mirror of
https://github.com/outbackdingo/UltraGrid.git
synced 2026-03-21 13:40:21 +00:00
7ff96e5f69
The signing sometimes silently fails and thus it's advisable to print copy of the output, that has been previously redirected, to console
74 lines
2.8 KiB
Bash
Executable File
74 lines
2.8 KiB
Bash
Executable File
#!/bin/sh -eux
|
|
## Usage:
|
|
## sign.sh <app_bundle_directory>
|
|
##
|
|
## Environment variables:
|
|
## - **apple_key_p12_b64** - tar.bz2 with $KEY_FILE (with empty password) and $CERT_FILE
|
|
## - **$altool_pass** - developer (see $DEVELOPER_USERNAME) app password
|
|
|
|
APP=${1?Appname must be passed as a first argument}
|
|
DEVELOPER_USERNAME=martin.pulec@cesnet.cz
|
|
|
|
if [ -z "$apple_key_p12_b64" -o -z "$altool_pass" ]; then
|
|
echo "Could not find key to sign the application" 2>&1
|
|
if [ "$GITHUB_WORKFLOW" = nightly ]; then
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
# Import keys
|
|
# Inspired by https://www.update.rocks/blog/osx-signing-with-travis/
|
|
KEY_CHAIN=build.keychain
|
|
KEY_CHAIN_PASS=build
|
|
KEY_FILE='CESNET, z. s. p. o..p12'
|
|
KEY_FILE_PASS=''
|
|
CERT_FILE='developerID_application.cer'
|
|
echo "$apple_key_p12_b64" | base64 -d > /tmp/cert.tar.bz2
|
|
tar -C /tmp -xJf /tmp/cert.tar.bz2
|
|
security create-keychain -p $KEY_CHAIN_PASS $KEY_CHAIN
|
|
security default-keychain -s $KEY_CHAIN
|
|
security unlock-keychain -p $KEY_CHAIN_PASS $KEY_CHAIN
|
|
security import "/tmp/$CERT_FILE"
|
|
security import "/tmp/$KEY_FILE" -A -P "$KEY_FILE_PASS"
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k $KEY_CHAIN_PASS $KEY_CHAIN
|
|
|
|
# Sign the application
|
|
# Libs need to be signed explicitly for some reason
|
|
for f in `find $APP/Contents/libs -type f` $APP; do
|
|
codesign --force --deep -s CESNET --options runtime --entitlements data/entitlements.mac.plist -v $f
|
|
done
|
|
#codesign --force --deep -s CESNET --options runtime -v $APP/Contents/MacOS/uv-qt
|
|
|
|
# Zip and send for notarization
|
|
ZIP_FILE=uv-qt.zip
|
|
UPLOAD_INFO_PLIST=/tmp/uplinfo.plist
|
|
REQUEST_INFO_PLIST=/tmp/reqinfo.plist
|
|
ditto -c -k --keepParent $APP $ZIP_FILE
|
|
xcrun altool --notarize-app --primary-bundle-id cz.cesnet.ultragrid.uv-qt --username $DEVELOPER_USERNAME --password "$altool_pass" --file $ZIP_FILE --output-format xml | tee $UPLOAD_INFO_PLIST
|
|
|
|
# Wait for notarization status
|
|
# Waiting inspired by https://nativeconnect.app/blog/mac-app-notarization-from-the-command-line/
|
|
SLEPT=0
|
|
TIMEOUT=7200
|
|
while true; do
|
|
/usr/bin/xcrun altool --notarization-info `/usr/libexec/PlistBuddy -c "Print :notarization-upload:RequestUUID" $UPLOAD_INFO_PLIST` -u $DEVELOPER_USERNAME -p $altool_pass --output-format xml | tee $REQUEST_INFO_PLIST
|
|
STATUS=`/usr/libexec/PlistBuddy -c "Print :notarization-info:Status" $REQUEST_INFO_PLIST`
|
|
if [ "$STATUS" != "in progress" -o $SLEPT -ge $TIMEOUT ]; then
|
|
break
|
|
fi
|
|
sleep 60
|
|
SLEPT=$(($SLEPT + 60))
|
|
done
|
|
if [ $STATUS != success ]; then
|
|
UUID=`/usr/libexec/PlistBuddy -c "Print :notarization-info:RequestUUID" $REQUEST_INFO_PLIST`
|
|
xcrun altool --notarization-info $UUID -u $DEVELOPER_USERNAME -p $altool_pass
|
|
echo "Could not notarize" 2>&1
|
|
exit 1
|
|
fi
|
|
|
|
# If everything is ok, staple the app
|
|
xcrun stapler staple $APP
|
|
|