|
8 | 8 |
|
9 | 9 | set -xeuo pipefail |
10 | 10 |
|
11 | | -service_account=$(curl --header "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" || echo "") |
12 | | -if [[ $service_account != "[email protected]" ]] ; then |
13 | | - echo "Not running on a signing agent, skipping signing" |
14 | | - exit 1 |
15 | | -fi |
| 11 | +KEYCHAIN_NAME=signing |
| 12 | +KEYCHAIN_PROFILE=notarization |
| 13 | +curr_dir=$(pwd) |
16 | 14 |
|
17 | 15 | cleanup() { |
18 | | - rm -rf darwin.zip staging darwin-amd64 darwin-arm64 ./*.tar.gz TIMESTAMP.txt |
19 | | - rm -rf .secrets |
| 16 | + security lock-keychain "${KEYCHAIN_NAME}" |
| 17 | + rm -rf darwin.zip staging darwin-amd64 darwin-arm64 *.tar.gz TIMESTAMP.txt |
20 | 18 | } |
21 | 19 | trap cleanup EXIT |
22 | 20 |
|
23 | | -mkdir -p .secrets |
24 | | -# Explicitly set the account to the signing agent. This is helpful if one of the previous |
25 | | -# commands failed and left the account set to something else. |
26 | | -gcloud config set account "[email protected]" |
27 | | -gcloud secrets versions access latest --secret=apple-signing-cert | base64 -d > .secrets/cert.p12 |
28 | | -gcloud secrets versions access latest --secret=apple-signing-cert-password > .secrets/cert.pass |
29 | | -gcloud secrets versions access latest --secret=appstoreconnect-api-key > .secrets/api_key.json |
30 | | - |
31 | 21 | mkdir artifacts |
32 | 22 | mv TIMESTAMP.txt artifacts/TIMESTAMP.txt |
| 23 | +security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_NAME}" |
| 24 | + |
33 | 25 | sign() { |
34 | | - archive=$(ls -1 go*.darwin-$1.tar.gz | head -n1 | xargs basename) |
35 | | - mkdir "darwin-$1" |
36 | | - tar -xf "$archive" -C "darwin-$1" |
37 | | - rm "$archive" |
| 26 | + archive=$(find . -name go*.darwin-$1.tar.gz -d 1 | head -n1 | xargs basename) |
| 27 | + mkdir darwin-$1 |
| 28 | + tar -xf $archive -C darwin-$1 |
| 29 | + rm $archive |
38 | 30 | for bin in go gofmt; do |
39 | | - rcodesign sign \ |
40 | | - --p12-file .secrets/cert.p12 --p12-password-file .secrets/cert.pass \ |
41 | | - --code-signature-flags runtime \ |
42 | | - "darwin-$1/go/bin/$bin" |
| 31 | + codesign --timestamp --options=runtime -f --keychain "$KEYCHAIN_NAME" -s "$SIGNING_IDENTITY" darwin-$1/go/bin/$bin |
43 | 32 | done |
44 | | - tar cf - -C "darwin-$1" go | gzip -9 > "artifacts/$archive" |
| 33 | + tar cf - -C darwin-$1 go | gzip -9 > artifacts/$archive |
45 | 34 | mkdir staging |
46 | | - cp "darwin-$1/go/bin/gofmt" staging |
47 | | - cp "darwin-$1/go/bin/go" staging |
| 35 | + cp darwin-$1/go/bin/gofmt staging |
| 36 | + cp darwin-$1/go/bin/go staging |
48 | 37 | zip -r darwin.zip staging |
49 | 38 | rm -rf staging |
50 | | - rcodesign notary-submit \ |
51 | | - --api-key-file .secrets/api_key.json \ |
52 | | - --wait \ |
53 | | - darwin.zip |
| 39 | + xcrun notarytool submit darwin.zip --wait \ |
| 40 | + --team-id "$TEAM_ID" --keychain-profile "$KEYCHAIN_PROFILE" \ |
| 41 | + --apple-id "$APPLE_ID" --verbose \ |
| 42 | + --keychain "${HOME}/Library/Keychains/${KEYCHAIN_NAME}-db" |
54 | 43 | } |
55 | 44 |
|
56 | 45 | sign amd64 |
|
![blathers-crl[bot]](https://avatars.githubusercontent.com/in/59700?v=4&size=40){kind=avatar}
0 commit comments