Spring/spring-tools
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

GHA: correct notarization script, cleanup. Define KEYCHAIN var in scripts

Browse Source
This commit is contained in:
aboyko
2023-07-19 21:35:51 -04:00
parent a543ab19dd
commit c34f47dce8
3 changed files with 9 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/scripts/notarize-osx-distro-file.sh vendored
View File

@@ -1,7 +1,8 @@
# Takes a DMG file as parameter
set -e
$dmg_file=$1
dmg_file=$1
notarize_profile=$2
dmg_filename="$(basename -- $dmg_file)"
dir="$(dirname "$dmg_file")"
@@ -9,7 +10,7 @@ echo "****************************************************************"
echo "*** Notarizing: ${dmg_filename}"
echo "****************************************************************"
cd $dir
xcrun notarytool submit ./${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait
xcrun notarytool submit ./${dmg_filename} --keychain-profile $notarize_profile --wait
echo "Staple and generate checksums for ${dmg_filename}"
xcrun stapler staple $dmg_filename
shasum -a 256 $dmg_filename > ${dmg_filename}.sha256

5
.github/scripts/sign-osx-distro-file.sh vendored
View File

@@ -16,9 +16,7 @@ mkdir ${dir}/${destination_folder_name}
tar -zxf $file --directory ${dir}/${destination_folder_name}
echo "Successfully extracted ${filename}"
echo "About to sign OSX .app file: ${dir}/${destination_folder_name}/SpringToolSuite4.app"
ls ${dir}/${destination_folder_name}
echo "keychain ${KEYCHAIN}"
echo "entitlements ${entitlements}"
codesign --verbose --deep --force --timestamp --entitlements "${entitlements}" --options=runtime --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ${dir}/${destination_folder_name}/SpringToolSuite4.app
cd ${dir}/${destination_folder_name}
@@ -37,11 +35,8 @@ cat ./dmg-config.json
dmg_filename=${filename%.*.*}.dmg
appdmg ./dmg-config.json ../${dmg_filename}
cd ..
pwd
ls
rm -rf ./${destination_folder_name}
rm -f $filename
echo "Sign ${dmg_filename}"
echo 'codesign --verbose --deep --force --timestamp --keychain "'${KEYCHAIN}'" -s "'${MACOS_CERTIFICATE_ID}'" ./$dmg_filename'
codesign --verbose --deep --force --timestamp --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ./$dmg_filename

15
.github/workflows/gh-hosted-eclipse-distro-build.yml vendored
View File

@@ -152,11 +152,9 @@ jobs:
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
KEYCHAIN: ${{ github.env.RUNNER_TEMP }}/app-signing.keychain-db
run: |
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
echo $KEYCHAIN
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
@@ -172,9 +170,6 @@ jobs:
- name: Install appdmg
run: |
npm install -g appdmg
- name: Setup Notarization Credentials
run: |
xcrun notarytool store-credentials notarize-app-dmg-profile --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }}
- name: Download OSX tar.gz files from S3 for Signing/Notarization
env:
AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_S3_ACCESS_KEY }}
@@ -186,18 +181,20 @@ jobs:
- name: Sign .app, Create DMG, Sign and Notarize DMG
env:
MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }}
KEYCHAIN: ${{ github.env.RUNNER_TEMP }}/app-signing.keychain-db
NOTARIZE_PROFILE: notarize-app-dmg-profile
run: |
export KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db
ls ${{ github.workspace }}/.github/assets
files=`ls spring-tool-suite-4*macosx*.tar.gz`
for file in $files
do
${{ github.workspace }}/.github/scripts/sign-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns
done
xcrun notarytool store-credentials $NOTARIZE_PROFILE --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }}
dmg_files=`ls spring-tool-suite-4*macosx*.dmg`
for dmg_file in $dmg_files
do
${{ github.workspace }}/.github/scripts/notarize-osx-distro-file.sh $dmg_file &
${{ github.workspace }}/.github/scripts/notarize-osx-distro-file.sh $dmg_file $NOTARIZE_PROFILE &
done
wait
echo "Done signing and notarization of DMG files"