From c34f47dce8bf83e9bafa9e11616a4ac571b5b0c3 Mon Sep 17 00:00:00 2001
From: aboyko <aboyko@vmware.com>
Date: Wed, 19 Jul 2023 21:35:51 -0400
Subject: [PATCH] GHA: correct notarization script, cleanup. Define KEYCHAIN
 var in scripts

---
 .github/scripts/notarize-osx-distro-file.sh       |  5 +++--
 .github/scripts/sign-osx-distro-file.sh           |  5 -----
 .../workflows/gh-hosted-eclipse-distro-build.yml  | 15 ++++++---------
 3 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/.github/scripts/notarize-osx-distro-file.sh b/.github/scripts/notarize-osx-distro-file.sh
index 2653e7531..551f4c7e3 100755
--- a/.github/scripts/notarize-osx-distro-file.sh
+++ b/.github/scripts/notarize-osx-distro-file.sh
@@ -1,7 +1,8 @@
 # Takes a DMG file as parameter
 set -e
 
-$dmg_file=$1
+dmg_file=$1
+notarize_profile=$2
 dmg_filename="$(basename -- $dmg_file)"
 dir="$(dirname "$dmg_file")"
 
@@ -9,7 +10,7 @@ echo "****************************************************************"
 echo "*** Notarizing: ${dmg_filename}"
 echo "****************************************************************"
 cd $dir
-xcrun notarytool submit ./${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait
+xcrun notarytool submit ./${dmg_filename} --keychain-profile $notarize_profile --wait
 echo "Staple and generate checksums for ${dmg_filename}"
 xcrun stapler staple $dmg_filename
 shasum -a 256 $dmg_filename > ${dmg_filename}.sha256
diff --git a/.github/scripts/sign-osx-distro-file.sh b/.github/scripts/sign-osx-distro-file.sh
index 3580bf2f5..93e64b76f 100755
--- a/.github/scripts/sign-osx-distro-file.sh
+++ b/.github/scripts/sign-osx-distro-file.sh
@@ -16,9 +16,7 @@ mkdir ${dir}/${destination_folder_name}
 tar -zxf $file --directory ${dir}/${destination_folder_name}
 echo "Successfully extracted ${filename}"
 echo "About to sign OSX .app file: ${dir}/${destination_folder_name}/SpringToolSuite4.app"
-ls ${dir}/${destination_folder_name}
 echo "keychain ${KEYCHAIN}"
-echo "entitlements ${entitlements}"
 codesign --verbose --deep --force --timestamp --entitlements "${entitlements}" --options=runtime --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ${dir}/${destination_folder_name}/SpringToolSuite4.app
 
 cd ${dir}/${destination_folder_name}
@@ -37,11 +35,8 @@ cat ./dmg-config.json
 dmg_filename=${filename%.*.*}.dmg
 appdmg ./dmg-config.json ../${dmg_filename}
 cd ..
-pwd
-ls
 rm -rf ./${destination_folder_name}
 rm -f $filename
 
 echo "Sign ${dmg_filename}"
-echo 'codesign --verbose --deep --force --timestamp --keychain "'${KEYCHAIN}'" -s "'${MACOS_CERTIFICATE_ID}'" ./$dmg_filename'
 codesign --verbose --deep --force --timestamp --keychain "${KEYCHAIN}" -s "${MACOS_CERTIFICATE_ID}" ./$dmg_filename
\ No newline at end of file
diff --git a/.github/workflows/gh-hosted-eclipse-distro-build.yml b/.github/workflows/gh-hosted-eclipse-distro-build.yml
index fccd4d7c4..eeb096e1e 100644
--- a/.github/workflows/gh-hosted-eclipse-distro-build.yml
+++ b/.github/workflows/gh-hosted-eclipse-distro-build.yml
@@ -152,11 +152,9 @@ jobs:
           BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
           P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-          KEYCHAIN: ${{ github.env.RUNNER_TEMP }}/app-signing.keychain-db
         run: |
-          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
-          
-          echo $KEYCHAIN
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12          
+          KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db
 
           echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
 
@@ -172,9 +170,6 @@ jobs:
       - name: Install appdmg
         run: |
           npm install -g appdmg
-      - name: Setup Notarization Credentials
-        run: |
-          xcrun notarytool store-credentials notarize-app-dmg-profile --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }}
       - name: Download OSX tar.gz files from S3 for Signing/Notarization
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_S3_ACCESS_KEY }}
@@ -186,18 +181,20 @@ jobs:
       - name: Sign .app, Create DMG, Sign and Notarize DMG
         env:
           MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }}
-          KEYCHAIN: ${{ github.env.RUNNER_TEMP }}/app-signing.keychain-db
+          NOTARIZE_PROFILE: notarize-app-dmg-profile
         run: |
+          export KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db
           ls ${{ github.workspace }}/.github/assets
           files=`ls spring-tool-suite-4*macosx*.tar.gz`
           for file in $files
           do
             ${{ github.workspace }}/.github/scripts/sign-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns
           done
+          xcrun notarytool store-credentials $NOTARIZE_PROFILE --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }}
           dmg_files=`ls spring-tool-suite-4*macosx*.dmg`
           for dmg_file in $dmg_files
           do
-            ${{ github.workspace }}/.github/scripts/notarize-osx-distro-file.sh $dmg_file &
+            ${{ github.workspace }}/.github/scripts/notarize-osx-distro-file.sh $dmg_file $NOTARIZE_PROFILE &
           done
           wait
           echo "Done signing and notarization of DMG files"