Skip to content

Commit 5dbed6f

Browse files
nb-ccdnb-ccd
committed
fix: set up macos certificate chain
1 parent 89b8135 commit 5dbed6f

File tree

1 file changed

+176
-0
lines changed

1 file changed

+176
-0
lines changed

‎.github/workflows/test-mac-code-signing.yaml‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
name: Test Mac build
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
service:
7+
type: choice
8+
description: Choose which workflow should be ran
9+
options:
10+
- node-macos
11+
12+
on:
13+
push:
14+
branches: SRE-1220/macos-signing
15+
workflow_dispatch: # allow manual trigger
16+
17+
env:
18+
UBUNTU_VERSION: '24.04'
19+
STATIC_LIBRARIES_IMAGE_TAG: 'rust-1.82_ghc-9.6.6-0'
20+
RUST_VERSION: '1.82'
21+
STACK_VERSION: '3.1.1'
22+
FLATBUFFERS_VERSION: '23.5.26'
23+
GHC_VERSION: '9.6.6'
24+
PROTOC_VERSION: '28.3'
25+
STATIC_NODE_BINARY_IMAGE_NAME: 'static-node-binaries'
26+
DOCKER_ARTIFACT_NAME: 'image'
27+
AWS_ROLE_TO_ASSUME: 'arn:aws:iam::192549843005:role/github_concordium-node'
28+
S3_ARN_TEMPLATES: '{
29+
\"database-exporter\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"tools/linux\", \"name\": \"database-exporter_${VERSION}.deb\"},
30+
\"p2p-bootstrapper\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"tools/linux\", \"name\": \"p2p-bootstrapper_${VERSION}.deb\"},
31+
\"node-stagenet-linux\": {\"bucket\": \"distribution.stagenet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-stagenet-node_${VERSION}_amd64.deb\"},
32+
\"node-flynet-linux\": {\"bucket\": \"distribution.flynet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-flynet-node_${VERSION}_amd64.deb\"},
33+
\"node-testnet-linux\": {\"bucket\": \"distribution.testnet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-testnet-node_${VERSION}_amd64.deb\"},
34+
\"node-mainnet-linux\": {\"bucket\": \"distribution.mainnet.concordium.software\", \"dir\": \"deb\", \"name\": \"concordium-mainnet-node_${VERSION}_amd64.deb\"},
35+
\"node-macos\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"macos\", \"name\": \"concordium-node-${VERSION}.pkg\"},
36+
\"node-windows\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"windows\", \"name\": \"Node-${VERSION}.msi\"}
37+
}'
38+
DOCKER_TAGS_TEMPLATES: '{
39+
\"docker-stagenet\": \"concordium/stagenet-node:${VERSION}\",
40+
\"docker-testnet\": \"concordium/testnet-node:${VERSION}\",
41+
\"docker-mainnet\": \"concordium/mainnet-node:${VERSION}\",
42+
\"docker-bootstrapper\": \"concordium/bootstrapper:${VERSION}\"
43+
}'
44+
REGISTRY: docker.io
45+
SERVICE: "${{ inputs.service }}"
46+
47+
permissions:
48+
id-token: write
49+
contents: read
50+
51+
jobs:
52+
53+
validate-preconditions:
54+
runs-on: ubuntu-latest
55+
outputs:
56+
s3_arns: ${{ steps.render.outputs.s3_arns }}
57+
docker_tags: ${{ steps.render.outputs.docker_tags }}
58+
release_type: ${{ steps.versions_derivation.outputs.release_type }}
59+
base_version: ${{ steps.versions_derivation.outputs.base_version }}
60+
version: ${{ steps.versions_derivation.outputs.version }}
61+
steps:
62+
- name: Checkout Repository
63+
uses: actions/checkout@v4
64+
65+
- name: Validate version
66+
id: versions_derivation
67+
run: |
68+
CARGO_VERSION=$(yq .package.version concordium-node/Cargo.toml)
69+
if [ -z "${{ env.SERVICE }}" ]; then
70+
IFS='-' read -r VERSION BUILD RELEASE_TYPE <<< "${{ github.ref_name }}"
71+
if [ ! "$VERSION" = "$CARGO_VERSION" ]; then
72+
echo "::error::${CARGO_VERSION} does not match ${VERSION}."
73+
exit 1
74+
fi
75+
else
76+
RELEASE_TYPE="${{ env.SERVICE }}"
77+
BUILD=$(git rev-parse --short HEAD)
78+
fi
79+
echo "::notice::RELEASE_TYPE=${RELEASE_TYPE}"
80+
echo "release_type=${RELEASE_TYPE}" >> "$GITHUB_OUTPUT"
81+
echo "version=${CARGO_VERSION}-${BUILD}" >> "$GITHUB_OUTPUT"
82+
echo "base_version=${CARGO_VERSION}" >> "$GITHUB_OUTPUT"
83+
- name: Templates rendering
84+
id: render
85+
run: |
86+
export VERSION="${{ steps.versions_derivation.outputs.version }}"
87+
echo "s3_arns=${{ env.S3_ARN_TEMPLATES }}" >> $GITHUB_OUTPUT
88+
echo "docker_tags=${{ env.DOCKER_TAGS_TEMPLATES }}" >> $GITHUB_OUTPUT
89+
90+
node-macos:
91+
runs-on: macos-latest-large
92+
environment: release
93+
needs: [validate-preconditions]
94+
if: contains(fromJSON('["rc", "alpha", "node-macos"]'), needs.validate-preconditions.outputs.release_type)
95+
steps:
96+
- name: Checkout Repository
97+
uses: actions/checkout@v4
98+
with:
99+
submodules: recursive
100+
101+
- name: Extrapolate artifact name
102+
run: |
103+
ARTIFACT_NAME=$(echo '${{ needs.validate-preconditions.outputs.s3_arns }}' | jq -r '.["${{ github.job }}"].name')
104+
echo "ARTIFACT_NAME=${ARTIFACT_NAME}" >> $GITHUB_ENV
105+
106+
- name: Import Apple signing certificates into a keychain)
107+
env:
108+
# Base64 encoding of the p12 certificate for Apple code signing.
109+
BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }}
110+
BUILD_INSTALLER_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_INSTALLER_CERTIFICATE_BASE64 }}
111+
# Password for the p12 certificate for Apple code signing.
112+
BUILD_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_BUILD_CERTIFICATE_PASSWORD }}
113+
BUILD_INSTALLER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_BUILD_INSTALLER_CERTIFICATE_PASSWORD }}
114+
# Random string to use as the keychain password.
115+
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
116+
run: |
117+
# create variables
118+
CERTIFICATE_PATH=$RUNNER_TEMP/apple_build_certificate.p12
119+
INSTALLER_CERTIFICATE_PATH=$RUNNER_TEMP/apple_build_installer_certificate.p12
120+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
121+
122+
# import certificate and provisioning profile from secrets
123+
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
124+
echo -n "$BUILD_INSTALLER_CERTIFICATE_BASE64" | base64 --decode -o $INSTALLER_CERTIFICATE_PATH
125+
126+
# create temporary keychain
127+
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
128+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
129+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
130+
131+
# import certificate to keychain
132+
security import $CERTIFICATE_PATH -P "$BUILD_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
133+
security import $INSTALLER_CERTIFICATE_PATH -P "$BUILD_INSTALLER_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
134+
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
135+
security list-keychain -d user -s $KEYCHAIN_PATH
136+
echo $?
137+
138+
# OTHER STUFF COMMENTED OUT TO TEST THIS.
139+
140+
# - uses: actions-rust-lang/setup-rust-toolchain@v1
141+
# with:
142+
# toolchain: ${{ env.RUST_VERSION }}
143+
144+
# - uses: haskell-actions/setup@v2
145+
# with:
146+
# ghc-version: ${{ env.GHC_VERSION }}
147+
# enable-stack: true
148+
# stack-version: ${{ env.STACK_VERSION }}
149+
150+
# - name: Install flatbuffers
151+
# run: |
152+
# wget https://github.com/google/flatbuffers/releases/download/v${{ env.FLATBUFFERS_VERSION }}/MacIntel.flatc.binary.zip -O MacIntel.flatc.binary.zip
153+
# unzip MacIntel.flatc.binary.zip -d flatbuffers
154+
# sudo mv flatbuffers/flatc /usr/local/bin/
155+
156+
# - name: Install protobuf
157+
# run: |
158+
# curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VERSION }}/protoc-${{ env.PROTOC_VERSION }}-osx-x86_64.zip
159+
# unzip protoc.zip
160+
# sudo mv bin/protoc /usr/local/bin/
161+
# sudo mv include/* /usr/local/include/
162+
163+
# - name: Install Homebrew Packages
164+
# run: |
165+
# brew install lmdb llvm
166+
167+
# - name: Build macOS Package
168+
# run: |
169+
# printf "N\n" | ./scripts/distribution/macOS-package/build.sh ${{ needs.validate-preconditions.outputs.version }}
170+
# cp ./scripts/distribution/macOS-package/build/packages/concordium-node-${{ needs.validate-preconditions.outputs.version }}-unsigned.pkg ./${{ env.ARTIFACT_NAME }}
171+
172+
# - name: Upload artifact
173+
# uses: actions/upload-artifact@v4
174+
# with:
175+
# name: ${{ github.job }}
176+
# path: ${{ env.ARTIFACT_NAME }}

0 commit comments

Comments
 (0)