Ionite
11 months ago
committed by
GitHub
7 changed files with 225 additions and 6 deletions
@ -0,0 +1,10 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> |
||||
<plist version="1.0"> |
||||
<dict> |
||||
<key>com.apple.security.cs.allow-jit</key> |
||||
<true/> |
||||
<key>com.apple.security.automation.apple-events</key> |
||||
<true/> |
||||
</dict> |
||||
</plist> |
||||
@ -0,0 +1,26 @@
|
||||
#!/bin/sh |
||||
|
||||
while getopts v: flag |
||||
do |
||||
case "${flag}" in |
||||
v) version=${OPTARG};; |
||||
*) echo "Invalid option";; |
||||
esac |
||||
done |
||||
|
||||
dotnet \ |
||||
msbuild \ |
||||
StabilityMatrix.Avalonia \ |
||||
-t:BundleApp \ |
||||
-p:RuntimeIdentifier=osx-arm64 \ |
||||
-p:UseAppHost=true \ |
||||
-p:Configuration=Release \ |
||||
-p:CFBundleShortVersionString="$version" \ |
||||
-p:SelfContained=true \ |
||||
-p:CFBundleName="Stability Matrix" \ |
||||
-p:CFBundleDisplayName="Stability Matrix" \ |
||||
-p:CFBundleVersion="$version" \ |
||||
-p:PublishDir="$(pwd)/out/osx-arm64/bin" \ |
||||
|
||||
# Copy the app out of bin |
||||
cp -r ./out/osx-arm64/bin/Stability\ Matrix.app ./out/osx-arm64/Stability\ Matrix.app |
||||
@ -0,0 +1,35 @@
|
||||
#!/bin/sh |
||||
|
||||
echo "Signing file: $1" |
||||
|
||||
# Setup keychain in CI |
||||
if [ -n "$CI" ]; then |
||||
# Turn our base64-encoded certificate back to a regular .p12 file |
||||
|
||||
echo "$MACOS_CERTIFICATE" | base64 --decode -o certificate.p12 |
||||
|
||||
# We need to create a new keychain, otherwise using the certificate will prompt |
||||
# with a UI dialog asking for the certificate password, which we can't |
||||
# use in a headless CI environment |
||||
|
||||
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain |
||||
security default-keychain -s build.keychain |
||||
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain |
||||
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign |
||||
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain |
||||
fi |
||||
|
||||
# Sign all files |
||||
|
||||
ENTITLEMENTS="AppEntitlements.entitlements" |
||||
|
||||
find "$1/Contents/MacOS/"|while read fname; do |
||||
if [[ -f $fname ]]; then |
||||
echo "[INFO] Signing $fname" |
||||
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$fname" |
||||
fi |
||||
done |
||||
|
||||
echo "[INFO] Signing app file" |
||||
|
||||
codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$1" -v |
||||
@ -0,0 +1,32 @@
|
||||
#!/bin/sh |
||||
|
||||
echo "Notarizing file: $1" |
||||
|
||||
# Store the notarization credentials so that we can prevent a UI password dialog |
||||
# from blocking the CI |
||||
|
||||
echo "Create keychain profile" |
||||
xcrun notarytool store-credentials "notarytool-profile" \ |
||||
--apple-id "$MACOS_NOTARIZATION_APPLE_ID" \ |
||||
--team-id "$MACOS_NOTARIZATION_TEAM_ID" \ |
||||
--password "$MACOS_NOTARIZATION_PWD" |
||||
|
||||
# We can't notarize an app bundle directly, but we need to compress it as an archive. |
||||
# Therefore, we create a zip file containing our app bundle, so that we can send it to the |
||||
# notarization service |
||||
|
||||
echo "Creating temp notarization archive" |
||||
ditto -c -k --keepParent "$1" "notarization.zip" |
||||
|
||||
# Here we send the notarization request to the Apple's Notarization service, waiting for the result. |
||||
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App |
||||
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if |
||||
# you're curious |
||||
|
||||
echo "Notarize app" |
||||
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait |
||||
|
||||
# Finally, we need to "attach the staple" to our executable, which will allow our app to be |
||||
# validated by macOS even when an internet connection is not available. |
||||
echo "Attach staple" |
||||
xcrun stapler staple "$1" |
||||
Binary file not shown.
Loading…
Reference in new issue