mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 16:33:27 +00:00
Claude
d10e6c4d81
Sign the macOS jlink image (amy-<version>-macos-arm64.tar.gz) so users who download it directly clear Gatekeeper. Reuses the same Developer ID cert and the six MAC_* secrets as the desktop DMG; no-op when they're absent. - .github/actions/import-macos-cert: factor the throwaway-keychain cert import into a composite action; the desktop leg now uses it too (was inline). - create-release.yml (build-cli macOS leg): import the cert, then codesign every Mach-O binary in the bundled JRE (executables get hardened-runtime entitlements, dylibs don't) and notarize via notarytool --wait. Runs before the collect step so the tarred image is signed. Job timeout 30->45 min for notarization headroom. - cli/packaging/macos/amy.entitlements: hardened-runtime entitlements; the disable-library-validation key lets the JVM load the secp256k1 native dylib it extracts from a jar at runtime (would otherwise crash under notarization). - BUILDING.md: document the tarball signing, the no-stapling/online-check caveat, and that the Homebrew-core jvm bundle is intentionally left unsigned. Untested end-to-end (no macOS runner / Apple creds here) — validate with a workflow_dispatch dry-run once the secrets are provisioned. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sso31DfSF9B6EFCVkEqWD
53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
name: Import macOS Developer ID certificate
|
|
description: >
|
|
Import a Developer ID Application certificate (base64-encoded .p12) into a
|
|
throwaway keychain so codesign/jpackage can find it during the job. Soft:
|
|
when no certificate is supplied it is a no-op and reports signing=false, so
|
|
callers build UNSIGNED artifacts exactly as before.
|
|
|
|
inputs:
|
|
certificate-p12-base64:
|
|
description: Base64 of the Developer ID Application .p12 (cert + private key)
|
|
required: true
|
|
certificate-password:
|
|
description: Password used when the .p12 was exported
|
|
required: true
|
|
|
|
outputs:
|
|
signing:
|
|
description: "'true' if a certificate was imported, else 'false'"
|
|
value: ${{ steps.import.outputs.signing }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: import
|
|
shell: bash
|
|
env:
|
|
CERT_P12: ${{ inputs.certificate-p12-base64 }}
|
|
CERT_PASSWORD: ${{ inputs.certificate-password }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${CERT_P12:-}" ]]; then
|
|
echo "::notice::No macOS signing certificate configured — artifacts will be UNSIGNED."
|
|
echo "signing=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
KEYCHAIN="$RUNNER_TEMP/amethyst-signing.keychain-db"
|
|
KEYCHAIN_PWD="$(openssl rand -base64 24)"
|
|
CERT_PATH="$RUNNER_TEMP/developer_id.p12"
|
|
security create-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN"
|
|
security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN"
|
|
echo "$CERT_P12" | base64 --decode > "$CERT_PATH"
|
|
security import "$CERT_PATH" -P "$CERT_PASSWORD" \
|
|
-k "$KEYCHAIN" -T /usr/bin/codesign -T /usr/bin/productsign
|
|
# Let codesign use the private key without an interactive UI prompt.
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: \
|
|
-s -k "$KEYCHAIN_PWD" "$KEYCHAIN" >/dev/null
|
|
# Prepend our keychain to the user search list so codesign sees it.
|
|
security list-keychains -d user -s "$KEYCHAIN" \
|
|
$(security list-keychains -d user | sed -e 's/[\"[:space:]]//g')
|
|
rm -f "$CERT_PATH"
|
|
echo "signing=true" >> "$GITHUB_OUTPUT"
|