Skip to content

Commit 8158a04

Browse files
beriberikixclaude
andcommitted
feat: add System Extension notarization to release workflow
- Add notarization step after code signing in release workflow - Submit System Extension bundle for Apple notarization - Staple notarization ticket to bundle for offline verification - Include 10 minute timeout and proper error handling - This should resolve System Extension security prompt issues 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 451d822 commit 8158a04

File tree

1 file changed

+32
-0
lines changed

1 file changed

+32
-0
lines changed

.github/workflows/release.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,38 @@ jobs:
229229
codesign --sign "Developer ID Application" --timestamp "$QEMU_SERVER_PATH" || echo "::warning::Code signing failed for QEMUTestServer"
230230
fi
231231
echo "✅ Code signing completed"
232+
233+
# Notarize system extension bundle if notarization credentials available
234+
if [ -n "$NOTARIZATION_USERNAME" ] && [ -n "$NOTARIZATION_PASSWORD" ] && [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
235+
echo "🔒 Notarizing system extension bundle..."
236+
237+
# Create zip for notarization (required format)
238+
ditto -c -k --keepParent "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip"
239+
240+
# Submit for notarization with timeout
241+
echo "📤 Submitting system extension for notarization..."
242+
xcrun notarytool submit "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip" \
243+
--apple-id "$NOTARIZATION_USERNAME" \
244+
--password "$NOTARIZATION_PASSWORD" \
245+
--team-id "592A3U6J26" \
246+
--wait --timeout 10m || {
247+
echo "::warning::System extension notarization failed or timed out"
248+
echo "::warning::This may prevent proper System Extension installation"
249+
}
250+
251+
# Staple the notarization if successful
252+
if xcrun stapler staple "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" 2>/dev/null; then
253+
echo "✅ System extension notarization completed and stapled"
254+
else
255+
echo "::warning::Failed to staple notarization to system extension"
256+
fi
257+
258+
# Clean up notarization zip
259+
rm -f "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip"
260+
else
261+
echo "::warning::Notarization credentials not available - System Extension will not be notarized"
262+
echo "::warning::This will prevent proper System Extension installation on user machines"
263+
fi
232264
else
233265
echo "::warning::No code signing certificates available - binaries will be unsigned"
234266
fi

0 commit comments

Comments
 (0)