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }} +# MACOS_NOTARIZATION_SERVICE_URL: http://localhost:8080 +# AC_USERNAME: ${{ secrets.AC_USERNAME }} +# AC_PASSWORD: ${{ secrets.AC_PASSWORD }} +# APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} run: | cd eclipse-distribution - KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db +# KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db ./mvnw --batch-mode -U clean deploy -P${{ inputs.eclipse_profile }} -P${{ inputs.build_type }} -Pgitactions -Pgpg.sign -Dsigning.skip=true -Dmaven.repo.local=~/.m2/repository-signed -Dhttpclient.retry-max=20 -Dmaven.test.skip=true -Declipse.p2.mirrors=false -Dtycho.localArtifacts=ignore -Ds3service.https-only=true -Dp2.replaceQualifier=true -Dorg.eclipse.ecf.provider.filetransfer.httpclient.retrieve.readTimeout=1200000 -Dorg.eclipse.equinox.p2.transport.ecf.retry=5 -Dskip.eclipserun.proxies=false -Dskip.osx.signing=true -Dskip.win.signing=true -Dskip.osx.notarizing=true -Dtycho.equinox.resolver.uses=true - name: Upload Build Artifacts for Signing env: @@ -152,9 +152,11 @@ jobs: BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} P12_PASSWORD: ${{ secrets.P12_PASSWORD }} KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + KEYCHAIN: ${{ github.env.$RUNNER_TEMP }}/app-signing.keychain-db run: | CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 - KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db + + echo $KEYCHAIN echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH @@ -184,13 +186,18 @@ jobs: - name: Sign .app, Create DMG, Sign and Notarize DMG env: MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }} + KEYCHAIN: ${{ github.env.$RUNNER_TEMP }}/app-signing.keychain-db run: | - export KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db ls ${{ github.workspace }}/.github/assets files=`ls spring-tool-suite-4*macosx*.tar.gz` for file in $files do - ${{ github.workspace }}/.github/scripts/sign-notarize-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns + ${{ github.workspace }}/.github/scripts/sign-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns + done + dmg_files=`ls spring-tool-suite-4*macosx*.dmg` + for dmg_file in $dmg_files + do + ${{ github.workspace }}/.github/scripts/notarize-osx-distro-file.sh $dmg_file & done wait echo "Done signing and notarization of DMG files"