ci: Notarize MacOS Binaries and Add Flat Package Installers (#3571)
* ci: Notarize MacOS * Modify logging and documentation to be better * Make a copy of certain parts of the deploy workflow * Delete testing workflow
This commit is contained in:
Kevin Song
GitHub
parent
4369c92d40
commit
955a0f7a33
|
|
@ -105,6 +105,100 @@ jobs:
|
||||||
name: ${{ matrix.name }}
|
name: ${{ matrix.name }}
|
||||||
path: ${{ matrix.name }}
|
path: ${{ matrix.name }}
|
||||||
|
|
||||||
|
# Notarize starship binaries for MacOS and build notarized pkg installers
|
||||||
|
notarize_and_pkgbuild:
|
||||||
|
runs-on: macos-latest
|
||||||
|
needs: github_build
|
||||||
|
strategy:
|
||||||
|
fail-fast: false
|
||||||
|
matrix:
|
||||||
|
include:
|
||||||
|
- target: x86_64-apple-darwin
|
||||||
|
arch: x86_64
|
||||||
|
name: starship-x86_64-apple-darwin.tar.gz
|
||||||
|
pkgname: starship-x86_64-apple-darwin.pkg
|
||||||
|
|
||||||
|
- target: aarch64-apple-darwin
|
||||||
|
arch: aarch64
|
||||||
|
name: starship-aarch64-apple-darwin.tar.gz
|
||||||
|
pkgname: starship-aarch64-apple-darwin.pkg
|
||||||
|
|
||||||
|
env:
|
||||||
|
KEYCHAIN_FILENAME: app-signing.keychain-db
|
||||||
|
KEYCHAIN_ENTRY: AC_PASSWORD
|
||||||
|
steps:
|
||||||
|
- name: Checkout repository
|
||||||
|
uses: actions/checkout@v2
|
||||||
|
- name: Notarize | Set up secrets
|
||||||
|
env:
|
||||||
|
APP_CERTIFICATE_BASE64: ${{ secrets.APPLEDEV_APPSIGNKEY_BASE64 }}
|
||||||
|
INSTALL_CERTIFICATE_BASE64: ${{ secrets.APPLEDEV_INSTALLERSIGNKEY_BASE64 }}
|
||||||
|
P12_PASSWORD: ${{ secrets.APPLEDEV_SIGNKEY_PASS }}
|
||||||
|
KEYCHAIN_PASSWORD: ${{ secrets.APPLEDEV_SIGNKEY_PASS }}
|
||||||
|
APPLEID_USERNAME: ${{ secrets.APPLEDEV_ID_NAME }}
|
||||||
|
APPLEID_TEAMID: ${{ secrets.APPLEDEV_TEAM_ID }}
|
||||||
|
APPLEID_PASSWORD: ${{ secrets.APPLEDEV_PASSWORD }}
|
||||||
|
run: |
|
||||||
|
APP_CERTIFICATE_PATH="$RUNNER_TEMP/app_certificate.p12"
|
||||||
|
INSTALL_CERTIFICATE_PATH="$RUNNER_TEMP/install_certificate.p12"
|
||||||
|
KEYCHAIN_PATH="$RUNNER_TEMP/$KEYCHAIN_FILENAME"
|
||||||
|
|
||||||
|
# import certificates from secrets
|
||||||
|
echo -n "$APP_CERTIFICATE_BASE64" | base64 --decode --output $APP_CERTIFICATE_PATH
|
||||||
|
echo -n "$INSTALL_CERTIFICATE_BASE64" | base64 --decode --output $INSTALL_CERTIFICATE_PATH
|
||||||
|
|
||||||
|
# create temporary keychain
|
||||||
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
||||||
|
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
|
||||||
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
||||||
|
|
||||||
|
# import certificates to keychain
|
||||||
|
security import $APP_CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
|
||||||
|
security import $INSTALL_CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
|
||||||
|
security list-keychain -d user -s $KEYCHAIN_PATH
|
||||||
|
|
||||||
|
# Add Apple Developer ID credentials to keychain
|
||||||
|
xcrun notarytool store-credentials "$KEYCHAIN_ENTRY" --team-id "$APPLEID_TEAMID" --apple-id "$APPLEID_USERNAME" --password "$APPLEID_PASSWORD" --keychain "$KEYCHAIN_PATH"
|
||||||
|
|
||||||
|
- name: Notarize | Build docs
|
||||||
|
run: |
|
||||||
|
cd docs
|
||||||
|
npm install
|
||||||
|
npm run build
|
||||||
|
|
||||||
|
- name: Notarize | Download artifacts
|
||||||
|
uses: actions/download-artifact@v2
|
||||||
|
with:
|
||||||
|
name: ${{ matrix.name }}
|
||||||
|
path: artifacts
|
||||||
|
|
||||||
|
- name: Notarize | Unpack Binaries
|
||||||
|
run: tar xf artifacts/${{ matrix.name }}
|
||||||
|
|
||||||
|
- name: Notarize | Build, Sign, and Notarize Pkg
|
||||||
|
run: bash install/macos_packages/build_and_notarize.sh starship docs ${{ matrix.arch }} ${{ matrix.pkgname }}
|
||||||
|
|
||||||
|
- name: Notarize | Upload Notarized Flat Installer
|
||||||
|
uses: actions/upload-artifact@v2
|
||||||
|
with:
|
||||||
|
name: ${{ matrix.pkgname }}
|
||||||
|
path: ${{ matrix.pkgname }}
|
||||||
|
|
||||||
|
- name: Notarize | Package Notarized Binary
|
||||||
|
run: tar czvf ${{ matrix.name }} starship
|
||||||
|
|
||||||
|
- name: Notarize | Upload Notarized Binary
|
||||||
|
uses: actions/upload-artifact@v2
|
||||||
|
with:
|
||||||
|
name: ${{ matrix.name }}
|
||||||
|
path: ${{ matrix.name }}
|
||||||
|
|
||||||
|
- name: Cleanup Secrets
|
||||||
|
if: ${{ always() }}
|
||||||
|
run: |
|
||||||
|
KEYCHAIN_PATH="$RUNNER_TEMP/$KEYCHAIN_FILENAME"
|
||||||
|
security delete-keychain $KEYCHAIN_PATH
|
||||||
|
|
||||||
# Create GitHub release with Rust build targets and release notes
|
# Create GitHub release with Rust build targets and release notes
|
||||||
github_release:
|
github_release:
|
||||||
name: Create GitHub Release
|
name: Create GitHub Release
|
||||||
|
|
|
||||||
|
|
@ -28,3 +28,6 @@ Cargo.lock
|
||||||
# Compiled files for documentation
|
# Compiled files for documentation
|
||||||
docs/node_modules
|
docs/node_modules
|
||||||
docs/.vuepress/dist/
|
docs/.vuepress/dist/
|
||||||
|
|
||||||
|
# Ignore pkg files within the install directory
|
||||||
|
install/**/*.pkg
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
|
<plist version="1.0">
|
||||||
|
<dict>
|
||||||
|
<key>arch</key>
|
||||||
|
<array>
|
||||||
|
<string>arm64</string>
|
||||||
|
</array>
|
||||||
|
</dict>
|
||||||
|
</plist>
|
||||||
|
|
@ -0,0 +1,115 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Envrionmental variables that need to be set. These are sane defaults
|
||||||
|
# KEYCHAIN_ENTRY=AC_PASSWORD # Or whatever you picked for <AUTH_ITEM_NAME>
|
||||||
|
# RUNNER_TEMP=~/Library/Keychains/
|
||||||
|
# KEYCHAIN_FILENAME=login.keychain-db
|
||||||
|
#
|
||||||
|
# Environmental variables that can be set if needed. Else they will default to
|
||||||
|
# values selected for the CI
|
||||||
|
#
|
||||||
|
# The identifier for the application signing key. Can be a name or a fingerprint
|
||||||
|
# APPLICATION_KEY_IDENT=E03290CABE09E9E42341C8FC82608E91241FAD4A
|
||||||
|
# The identifier for the installer signing key. Can be a name or a fingerprint
|
||||||
|
# INSTALLATION_KEY_IDENT=E525359D0B5AE97B7B6F5BB465FEC872C117D681
|
||||||
|
|
||||||
|
usage(){
|
||||||
|
echo "Builds, signs, and notarizes starship."
|
||||||
|
echo "Read readme.md in the script directory to see the assumptions the script makes."
|
||||||
|
echo "Usage: $0 <path-to-starship-binary> <path-to-docs-directory> <arch> [pkgname]"
|
||||||
|
echo " Example: $0 target/release/starship docs/ x64"
|
||||||
|
echo " Example: $0 target/debug/starship docs/ arm64 starship-1.2.1-arm64.pkg"
|
||||||
|
echo ""
|
||||||
|
echo "If no pkgname is provided, the package will be named starship-<version>-<arch>.pkg"
|
||||||
|
}
|
||||||
|
|
||||||
|
script_dir="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
||||||
|
source "$script_dir/common.sh"
|
||||||
|
|
||||||
|
if [[ -z ${KEYCHAIN_ENTRY+x} ]]; then
|
||||||
|
error "Environmental variable KEYCHAIN_ENTRY must be set."
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z ${RUNNER_TEMP+x} ]]; then
|
||||||
|
error "Environmental variable RUNNER_TEMP must be set."
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z ${KEYCHAIN_FILENAME+x} ]]; then
|
||||||
|
error "Environmental variable KEYCHAIN_FILENAME must be set."
|
||||||
|
fi
|
||||||
|
|
||||||
|
keychain_path="$RUNNER_TEMP/$KEYCHAIN_FILENAME"
|
||||||
|
if [[ ! -f "$keychain_path" ]]; then
|
||||||
|
error "Could not find keychain at $keychain_path"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z ${APPLICATION_KEY_IDENT+x} ]]; then
|
||||||
|
APPLICATION_KEY_IDENT=E03290CABE09E9E42341C8FC82608E91241FAD4A
|
||||||
|
echo "APPLICATION_KEY_IDENT not set. Using default value of $APPLICATION_KEY_IDENT"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z ${INSTALLATION_KEY_IDENT+x} ]]; then
|
||||||
|
INSTALLATION_KEY_IDENT=E525359D0B5AE97B7B6F5BB465FEC872C117D681
|
||||||
|
echo "INSTALLATION_KEY_IDENT not set. Using default value of $INSTALLATION_KEY_IDENT"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z ${3+x} ]]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
starship_binary="$1"
|
||||||
|
starship_docs_dir="$2"
|
||||||
|
arch="$3"
|
||||||
|
pkgname="${4:-}"
|
||||||
|
|
||||||
|
if [[ ! -d "$starship_docs_dir/.vuepress/dist" ]]; then
|
||||||
|
error "Documentation does not appear to have been built!"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ">>>> Signing binary"
|
||||||
|
codesign --timestamp --keychain "$keychain_path" --sign "$APPLICATION_KEY_IDENT" --verbose -f -o runtime "$starship_binary"
|
||||||
|
|
||||||
|
# Make ZIP file to notarize binary
|
||||||
|
if [ "$starship_binary" != "starship" ]; then
|
||||||
|
cp "$starship_binary" starship
|
||||||
|
fi
|
||||||
|
zip starship.zip starship
|
||||||
|
|
||||||
|
echo ">>>> Submitting binary for notarization"
|
||||||
|
xcrun notarytool submit starship.zip --keychain-profile "$KEYCHAIN_ENTRY" --wait
|
||||||
|
|
||||||
|
# Don't think this is actually necessary, but not costly so why not
|
||||||
|
rm starship
|
||||||
|
unzip starship.zip
|
||||||
|
|
||||||
|
# Create the component package
|
||||||
|
echo ">>>> Building Component Package"
|
||||||
|
bash "$script_dir/build_component_package.sh" "starship" "$starship_docs_dir/.vuepress/dist"
|
||||||
|
|
||||||
|
# Create the distribution package
|
||||||
|
echo ">>>> Building Distribution Package"
|
||||||
|
resources_path="$script_dir/pkg_resources"
|
||||||
|
bash "$script_dir/build_distribution_package.sh" "starship-component.pkg" "$resources_path" "$arch"
|
||||||
|
|
||||||
|
# Codesign the package installer
|
||||||
|
productsign --timestamp --sign "$INSTALLATION_KEY_IDENT" starship-unsigned.pkg starship.pkg
|
||||||
|
|
||||||
|
# Notarize the package installer
|
||||||
|
echo ">>>> Submitting .pkg for notarization"
|
||||||
|
xcrun notarytool submit starship.pkg --keychain-profile "$KEYCHAIN_ENTRY" --wait
|
||||||
|
|
||||||
|
# Staple things
|
||||||
|
echo ">>>> Running final steps"
|
||||||
|
xcrun stapler staple starship.pkg
|
||||||
|
|
||||||
|
# Rename to expected name
|
||||||
|
if [ "$pkgname" = "" ]; then
|
||||||
|
version="$(starship_version "$starship_binary")"
|
||||||
|
pkgname="starship-$version-$arch.pkg"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ">>>> Placing final output at $pkgname"
|
||||||
|
mv starship.pkg "$pkgname"
|
||||||
|
|
@ -0,0 +1,90 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Requirements:
|
||||||
|
# - MacOS
|
||||||
|
# - A starship repository with binaries and documentation already built.
|
||||||
|
# Usage: run this script, passing $1 to the repository path. The script assumes
|
||||||
|
# it is being run from within a starship repository if $1 is not provided.
|
||||||
|
|
||||||
|
usage(){
|
||||||
|
echo "Builds a component package for macOS."
|
||||||
|
echo "Assumes that the following items already exist:"
|
||||||
|
echo " - A starship binary which has already been notarized"
|
||||||
|
echo " - Documentation created by \`npm run build\`, usually in a dist"
|
||||||
|
echo " directory at <repo>/docs/.vuepress/dist"
|
||||||
|
echo "Usage: $0 <path-to-starship-binary> <path-to-dist-directory>"
|
||||||
|
}
|
||||||
|
|
||||||
|
script_dir="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
||||||
|
source "$script_dir/common.sh"
|
||||||
|
|
||||||
|
cleanup_server(){
|
||||||
|
if [[ -n "${server_pid-}" ]]; then
|
||||||
|
echo "Killing HTTP server ($server_pid) to clean up."
|
||||||
|
kill "$server_pid"
|
||||||
|
rm "x86_64-apple-darwin-simple-http-server"
|
||||||
|
else
|
||||||
|
echo "No server found, exiting normally."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
if [[ "$OSTYPE" != 'darwin'* ]]; then
|
||||||
|
error "This script only works on MacOS"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${2-undefined}" = "undefined" ]]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
starship_program_file="$1"
|
||||||
|
starship_documentation_dir="$2"
|
||||||
|
|
||||||
|
if [ ! -f "$starship_program_file" ]; then
|
||||||
|
error "Could not find starship binary at $starship_program_file"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -d "$starship_documentation_dir" ]; then
|
||||||
|
error "Could not find starship documentation at $starship_documentation_dir"
|
||||||
|
fi
|
||||||
|
|
||||||
|
pkgdir="$(mktemp -d)"
|
||||||
|
mkdir -p "$pkgdir/usr/local/bin"
|
||||||
|
cp "$starship_program_file" "$pkgdir/usr/local/bin/starship"
|
||||||
|
|
||||||
|
# Now we get to make documentation! Vuepress was not designed to build locally
|
||||||
|
# (too many assumptions about running on an HTTP server), so we do the hackiest
|
||||||
|
# thing imagineable: start an http server, and use wget to make a local mirror.
|
||||||
|
|
||||||
|
# First, we need to install the server. There are several options, but this one
|
||||||
|
# provides prebuilt binaries for MacOS, making it the easiest. (yay rust)
|
||||||
|
server_prog_name="x86_64-apple-darwin-simple-http-server"
|
||||||
|
latest_server_version="$(curl -L -s -H 'Accept: application/json' https://github.com/TheWaWaR/simple-http-server/releases/latest | sed -e 's/.*"tag_name":"\([^"]*\)".*/\1/')"
|
||||||
|
curl -LOk "https://github.com/TheWaWaR/simple-http-server/releases/download/$latest_server_version/$server_prog_name"
|
||||||
|
chmod u+x "$server_prog_name"
|
||||||
|
|
||||||
|
# Next, we build the documentation and serve it via simple-http-server
|
||||||
|
trap cleanup_server INT
|
||||||
|
"./$server_prog_name" --ip 127.0.0.1 --index "$starship_documentation_dir" &
|
||||||
|
server_pid="$!"
|
||||||
|
# Give the server a chance to come online before trying to mirror it
|
||||||
|
echo "Sleeping to give the server a chance to come online..."
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
# Use wget to make a mirror of the site and move it into the package. Not installed
|
||||||
|
# on MacOS by default, but lucky for us, it does exist on GHActions runners.
|
||||||
|
# Wget may return nonzero exit codes even if things were mostly fine (e.g. 404 for
|
||||||
|
# some links on translated pages) so we simply ignore if it has a failure
|
||||||
|
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent 127.0.0.1:8000 &> wget.log || true
|
||||||
|
mkdir -p "$pkgdir/usr/local/share/doc/"
|
||||||
|
mv 127.0.0.1:8000 "$pkgdir/usr/local/share/doc/starship"
|
||||||
|
|
||||||
|
# Technically a race condition here, but very unlikely to hit it in practice.
|
||||||
|
cleanup_server
|
||||||
|
trap - INT
|
||||||
|
|
||||||
|
# Build the component package
|
||||||
|
version="$(starship_version "$starship_program_file")"
|
||||||
|
pkgbuild --identifier com.starshipprompt.starship --version "$version" --root $pkgdir starship-component.pkg
|
||||||
|
|
@ -0,0 +1,67 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
component_package="$1"
|
||||||
|
resources="$2"
|
||||||
|
arch="$3"
|
||||||
|
|
||||||
|
usage(){
|
||||||
|
echo "Builds a distribution package for macOS."
|
||||||
|
echo "Assumes that the following items already exist:"
|
||||||
|
echo " - A starship component package"
|
||||||
|
echo " - Resources in a pkg_resources directory"
|
||||||
|
echo "Usage: $0 <path-to-component-package> <path-to-pkg-resources> <arch>"
|
||||||
|
echo " where arch is one of \"arm64\" or \"x86_64\""
|
||||||
|
}
|
||||||
|
|
||||||
|
script_dir="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
|
||||||
|
source "$script_dir/common.sh"
|
||||||
|
|
||||||
|
if [[ "$OSTYPE" != 'darwin'* ]]; then
|
||||||
|
error "This script only works on MacOS"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${3-undefined}" = "undefined" ]]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Generate a distribution file with the appropriate architecture plists
|
||||||
|
if [[ "$arch" == "x86_64" || "$arch" == "x64" ]]; then
|
||||||
|
archplist="$script_dir/x86_64.plist"
|
||||||
|
elif [[ "$arch" == "arm64" || "$arch" == "aarch64" ]]; then
|
||||||
|
archplist="$script_dir/aarch64.plist"
|
||||||
|
else
|
||||||
|
error "Invalid architecture: $arch"
|
||||||
|
fi
|
||||||
|
|
||||||
|
productbuild --synthesize --package starship-component.pkg --product "$archplist" starship_raw.dist
|
||||||
|
|
||||||
|
# A terrible hacky way to insert nodes into XML without needing a full XML parser:
|
||||||
|
# search for a line that matches our opening tag and insert our desired lines after it
|
||||||
|
# Solution taken from https://www.theunixschool.com/2012/06/insert-line-before-or-after-pattern.html
|
||||||
|
|
||||||
|
while read -r line
|
||||||
|
do
|
||||||
|
echo "$line"
|
||||||
|
if echo "$line" | grep -qF '<installer-gui-script '; then
|
||||||
|
echo '<welcome file="welcome.html" mime-type="text-html" />'
|
||||||
|
echo '<license file="license.html" mime-type="text-html" />'
|
||||||
|
echo '<conclusion file="conclusion.html" mime-type="text-html" />'
|
||||||
|
echo '<background file="icon.png" scaling="proportional" alignment="bottomleft"/>'
|
||||||
|
fi
|
||||||
|
done < starship_raw.dist > starship.dist
|
||||||
|
|
||||||
|
# The above script does not correctly take care of the last line. Apply fixup.
|
||||||
|
echo '</installer-gui-script>' >> starship.dist
|
||||||
|
|
||||||
|
echo "Creating distribution package with following distribution file:"
|
||||||
|
cat starship.dist
|
||||||
|
|
||||||
|
echo "Resource directory is $resources"
|
||||||
|
echo "Component package is $component_package"
|
||||||
|
|
||||||
|
# Build the distribution package
|
||||||
|
productbuild --distribution starship.dist --resources "$resources" --package-path "$component_package" starship-unsigned.pkg
|
||||||
|
|
||||||
|
# Clean up the distribution files
|
||||||
|
rm -- *.dist
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
error(){
|
||||||
|
echo "[ERROR]: $1"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
starship_version(){
|
||||||
|
starship_program_file="$1"
|
||||||
|
# Check if this is a relative path: if so, prepend './' to it
|
||||||
|
if [ "$1" = "${1#/}" ]; then
|
||||||
|
starship_program_file="./$starship_program_file"
|
||||||
|
fi
|
||||||
|
if "$starship_program_file" -V 2>&1 > /dev/null; then
|
||||||
|
"$starship_program_file" -V | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+'
|
||||||
|
else
|
||||||
|
# try to get this information from Cargo.toml
|
||||||
|
pushd "$(git rev-parse --show-toplevel)" || true
|
||||||
|
grep '^version = \"\(.*\)\"' Cargo.toml | cut -f 2 -d '"'
|
||||||
|
popd
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<title>Install Starship</title>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<font face="Helvetica Neue" size="4">
|
||||||
|
<p>Starship has been installed!</p>
|
||||||
|
<p>Visit <a href="https://starship.rs">https://starship.rs</a> to get
|
||||||
|
instructions on how to configure your shell to use starship.</p>
|
||||||
|
<p>If you do not have internet access, you can view an offline copy of the
|
||||||
|
the documentation by opening
|
||||||
|
<a href="file:///usr/local/share/doc/starship/index.html">
|
||||||
|
<code>
|
||||||
|
/usr/local/share/doc/starship/index.html.
|
||||||
|
</code>
|
||||||
|
</a>
|
||||||
|
</p>
|
||||||
|
<p>Unless you modified the installer, your copy of starship was installed to
|
||||||
|
<code>/usr/local/bin/starship</code>.
|
||||||
|
</p>
|
||||||
|
</font>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<title>ISC License</title>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<font face="Helvetica Neue" size="4">
|
||||||
|
<p>ISC License</p>
|
||||||
|
<p>Copyright (c) 2019-2022, Starship Contributors</p>
|
||||||
|
<p>Permission to use, copy, modify, and/or distribute this software for any
|
||||||
|
purpose with or without fee is hereby granted, provided that the above
|
||||||
|
copyright notice and this permission notice appear in all copies.</p>
|
||||||
|
<p>THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.</p>
|
||||||
|
</font>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<title>Install Starship</title>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<font face="Helvetica Neue" size="4">
|
||||||
|
<p>Starship is the minimal, blazing-fast, and infinitely customizable prompt for any shell!</p>
|
||||||
|
<p>This installer will install Starship on to <code>/usr/local/</code> on your system.</p>
|
||||||
|
<p>After the installation, you will need to modify your shell startup files to
|
||||||
|
use starship.</p>
|
||||||
|
</font>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
|
|
@ -0,0 +1,263 @@
|
||||||
|
# MacOS Codesigning Scripts
|
||||||
|
|
||||||
|
Well, here we are. The Apple notarization procedure is complex enough that I
|
||||||
|
need an actual pile of scripts and writeup to be able to remember how to do it.
|
||||||
|
|
||||||
|
The basic procedure is as follows:
|
||||||
|
|
||||||
|
- Build code
|
||||||
|
- Build docs
|
||||||
|
- Sign binary with Developer Application ID
|
||||||
|
- Upload binary to notarization service to get notarized
|
||||||
|
- Use code + docs to generate a component package
|
||||||
|
- Use component package to generate a distribution package
|
||||||
|
- Sign distribution package with Developer Installer ID
|
||||||
|
- Upload distribution package to notarization service to get notarized
|
||||||
|
|
||||||
|
Et. voila, you have a notarized distribution package which can be installed.
|
||||||
|
|
||||||
|
I fully anticipate that this procedure will break in the future, so here is the
|
||||||
|
(scant) documentation that I have been able to scrape together on these procedures,
|
||||||
|
along with some commentary on things that I've found and requirements for these
|
||||||
|
scripts.
|
||||||
|
|
||||||
|
You will need XCode installed.
|
||||||
|
|
||||||
|
## Short-form Command Line Invocation
|
||||||
|
|
||||||
|
If you have the prerequisites set up (including the environment variables as
|
||||||
|
described below, built docs, and built release binary), you can generate the
|
||||||
|
package file with the following command:
|
||||||
|
|
||||||
|
```
|
||||||
|
./install/macos_packages/build_and_notarize.sh target/release/starship docs x64
|
||||||
|
```
|
||||||
|
|
||||||
|
or `arm64` if building on Apple silicon.
|
||||||
|
|
||||||
|
## Setting Up Credentials
|
||||||
|
|
||||||
|
### Apple Developer Account
|
||||||
|
|
||||||
|
In order to get the signing keys, you need to have a developer account. You can
|
||||||
|
buy one at https://developer.apple.com/programs/ for $100 a year (at time of
|
||||||
|
writing).
|
||||||
|
|
||||||
|
There is no other way to acquire an account, which is needed to obtain
|
||||||
|
non-self-signed keys and to be able to notarize files.
|
||||||
|
|
||||||
|
### Signing Keys
|
||||||
|
|
||||||
|
To generate the signing keys, I went through the [XcodeGUI](https://help.apple.com/xcode/mac/current/#/dev154b28f09), though there are
|
||||||
|
several other methods to do this. You will need at least one Application signing
|
||||||
|
key and one Installer signing key.
|
||||||
|
|
||||||
|
To check what signing keys are available, you can use the following command:
|
||||||
|
|
||||||
|
```
|
||||||
|
security find-identity -p basic -v
|
||||||
|
```
|
||||||
|
|
||||||
|
### Notarization Credentials
|
||||||
|
|
||||||
|
To be able to notarize objects, you will need an app-specific password. You will
|
||||||
|
need to set it up using the instructions [on this page](https://support.apple.com/en-us/HT204397).
|
||||||
|
You will also need your team ID, which can be found at https://developer.apple.com/account/#/membership
|
||||||
|
(if it goes to the home page, click on "Membership" on the left panel), and your
|
||||||
|
Apple ID (usually an email address).
|
||||||
|
|
||||||
|
If you want to enter everything manually, most commands that require these values
|
||||||
|
accept the `--apple-id`, `--team-id`, and `--password` flags. However, I find it
|
||||||
|
simpler to store the credentials in the keychain. You can do so with the following
|
||||||
|
command:
|
||||||
|
|
||||||
|
```
|
||||||
|
xcrun notarytool store-credentials "<AUTH_ITEM_NAME>" --apple-id "<apple-id>" --password "<password>" --team-id "<team-id>"
|
||||||
|
```
|
||||||
|
|
||||||
|
where `<AUTH_ITEM_NAME>` is a name you will use later to refer to the credentials,
|
||||||
|
and the other three items are the Apple ID, the Team ID, and the app-specific password,
|
||||||
|
respectively. For the rest of this document, I will assume that its value is
|
||||||
|
`AC_PASSWORD` for compatibility with Apple's website, though you may choose
|
||||||
|
whatever you like.
|
||||||
|
|
||||||
|
### Script Assumptions
|
||||||
|
|
||||||
|
The scripts in this directory assume that the signing keys and the notarization
|
||||||
|
credentials are unlocked and available within a specific keychain file, stored
|
||||||
|
in a file at `$RUNNER_TEMP/$KEYCHAIN_FILENAME`. Additionally, it assumes that
|
||||||
|
the `AUTH_ITEM_NAME` used to refer to the notarization credentials is found in
|
||||||
|
the environment under the variable `KEYCHAIN_ENTRY`.
|
||||||
|
|
||||||
|
The CI environment ensures that the keychain file exists at the appropriate
|
||||||
|
locations and is destroyed after use. If you are running these scripts locally,
|
||||||
|
the values that correspond to what Apple uses in their tutorials are:
|
||||||
|
|
||||||
|
```
|
||||||
|
KEYCHAIN_ENTRY=AC_PASSWORD # Or whatever you picked for <AUTH_ITEM_NAME> above
|
||||||
|
RUNNER_TEMP=~/Library/Keychains
|
||||||
|
KEYCHAIN_FILENAME=login.keychain
|
||||||
|
```
|
||||||
|
|
||||||
|
Note to developers: because the keychain file may be a user's personal keychain,
|
||||||
|
you MUST NEVER WRITE TO THE KEYCHAIN FILE in these scripts. On the CI, CI actions
|
||||||
|
will ensure that the keychain file is shredded after use.
|
||||||
|
|
||||||
|
## Codesigning a Binary
|
||||||
|
|
||||||
|
This is actually fairly simple. Run
|
||||||
|
|
||||||
|
```
|
||||||
|
codesign --timestamp --sign "<Key ID>" --verbose -f -o runtime <binary>
|
||||||
|
```
|
||||||
|
|
||||||
|
to sign the binary file. `--timestamp` is not required for signing, but will be
|
||||||
|
required for notarization. `<Key ID>` can be one of two things: the name of the
|
||||||
|
signing key (on the right of `security find-identity -p basic -v`), or the key
|
||||||
|
hash (the hex string on the left of the command).
|
||||||
|
|
||||||
|
Usually you can use name of the key, but if you have multiple keys like me, you
|
||||||
|
may need to use the hex string to specify.
|
||||||
|
|
||||||
|
## Notarizing a Binary
|
||||||
|
|
||||||
|
Once the binary has been signed, you need to package it into a .zip file in order
|
||||||
|
to be able to send it to Apple for notarization. The simplest way to do this is
|
||||||
|
to run `zip <archive.zip> <binary>`.
|
||||||
|
|
||||||
|
Then, run `xcrun notarytool submit <archive.zip> --keychain-profile "AC_PASSWORD" --wait`
|
||||||
|
to submit the binary for notarization. The `--wait` flag will cause the tool to
|
||||||
|
block until the notarialization is complete. If you want to be able to leave and
|
||||||
|
check the results later, omit `--wait` (though starship notarization usually takes
|
||||||
|
no more than 60s).
|
||||||
|
|
||||||
|
Finally, you should check the submission logs. To get a record of all notarization
|
||||||
|
attempts, run
|
||||||
|
|
||||||
|
```
|
||||||
|
xcrun notarytool history --keychain-profile "AC_PASSWORD"
|
||||||
|
```
|
||||||
|
|
||||||
|
Find the `id` of the attempt you wish to view, then run one of these commmands:
|
||||||
|
|
||||||
|
```
|
||||||
|
xcrun notarytool info <run-id> --keychain-profile "AC_PASSWORD"
|
||||||
|
xcrun notarytool log <run-id> --keychain-profile "AC_PASSWORD"
|
||||||
|
```
|
||||||
|
|
||||||
|
The `log` command downloads a JSON log of the notarization attempt, and can reveal
|
||||||
|
warnings that should be fixed before the next submission.
|
||||||
|
|
||||||
|
Additional details on the notarization process can be found at https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow.
|
||||||
|
Note that while Apple has a lot of requirements on their pages, including stuff
|
||||||
|
like Hardened Runtime requirements and listing entitlements, as far as I can tell,
|
||||||
|
starship does not require any of these even though we do things like send
|
||||||
|
notifications and access the network via an HTTP client. Nonetheless, I'm
|
||||||
|
linking the [entitlements page](https://developer.apple.com/documentation/bundleresources/entitlements)
|
||||||
|
here in case it becomes important later.
|
||||||
|
|
||||||
|
## Creating a Component Package
|
||||||
|
|
||||||
|
Since I'm only dealing with one binary, we will make one Component package and
|
||||||
|
one Distribution package. Surprisingly, the flat package (.pkg) format is not
|
||||||
|
documented by Apple. [This guide](https://matthew-brett.github.io/docosx/flat_packages.html)
|
||||||
|
and many of the links within it are the best documentation available on the subject.
|
||||||
|
|
||||||
|
To build a component package, we first need to create a temporary directory and
|
||||||
|
create a pseudo-filesystem within it (similar to makepkg on Arch). For example,
|
||||||
|
if we place the directory at `$TEMP_DIR/usr/local/bin/starship`, the binary
|
||||||
|
will be installed at `/usr/local/bin/starship` once the installer runs.
|
||||||
|
|
||||||
|
An aside on docs: We would also like to include documentation in the pkg.
|
||||||
|
Unfortunately, Vuepress currently cannot build with relative paths, and any
|
||||||
|
attempt at hacking this in seems to create even more problems. Instead, the
|
||||||
|
scripts do the dumbest thing imaginable: build the documentation, serve it with
|
||||||
|
a simple HTTP server, and then use `wget` to make a local copy which can be
|
||||||
|
viewed offline.
|
||||||
|
|
||||||
|
Once everything is placed in the correct locations, we can run the following
|
||||||
|
command to generate the component package:
|
||||||
|
|
||||||
|
```
|
||||||
|
pkgbuild --identifier com.starshipprompt.starship --version "<version>" --root <pkgdir> output.pkg
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notarizing the Component Package (and why we don't need to)
|
||||||
|
|
||||||
|
Fortunately for us, Apple has confirmed that we only need to notarize the
|
||||||
|
[outermost installer mechanism](https://developer.apple.com/forums/thread/122045).
|
||||||
|
|
||||||
|
Therefore, if we are sending the component package on its own, we should notarize
|
||||||
|
it now. However, for starship, we will bundle this into a distribution package,
|
||||||
|
so we don't need to notarize this pkg file.
|
||||||
|
|
||||||
|
## Creating a Distribution Package
|
||||||
|
|
||||||
|
To create a distribution, we do the following steps:
|
||||||
|
|
||||||
|
- Use `productbuild` to generate a skeleton distribution file.
|
||||||
|
- Insert custom welcome/license/conclusion and icon files into the installer.
|
||||||
|
- Build the installer with `productbuild`.
|
||||||
|
|
||||||
|
I have elected not to make a fat binary due to concerns over startup cost, so
|
||||||
|
there are two .plist files that can be used to specify the architecture required.
|
||||||
|
|
||||||
|
## Signing the Distribution package
|
||||||
|
|
||||||
|
This is also fairly simple, and analagous to signing the binary.
|
||||||
|
|
||||||
|
```
|
||||||
|
productsign --timestamp --sign "<Key ID>" <input.pkg> <output.pkg>
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notarizing the Distribution Package
|
||||||
|
|
||||||
|
Also analagous to notarizing the binary. We run
|
||||||
|
|
||||||
|
```
|
||||||
|
xcrun notarytool submit <package.pkg> --keychain-profile "AC_PASSWORD" --wait
|
||||||
|
```
|
||||||
|
|
||||||
|
and also check the submission logs.
|
||||||
|
|
||||||
|
Note: you may need to enter your password a ridiculous number of times (like 4+)
|
||||||
|
in order to successfully notarize this.
|
||||||
|
|
||||||
|
## Stapling the Result
|
||||||
|
|
||||||
|
Finally, we staple the notarization ticket to the package, ensuring that anyone
|
||||||
|
who downloads the file can see that the installer was notarized:
|
||||||
|
|
||||||
|
```
|
||||||
|
xcrun stapler staple <package>
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that `.dmg`, `.app`, and `.pkg` files can be stapled, but `.zip` and
|
||||||
|
binary files cannot. Distributing the latter files alone will require that the
|
||||||
|
installing computer can access the internet to verify notarization of the app.
|
||||||
|
|
||||||
|
## Putting It All Together
|
||||||
|
|
||||||
|
If you don't want to run these commands, a full workflow is available in
|
||||||
|
`build_and_notarize` script. Check the documentation at the top of the script
|
||||||
|
for environment variables and arguments that need to be set--it is a fairly
|
||||||
|
complicated script, but this is a fairly complicated procedure.
|
||||||
|
|
||||||
|
# Testing Notarization
|
||||||
|
|
||||||
|
To test if a particular item is notarized, run one of the following commands:
|
||||||
|
|
||||||
|
```
|
||||||
|
codesign --test-requirement="=notarized" --verify --verbose <file>
|
||||||
|
spctl -a -vvv -t install <file>
|
||||||
|
```
|
||||||
|
|
||||||
|
# External Links
|
||||||
|
|
||||||
|
https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution
|
||||||
|
|
||||||
|
https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow
|
||||||
|
|
||||||
|
https://github.com/akeru-inc/xcnotary
|
||||||
|
|
||||||
|
https://www.reddit.com/r/rust/comments/q8r90b/notarization_of_rust_binary_for_distribution_on/
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
|
<plist version="1.0">
|
||||||
|
<dict>
|
||||||
|
<key>arch</key>
|
||||||
|
<array>
|
||||||
|
<string>x86_64</string>
|
||||||
|
</array>
|
||||||
|
</dict>
|
||||||
|
</plist>
|
||||||
Loading…
Reference in New Issue