enable macOS notarization for all distribution targets

2019-11-14 14:00:16 +01:00
parent b5d2ba90d9
commit f429653457
4 changed files with 120 additions and 4 deletions
--- a/eclipse-distribution/org.springframework.boot.ide.product.e412/macos-notarize.sh
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e412/macos-notarize.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+DMG=$1
+NOTARIZE_SERVICE_URL=$2
+
+RESPONSE=\
+$(curl -s -X POST \
+  -F file=@${DMG} \
+  -F 'options={"primaryBundleId": "SpringTools4", "staple": true};type=application/json' \
+  ${NOTARIZE_SERVICE_URL}/macos-notarization-service/notarize)
+	  
+echo "Notarization request submitted"
+echo ${RESPONSE}
+  
+UUID=$(echo ${RESPONSE} | jq -r '.uuid')
+
+STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+
+while [[ ${STATUS} == 'IN_PROGRESS' ]]; do
+  sleep 1m
+  RESPONSE=$(curl -s ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/status)
+  STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+done
+
+if [[ ${STATUS} != 'COMPLETE' ]]; then
+  echo "Notarization failed: ${RESPONSE}"
+  exit 1
+fi
+
+mv "${DMG}" "${DMG}-unnotarized"
+
+curl -o ${DMG} -J ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/download
--- a/eclipse-distribution/org.springframework.boot.ide.product.e412/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e412/pom.xml
@@ -132,6 +132,7 @@
 				<version>1.7</version>
 				<executions>

+					<!-- macos code signing requires the build to run on a macOS machine with Xcode installed, including the appropriate Apple Developer certificates for code signing -->
 					<execution>
 						<id>osx-app-signing</id>
 						<phase>package</phase>
@@ -147,10 +148,11 @@
 									<arg value="--force"/>
 									<arg value="--entitlements"/>
 									<arg value="${project.build.directory}/../entitlements.plist"/>
+									<arg value="--options=runtime"/>
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/macosx/cocoa/x86_64/SpringToolSuite4.app"/>
 								</exec>

@@ -161,6 +163,7 @@
 						</goals>
 					</execution>

+					<!-- the creation of the DMG file is based on appdmg: https://www.npmjs.com/package/appdmg -->
 					<execution>
 						<id>osx-dmg-creation</id>
 						<phase>verify</phase>
@@ -197,7 +200,7 @@
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${dmgName}"/>
 								</exec>

@@ -208,6 +211,29 @@
 						</goals>
 					</execution>

+					<!-- the notarizing of the DMG file needs this service running somewhere: https://github.com/eclipse-cbi/macos-notarization-service -->
+					<execution>
+						<id>osx-dmg-notarizing</id>
+						<phase>verify</phase>
+						<configuration>
+							<skip>${skip.osx.notarizing}</skip>
+							<target>
+
+								<property name="dmgName" value="${project.build.directory}/products/spring-tool-suite-4-${unqualifiedVersion}.${p2.qualifier}-${dist.target}-macosx.cocoa.x86_64.dmg" />
+
+								<exec executable="/bin/bash" failonerror="true">
+									<arg value="${project.build.directory}/../macos-notarize.sh"/>
+									<arg value="${dmgName}"/>
+								    <arg value="${env.MACOS_NOTARIZATION_SERVICE_URL}"/>
+								</exec>
+
+							</target>
+						</configuration>
+						<goals>
+							<goal>run</goal>
+						</goals>
+					</execution>
+
 					<execution>
 						<id>upload-product-bundles</id>
 						<phase>deploy</phase>
--- a/eclipse-distribution/org.springframework.boot.ide.product.e414/macos-notarize.sh
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e414/macos-notarize.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+DMG=$1
+NOTARIZE_SERVICE_URL=$2
+
+RESPONSE=\
+$(curl -s -X POST \
+  -F file=@${DMG} \
+  -F 'options={"primaryBundleId": "SpringTools4", "staple": true};type=application/json' \
+  ${NOTARIZE_SERVICE_URL}/macos-notarization-service/notarize)
+	  
+echo "Notarization request submitted"
+echo ${RESPONSE}
+  
+UUID=$(echo ${RESPONSE} | jq -r '.uuid')
+
+STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+
+while [[ ${STATUS} == 'IN_PROGRESS' ]]; do
+  sleep 1m
+  RESPONSE=$(curl -s ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/status)
+  STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+done
+
+if [[ ${STATUS} != 'COMPLETE' ]]; then
+  echo "Notarization failed: ${RESPONSE}"
+  exit 1
+fi
+
+mv "${DMG}" "${DMG}-unnotarized"
+
+curl -o ${DMG} -J ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/download
--- a/eclipse-distribution/org.springframework.boot.ide.product.e414/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e414/pom.xml
@@ -132,6 +132,7 @@
 				<version>1.7</version>
 				<executions>

+					<!-- macos code signing requires the build to run on a macOS machine with Xcode installed, including the appropriate Apple Developer certificates for code signing -->
 					<execution>
 						<id>osx-app-signing</id>
 						<phase>package</phase>
@@ -147,10 +148,11 @@
 									<arg value="--force"/>
 									<arg value="--entitlements"/>
 									<arg value="${project.build.directory}/../entitlements.plist"/>
+									<arg value="--options=runtime"/>
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/macosx/cocoa/x86_64/SpringToolSuite4.app"/>
 								</exec>

@@ -161,6 +163,7 @@
 						</goals>
 					</execution>

+					<!-- the creation of the DMG file is based on appdmg: https://www.npmjs.com/package/appdmg -->
 					<execution>
 						<id>osx-dmg-creation</id>
 						<phase>verify</phase>
@@ -197,7 +200,7 @@
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${dmgName}"/>
 								</exec>

@@ -208,6 +211,29 @@
 						</goals>
 					</execution>

+					<!-- the notarizing of the DMG file needs this service running somewhere: https://github.com/eclipse-cbi/macos-notarization-service -->
+					<execution>
+						<id>osx-dmg-notarizing</id>
+						<phase>verify</phase>
+						<configuration>
+							<skip>${skip.osx.notarizing}</skip>
+							<target>
+
+								<property name="dmgName" value="${project.build.directory}/products/spring-tool-suite-4-${unqualifiedVersion}.${p2.qualifier}-${dist.target}-macosx.cocoa.x86_64.dmg" />
+
+								<exec executable="/bin/bash" failonerror="true">
+									<arg value="${project.build.directory}/../macos-notarize.sh"/>
+									<arg value="${dmgName}"/>
+								    <arg value="${env.MACOS_NOTARIZATION_SERVICE_URL}"/>
+								</exec>
+
+							</target>
+						</configuration>
+						<goals>
+							<goal>run</goal>
+						</goals>
+					</execution>
+
 					<execution>
 						<id>upload-product-bundles</id>
 						<phase>deploy</phase>