-
Notifications
You must be signed in to change notification settings - Fork 134
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #222 from id/0801-build-on-apple-silicon-and-sign-…
…macos-package feat: release package for apple silicon and sign macos package
- Loading branch information
Showing
7 changed files
with
153 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| # intended to run on MacOS only | ||
| if [ $(uname) != 'Darwin' ]; then | ||
| echo 'Not macOS, exiting'; | ||
| exit 0; | ||
| fi | ||
|
|
||
| pushd "${RELX_TEMP_DIR}" | ||
|
|
||
| ZIP_PACKAGE_PATH="${1:-${RELX_OUTPUT_DIR}/${RELX_RELEASE_NAME}-${RELX_RELEASE_VSN}.zip}" | ||
| zip -qr "${ZIP_PACKAGE_PATH}" . | ||
|
|
||
| popd | ||
|
|
||
| if [[ "${APPLE_ID:-0}" == 0 || "${APPLE_ID_PASSWORD:-0}" == 0 || "${APPLE_TEAM_ID:-0}" == 0 ]]; then | ||
| echo "Apple ID is not configured, skipping notarization." | ||
| exit 0 | ||
| fi | ||
|
|
||
| # notarize the package | ||
| # if fails, check what went wrong with this command: | ||
| # xcrun notarytool log \ | ||
| # --apple-id "${APPLE_ID}" \ | ||
| # --password "${APPLE_ID_PASSWORD}" \ | ||
| # --team-id "${APPLE_TEAM_ID}" <submission-id> | ||
| echo 'Submitting the package for notarization to Apple (normally takes about a minute)' | ||
| notarytool_output="$(xcrun notarytool submit \ | ||
| --apple-id "${APPLE_ID}" \ | ||
| --password "${APPLE_ID_PASSWORD}" \ | ||
| --team-id "${APPLE_TEAM_ID}" "${ZIP_PACKAGE_PATH}" \ | ||
| --no-progress \ | ||
| --wait)" | ||
| echo "$notarytool_output" | ||
| echo "$notarytool_output" | grep -q 'status: Accepted' || { | ||
| echo 'Notarization failed'; | ||
| exit 1; | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # intended to run on MacOS only | ||
| # signs runtime libraries found in $RELX_TEMP_DIR | ||
|
|
||
| # required variables: | ||
| # APPLE_DEVELOPER_IDENTITY: "Developer ID Application: <company name> (<hex id>)" | ||
| # APPLE_DEVELOPER_ID_BUNDLE: base64-encoded content of apple developer id certificate bundle in pksc12 format | ||
| # APPLE_DEVELOPER_ID_BUNDLE_PASSWORD: password used when exporting the bundle | ||
|
|
||
| # note: 'bundle' in apple terminology is 'identity' | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| if [ $(uname) != 'Darwin' ]; then | ||
| echo 'Not macOS, exiting'; | ||
| exit 0; | ||
| fi | ||
|
|
||
| if [[ "${APPLE_DEVELOPER_ID_BUNDLE:-0}" == 0 || "${APPLE_DEVELOPER_ID_BUNDLE_PASSWORD:-0}" == 0 ]]; then | ||
| echo "Apple developer certificate is not configured, skip signing" | ||
| exit 0 | ||
| fi | ||
|
|
||
| PKSC12_FILE="$HOME/developer-id-application.p12" | ||
| base64 --decode > "${PKSC12_FILE}" <<<"${APPLE_DEVELOPER_ID_BUNDLE}" | ||
|
|
||
| KEYCHAIN="emqtt-bench-$(date +%s).keychain-db" | ||
| KEYCHAIN_PASSWORD="$(openssl rand -base64 32)" | ||
|
|
||
| trap cleanup EXIT | ||
|
|
||
| function cleanup { | ||
| set +e | ||
| security delete-keychain "${KEYCHAIN}" 2>/dev/null | ||
| } | ||
|
|
||
| security create-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN}" | ||
| security set-keychain-settings "${KEYCHAIN}" | ||
| security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN}" | ||
| security import "${PKSC12_FILE}" -P "${APPLE_DEVELOPER_ID_BUNDLE_PASSWORD}" -t cert -f pkcs12 -k "${KEYCHAIN}" -T /usr/bin/codesign | ||
| security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "${KEYCHAIN_PASSWORD}" "${KEYCHAIN}" | ||
| security verify-cert -k "${KEYCHAIN}" -c "${PKSC12_FILE}" | ||
| security find-identity -p codesigning "${KEYCHAIN}" | ||
|
|
||
| # add new keychain into the search path for codesign, otherwise the stuff does not work | ||
| keychains=$(security list-keychains -d user) | ||
| keychain_names=(); | ||
| for keychain in ${keychains}; do | ||
| basename=$(basename "${keychain}") | ||
| keychain_name=${basename::${#basename}-4} | ||
| keychain_names+=("${keychain_name}") | ||
| done | ||
| security -v list-keychains -s "${keychain_names[@]}" "${KEYCHAIN}" | ||
|
|
||
| for f in \ | ||
| asn1rt_nif.so \ | ||
| beam.smp \ | ||
| crypto.so \ | ||
| crypto_callback.so \ | ||
| dyn_erl \ | ||
| epmd \ | ||
| erl \ | ||
| erl_call \ | ||
| erl_child_setup \ | ||
| erlexec \ | ||
| escript \ | ||
| heart \ | ||
| inet_gethost \ | ||
| libquicer_nif.dylib \ | ||
| libquicer_nif.so \ | ||
| otp_test_engine.so \ | ||
| run_erl \ | ||
| to_erl \ | ||
| ; do | ||
| find "${RELX_TEMP_DIR}" -name "$f" -exec codesign -s "${APPLE_DEVELOPER_IDENTITY}" -f --verbose=4 --timestamp --options=runtime {} \; | ||
| done | ||
|
|
||
| cleanup |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters