feat(KAN-56): sign and notarize macOS releases
This commit is contained in:
@@ -0,0 +1,444 @@
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { createHash } from 'node:crypto';
|
||||
import {
|
||||
existsSync,
|
||||
mkdirSync,
|
||||
mkdtempSync,
|
||||
readFileSync,
|
||||
renameSync,
|
||||
rmSync,
|
||||
writeFileSync,
|
||||
} from 'node:fs';
|
||||
import { dirname, join, resolve } from 'node:path';
|
||||
import process from 'node:process';
|
||||
import { fileURLToPath, pathToFileURL } from 'node:url';
|
||||
import { parseArgs } from 'node:util';
|
||||
|
||||
export const appleTeamId = 'ZZX2KZGTHU';
|
||||
export const bundleIdentifier = 'de.kanbangit.desktop';
|
||||
const submissionIdPattern =
|
||||
/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
|
||||
|
||||
function execute(command, args, options) {
|
||||
const result = spawnSync(command, args, {
|
||||
cwd: options.cwd,
|
||||
env: options.env,
|
||||
encoding: 'utf8',
|
||||
maxBuffer: 16 * 1024 * 1024,
|
||||
stdio: options.inherit ? 'inherit' : 'pipe',
|
||||
});
|
||||
|
||||
if (result.error || result.status !== 0) {
|
||||
throw new Error(
|
||||
`${options.step} failed${result.error ? `: ${result.error.message}` : ` (exit ${result.status ?? result.signal})`}.`,
|
||||
);
|
||||
}
|
||||
|
||||
return result.stdout?.trim() || result.stderr?.trim() || '';
|
||||
}
|
||||
|
||||
export function releaseMacos({
|
||||
env = process.env,
|
||||
platform = process.platform,
|
||||
arch = process.arch,
|
||||
directory = dirname(fileURLToPath(import.meta.url)),
|
||||
run = execute,
|
||||
log = console.log,
|
||||
resumeSubmissionId = null,
|
||||
} = {}) {
|
||||
if (platform !== 'darwin') {
|
||||
throw new Error('macOS releases require a Mac with Xcode installed.');
|
||||
}
|
||||
|
||||
if (
|
||||
resumeSubmissionId !== null &&
|
||||
!submissionIdPattern.test(resumeSubmissionId)
|
||||
) {
|
||||
throw new Error('--resume requires the Apple submission UUID.');
|
||||
}
|
||||
|
||||
const identity = env.APPLE_SIGNING_IDENTITY?.trim();
|
||||
const profile = env.APPLE_NOTARY_KEYCHAIN_PROFILE?.trim();
|
||||
|
||||
if (
|
||||
!identity?.startsWith('Developer ID Application: ') ||
|
||||
!identity.endsWith(` (${appleTeamId})`) ||
|
||||
/[\r\n"]/.test(identity)
|
||||
) {
|
||||
throw new Error(
|
||||
`Set APPLE_SIGNING_IDENTITY to the full Developer ID Application certificate name for team ${appleTeamId}.`,
|
||||
);
|
||||
}
|
||||
|
||||
if (env.APPLE_TEAM_ID && env.APPLE_TEAM_ID !== appleTeamId) {
|
||||
throw new Error(`APPLE_TEAM_ID must be ${appleTeamId}.`);
|
||||
}
|
||||
|
||||
if (!profile) {
|
||||
throw new Error(
|
||||
'Set APPLE_NOTARY_KEYCHAIN_PROFILE to a notarytool profile created with store-credentials for the new Apple team.',
|
||||
);
|
||||
}
|
||||
|
||||
const target =
|
||||
env.MACOS_RELEASE_TARGET ||
|
||||
{ arm64: 'aarch64-apple-darwin', x64: 'x86_64-apple-darwin' }[arch];
|
||||
|
||||
if (!['aarch64-apple-darwin', 'x86_64-apple-darwin'].includes(target)) {
|
||||
throw new Error(
|
||||
'MACOS_RELEASE_TARGET must be aarch64-apple-darwin or x86_64-apple-darwin.',
|
||||
);
|
||||
}
|
||||
|
||||
const config = JSON.parse(
|
||||
readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
|
||||
);
|
||||
|
||||
if (
|
||||
config.identifier !== bundleIdentifier ||
|
||||
config.productName !== 'KanbanGit'
|
||||
) {
|
||||
throw new Error(
|
||||
'The macOS release must keep the KanbanGit product name and bundle identifier.',
|
||||
);
|
||||
}
|
||||
|
||||
if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version)) {
|
||||
throw new Error(
|
||||
'The macOS release version must be a stable MAJOR.MINOR.PATCH version.',
|
||||
);
|
||||
}
|
||||
|
||||
const targetDirectory = join(directory, 'src-tauri/target');
|
||||
const releaseDirectory = join(targetDirectory, 'macos-release');
|
||||
const destination = join(releaseDirectory, `${config.version}-${target}`);
|
||||
|
||||
if (existsSync(destination)) {
|
||||
throw new Error(
|
||||
`Release output already exists: ${destination}. Move it aside or use a new version.`,
|
||||
);
|
||||
}
|
||||
|
||||
// Notarization is handled below with the explicit keychain profile, never ambient Apple credentials.
|
||||
const buildEnv = Object.fromEntries(
|
||||
Object.entries(env).filter(
|
||||
([key]) => !key.startsWith('APPLE_') && key !== 'TAURI_CONFIG',
|
||||
),
|
||||
);
|
||||
buildEnv.APPLE_SIGNING_IDENTITY = identity;
|
||||
buildEnv.CARGO_TARGET_DIR = targetDirectory;
|
||||
|
||||
function step(label, command, args, inherit = false) {
|
||||
log(label);
|
||||
|
||||
return run(command, args, {
|
||||
cwd: directory,
|
||||
env: buildEnv,
|
||||
step: label,
|
||||
inherit,
|
||||
});
|
||||
}
|
||||
|
||||
const identities = step('Checking signing certificate', 'security', [
|
||||
'find-identity',
|
||||
'-v',
|
||||
'-p',
|
||||
'codesigning',
|
||||
]);
|
||||
|
||||
if (
|
||||
!identities
|
||||
.split('\n')
|
||||
.some((line) => line.trim().endsWith(`"${identity}"`))
|
||||
) {
|
||||
throw new Error(
|
||||
`Install the Developer ID Application certificate for ${appleTeamId}, including its private key, in an unlocked keychain.`,
|
||||
);
|
||||
}
|
||||
|
||||
const notaryCredentials = ['--keychain-profile', profile];
|
||||
|
||||
if (env.APPLE_NOTARY_KEYCHAIN?.trim()) {
|
||||
notaryCredentials.push('--keychain', env.APPLE_NOTARY_KEYCHAIN.trim());
|
||||
}
|
||||
|
||||
step(
|
||||
'Checking notarization access (check the keychain profile if this fails)',
|
||||
'xcrun',
|
||||
[
|
||||
'notarytool',
|
||||
'history',
|
||||
...notaryCredentials,
|
||||
'--output-format',
|
||||
'json',
|
||||
],
|
||||
);
|
||||
|
||||
const app = join(
|
||||
targetDirectory,
|
||||
target,
|
||||
'release/bundle/macos/KanbanGit.app',
|
||||
);
|
||||
if (!resumeSubmissionId) {
|
||||
step(
|
||||
'Building signed macOS release',
|
||||
'pnpm',
|
||||
[
|
||||
'exec',
|
||||
'tauri',
|
||||
'build',
|
||||
'--ci',
|
||||
'--target',
|
||||
target,
|
||||
'--bundles',
|
||||
'app',
|
||||
'--config',
|
||||
JSON.stringify({
|
||||
bundle: {
|
||||
createUpdaterArtifacts: false,
|
||||
macOS: {
|
||||
signingIdentity: identity,
|
||||
hardenedRuntime: true,
|
||||
},
|
||||
},
|
||||
}),
|
||||
'--',
|
||||
'--locked',
|
||||
],
|
||||
true,
|
||||
);
|
||||
}
|
||||
|
||||
if (!existsSync(app)) {
|
||||
throw new Error('The release build did not produce KanbanGit.app.');
|
||||
}
|
||||
|
||||
step('Verifying Developer ID signature and team', 'codesign', [
|
||||
'--verify',
|
||||
'--deep',
|
||||
'--strict',
|
||||
'--verbose=2',
|
||||
'-R',
|
||||
`=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists`,
|
||||
app,
|
||||
]);
|
||||
const signature = step('Checking hardened runtime', 'codesign', [
|
||||
'--display',
|
||||
'--verbose=4',
|
||||
app,
|
||||
]);
|
||||
|
||||
if (!/^CodeDirectory .*flags=.*\bruntime\b/m.test(signature)) {
|
||||
throw new Error(
|
||||
'The release signature does not enable Hardened Runtime.',
|
||||
);
|
||||
}
|
||||
|
||||
const cdhash = signature.match(/^CDHash=([\da-f]+)$/m)?.[1];
|
||||
|
||||
if (!cdhash) {
|
||||
throw new Error(
|
||||
'The signed app has no CodeDirectory hash to match against Apple notarization.',
|
||||
);
|
||||
}
|
||||
|
||||
const version = step('Checking bundled release version', 'plutil', [
|
||||
'-extract',
|
||||
'CFBundleShortVersionString',
|
||||
'raw',
|
||||
'-o',
|
||||
'-',
|
||||
join(app, 'Contents/Info.plist'),
|
||||
]);
|
||||
|
||||
if (version.trim() !== config.version) {
|
||||
throw new Error(
|
||||
'The built app version does not match the release version.',
|
||||
);
|
||||
}
|
||||
|
||||
mkdirSync(releaseDirectory, { recursive: true });
|
||||
const staging = mkdtempSync(join(releaseDirectory, '.pending-'));
|
||||
|
||||
try {
|
||||
const submission = join(staging, 'notarization.zip');
|
||||
let submissionId = resumeSubmissionId;
|
||||
|
||||
if (!submissionId) {
|
||||
step('Preparing notarization archive', 'ditto', [
|
||||
'-c',
|
||||
'-k',
|
||||
'--sequesterRsrc',
|
||||
'--keepParent',
|
||||
app,
|
||||
submission,
|
||||
]);
|
||||
const submitted = JSON.parse(
|
||||
step('Submitting to Apple', 'xcrun', [
|
||||
'notarytool',
|
||||
'submit',
|
||||
submission,
|
||||
...notaryCredentials,
|
||||
'--no-wait',
|
||||
'--output-format',
|
||||
'json',
|
||||
]),
|
||||
);
|
||||
submissionId = submitted.id;
|
||||
|
||||
if (!submissionIdPattern.test(submissionId ?? '')) {
|
||||
throw new Error(
|
||||
'Apple did not return a valid submission UUID. Check notarytool history before retrying.',
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const resumeHint = `Resume without rebuilding or uploading: pnpm --dir native release:macos --resume ${submissionId}`;
|
||||
log(`Apple submission: ${submissionId}. ${resumeHint}`);
|
||||
writeFileSync(
|
||||
join(
|
||||
targetDirectory,
|
||||
`notarization-${submissionId}.submission.json`,
|
||||
),
|
||||
JSON.stringify(
|
||||
{
|
||||
submissionId,
|
||||
version: config.version,
|
||||
target,
|
||||
cdhash,
|
||||
},
|
||||
null,
|
||||
2,
|
||||
) + '\n',
|
||||
);
|
||||
|
||||
let result;
|
||||
|
||||
try {
|
||||
result = JSON.parse(
|
||||
step('Waiting for Apple notarization', 'xcrun', [
|
||||
'notarytool',
|
||||
'wait',
|
||||
submissionId,
|
||||
...notaryCredentials,
|
||||
'--timeout',
|
||||
'30m',
|
||||
'--output-format',
|
||||
'json',
|
||||
]),
|
||||
);
|
||||
} catch (error) {
|
||||
throw new Error(
|
||||
`${error.message} Apple may still be processing this submission. ${resumeHint}`,
|
||||
);
|
||||
}
|
||||
|
||||
if (result.status !== 'Accepted') {
|
||||
throw new Error(
|
||||
`Apple did not accept the release (status: ${result.status ?? 'unknown'}, submission: ${submissionId}). Inspect it with notarytool log. ${resumeHint}`,
|
||||
);
|
||||
}
|
||||
|
||||
const notaryLog = JSON.parse(
|
||||
step('Checking Apple notarization log', 'xcrun', [
|
||||
'notarytool',
|
||||
'log',
|
||||
submissionId,
|
||||
...notaryCredentials,
|
||||
]),
|
||||
);
|
||||
writeFileSync(
|
||||
join(targetDirectory, `notarization-${submissionId}.log.json`),
|
||||
JSON.stringify(notaryLog, null, 2) + '\n',
|
||||
);
|
||||
const expectedArch =
|
||||
target === 'aarch64-apple-darwin' ? 'arm64' : 'x86_64';
|
||||
|
||||
if (
|
||||
notaryLog.jobId !== submissionId ||
|
||||
notaryLog.status !== 'Accepted' ||
|
||||
!notaryLog.ticketContents?.some(
|
||||
(ticket) =>
|
||||
ticket.path.endsWith('/KanbanGit.app') &&
|
||||
ticket.cdhash === cdhash &&
|
||||
ticket.arch === expectedArch,
|
||||
)
|
||||
) {
|
||||
throw new Error(
|
||||
'The accepted Apple submission does not match this signed app and architecture. Restore the submitted app or create a new release.',
|
||||
);
|
||||
}
|
||||
|
||||
if (notaryLog.issues?.length) {
|
||||
throw new Error(
|
||||
`Apple reported notarization issues. Review src-tauri/target/notarization-${submissionId}.log.json before distribution.`,
|
||||
);
|
||||
}
|
||||
|
||||
step('Stapling notarization ticket', 'xcrun', [
|
||||
'stapler',
|
||||
'staple',
|
||||
app,
|
||||
]);
|
||||
step('Validating notarization ticket', 'xcrun', [
|
||||
'stapler',
|
||||
'validate',
|
||||
app,
|
||||
]);
|
||||
step('Verifying final app signature', 'codesign', [
|
||||
'--verify',
|
||||
'--deep',
|
||||
'--strict',
|
||||
app,
|
||||
]);
|
||||
step('Checking Gatekeeper acceptance', 'spctl', [
|
||||
'--assess',
|
||||
'--type',
|
||||
'execute',
|
||||
'--verbose=2',
|
||||
app,
|
||||
]);
|
||||
|
||||
const name = `KanbanGit-${config.version}-${target}.zip`;
|
||||
const archive = join(staging, name);
|
||||
step('Packaging notarized download', 'ditto', [
|
||||
'-c',
|
||||
'-k',
|
||||
'--sequesterRsrc',
|
||||
'--keepParent',
|
||||
app,
|
||||
archive,
|
||||
]);
|
||||
const checksum = createHash('sha256')
|
||||
.update(readFileSync(archive))
|
||||
.digest('hex');
|
||||
writeFileSync(`${archive}.sha256`, `${checksum} ${name}\n`);
|
||||
rmSync(submission, { force: true });
|
||||
renameSync(staging, destination);
|
||||
log(`Verified release: ${join(destination, name)}`);
|
||||
|
||||
return {
|
||||
archive: join(destination, name),
|
||||
checksum,
|
||||
version: config.version,
|
||||
target,
|
||||
};
|
||||
} finally {
|
||||
rmSync(staging, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
|
||||
if (
|
||||
process.argv[1] &&
|
||||
import.meta.url === pathToFileURL(resolve(process.argv[1])).href
|
||||
) {
|
||||
try {
|
||||
const { values } = parseArgs({
|
||||
options: { resume: { type: 'string' } },
|
||||
});
|
||||
releaseMacos({ resumeSubmissionId: values.resume ?? null });
|
||||
} catch (error) {
|
||||
console.error(`macOS release failed: ${error.message}`);
|
||||
process.exitCode = 1;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user