You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.1 KiB
63 lines
2.1 KiB
11 months ago
|
#!/bin/sh
|
||
|
|
|
||
|
|
echo "Signing file: $1"
|
||
|
|
|
||
|
|
# Setup keychain in CI
|
||
|
|
if [ -n "$CI" ]; then
|
||
|
|
# Turn our base64-encoded certificate back to a regular .p12 file
|
||
|
|
|
||
|
|
echo "$MACOS_CERTIFICATE" | base64 --decode -o certificate.p12
|
||
|
|
|
||
|
|
# We need to create a new keychain, otherwise using the certificate will prompt
|
||
|
|
# with a UI dialog asking for the certificate password, which we can't
|
||
|
|
# use in a headless CI environment
|
||
|
|
|
||
|
|
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
||
|
|
security default-keychain -s build.keychain
|
||
|
|
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
||
|
|
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
|
||
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Sign all files
|
||
|
|
PARENT_PATH=$( cd "$(dirname "${BASH_SOURCE[0]}")" || return ; pwd -P )
|
||
|
|
ENTITLEMENTS="$PARENT_PATH/EmbeddedEntitlements.entitlements"
|
||
|
|
|
||
|
|
echo "Using entitlements file: $ENTITLEMENTS"
|
||
|
|
|
||
|
|
# App
|
||
|
|
if [ "$1" == "*.app" ]; then
|
||
|
|
echo "[INFO] Signing app contents"
|
||
|
|
|
||
|
|
find "$1/Contents/MacOS/"|while read fname; do
|
||
|
|
if [[ -f $fname ]]; then
|
||
|
|
echo "[INFO] Signing $fname"
|
||
|
|
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$fname"
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "[INFO] Signing app file"
|
||
|
|
|
||
|
|
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$1" -v
|
||
|
|
# Directory
|
||
|
|
elif [ -d "$1" ]; then
|
||
|
|
echo "[INFO] Signing directory contents"
|
||
|
|
|
||
|
|
find "$1"|while read fname; do
|
||
|
|
if [[ -f $fname ]] && [[ ! $fname =~ /(*.(py|msg|enc))/ ]]; then
|
||
|
|
echo "[INFO] Signing $fname"
|
||
|
|
|
||
|
|
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$fname"
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
# File
|
||
|
|
elif [ -f "$1" ]; then
|
||
|
|
echo "[INFO] Signing file"
|
||
|
|
|
||
|
|
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$1" -v
|
||
|
|
# Not matched
|
||
|
|
else
|
||
|
|
echo "[ERROR] Unknown file type"
|
||
|
|
exit 1
|
||
|
|
fi
|