Skip to content

Commit f6a9b1e

Browse files
mokagioAliSoftware
andauthored
Sign release build with distribution certificate (#150)
Co-authored-by: Olivier Halligon <[email protected]>
2 parents 7cf632c + 6441b37 commit f6a9b1e

File tree

4 files changed

+101
-62
lines changed

4 files changed

+101
-62
lines changed

.rubocop.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ AllCops:
1717
SuggestExtensions: false
1818

1919
Metrics/MethodLength:
20-
Max: 16
20+
Max: 30
2121

2222
Style/HashSyntax:
2323
EnforcedShorthandSyntax: never

Gemfile.lock

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -10,31 +10,35 @@ GEM
1010
artifactory (3.0.17)
1111
ast (2.4.2)
1212
atomos (0.1.3)
13-
aws-eventstream (1.3.0)
14-
aws-partitions (1.1001.0)
15-
aws-sdk-core (3.211.0)
13+
aws-eventstream (1.4.0)
14+
aws-partitions (1.1180.0)
15+
aws-sdk-core (3.236.0)
1616
aws-eventstream (~> 1, >= 1.3.0)
1717
aws-partitions (~> 1, >= 1.992.0)
1818
aws-sigv4 (~> 1.9)
19+
base64
20+
bigdecimal
1921
jmespath (~> 1, >= 1.6.1)
20-
aws-sdk-kms (1.95.0)
21-
aws-sdk-core (~> 3, >= 3.210.0)
22+
logger
23+
aws-sdk-kms (1.116.0)
24+
aws-sdk-core (~> 3, >= 3.234.0)
2225
aws-sigv4 (~> 1.5)
23-
aws-sdk-s3 (1.169.0)
24-
aws-sdk-core (~> 3, >= 3.210.0)
26+
aws-sdk-s3 (1.202.0)
27+
aws-sdk-core (~> 3, >= 3.234.0)
2528
aws-sdk-kms (~> 1)
2629
aws-sigv4 (~> 1.5)
27-
aws-sigv4 (1.10.1)
30+
aws-sigv4 (1.12.1)
2831
aws-eventstream (~> 1, >= 1.0.2)
2932
babosa (1.0.4)
30-
base64 (0.2.0)
33+
base64 (0.3.0)
34+
bigdecimal (3.3.1)
3135
claide (1.1.0)
3236
colored (1.2)
3337
colored2 (3.1.2)
3438
commander (4.6.0)
3539
highline (~> 2.0.0)
3640
declarative (0.0.20)
37-
digest-crc (0.6.5)
41+
digest-crc (0.7.0)
3842
rake (>= 12.0.0, < 14.0.0)
3943
domain_name (0.6.20240107)
4044
dotenv (2.8.1)
@@ -56,20 +60,20 @@ GEM
5660
faraday (>= 0.8.0)
5761
http-cookie (~> 1.0.0)
5862
faraday-em_http (1.0.0)
59-
faraday-em_synchrony (1.0.0)
63+
faraday-em_synchrony (1.0.1)
6064
faraday-excon (1.1.0)
6165
faraday-httpclient (1.0.1)
62-
faraday-multipart (1.0.4)
63-
multipart-post (~> 2)
66+
faraday-multipart (1.1.1)
67+
multipart-post (~> 2.0)
6468
faraday-net_http (1.0.2)
6569
faraday-net_http_persistent (1.2.0)
6670
faraday-patron (1.0.0)
6771
faraday-rack (1.0.0)
6872
faraday-retry (1.0.3)
6973
faraday_middleware (1.2.1)
7074
faraday (~> 1.0)
71-
fastimage (2.3.1)
72-
fastlane (2.225.0)
75+
fastimage (2.4.0)
76+
fastlane (2.228.0)
7377
CFPropertyList (>= 2.3, < 4.0.0)
7478
addressable (>= 2.8, < 3.0.0)
7579
artifactory (~> 3.0)
@@ -109,7 +113,7 @@ GEM
109113
tty-spinner (>= 0.8.0, < 1.0.0)
110114
word_wrap (~> 1.0.0)
111115
xcodeproj (>= 1.13.0, < 2.0.0)
112-
xcpretty (~> 0.3.0)
116+
xcpretty (~> 0.4.1)
113117
xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
114118
fastlane-sirp (1.0.0)
115119
sysrandom (~> 1.0)
@@ -130,12 +134,12 @@ GEM
130134
google-apis-core (>= 0.11.0, < 2.a)
131135
google-apis-storage_v1 (0.31.0)
132136
google-apis-core (>= 0.11.0, < 2.a)
133-
google-cloud-core (1.7.1)
137+
google-cloud-core (1.8.0)
134138
google-cloud-env (>= 1.0, < 3.a)
135139
google-cloud-errors (~> 1.0)
136140
google-cloud-env (1.6.0)
137141
faraday (>= 0.17.3, < 3.0)
138-
google-cloud-errors (1.4.0)
142+
google-cloud-errors (1.5.0)
139143
google-cloud-storage (1.47.0)
140144
addressable (~> 2.8)
141145
digest-crc (~> 0.4)
@@ -151,40 +155,43 @@ GEM
151155
os (>= 0.9, < 2.0)
152156
signet (>= 0.16, < 2.a)
153157
highline (2.0.3)
154-
http-cookie (1.0.7)
158+
http-cookie (1.0.8)
155159
domain_name (~> 0.5)
156-
httpclient (2.8.3)
160+
httpclient (2.9.0)
161+
mutex_m
157162
jmespath (1.6.2)
158-
json (2.7.5)
159-
jwt (2.9.3)
163+
json (2.15.2)
164+
jwt (2.10.2)
160165
base64
161166
language_server-protocol (3.17.0.3)
167+
logger (1.7.0)
162168
mini_magick (4.13.2)
163169
mini_mime (1.1.5)
164-
multi_json (1.15.0)
170+
multi_json (1.17.0)
165171
multipart-post (2.4.1)
172+
mutex_m (0.3.0)
166173
nanaimo (0.4.0)
167-
naturally (2.2.1)
174+
naturally (2.3.0)
168175
nkf (0.2.0)
169-
optparse (0.5.0)
176+
optparse (0.8.0)
170177
os (1.1.4)
171178
parallel (1.26.3)
172179
parser (3.3.5.1)
173180
ast (~> 2.4.1)
174181
racc
175-
plist (3.7.1)
176-
public_suffix (6.0.1)
182+
plist (3.7.2)
183+
public_suffix (6.0.2)
177184
racc (1.8.1)
178185
rainbow (3.1.1)
179-
rake (13.2.1)
186+
rake (13.3.1)
180187
regexp_parser (2.9.2)
181188
representable (3.2.0)
182189
declarative (< 0.1.0)
183190
trailblazer-option (>= 0.1.1, < 0.2.0)
184191
uber (< 0.2.0)
185192
retriable (3.1.2)
186-
rexml (3.3.9)
187-
rouge (2.0.7)
193+
rexml (3.4.4)
194+
rouge (3.28.0)
188195
rubocop (1.68.0)
189196
json (~> 2.3)
190197
language_server-protocol (>= 3.17.0)
@@ -199,12 +206,12 @@ GEM
199206
parser (>= 3.3.1.0)
200207
ruby-progressbar (1.13.0)
201208
ruby2_keywords (0.0.5)
202-
rubyzip (2.3.2)
209+
rubyzip (2.4.1)
203210
security (0.1.5)
204-
signet (0.19.0)
211+
signet (0.21.0)
205212
addressable (~> 2.8)
206213
faraday (>= 0.17.5, < 3.a)
207-
jwt (>= 1.5, < 3.0)
214+
jwt (>= 1.5, < 4.0)
208215
multi_json (~> 1.10)
209216
simctl (1.6.10)
210217
CFPropertyList
@@ -228,8 +235,8 @@ GEM
228235
colored2 (~> 3.1)
229236
nanaimo (~> 0.4.0)
230237
rexml (>= 3.3.6, < 4.0)
231-
xcpretty (0.3.0)
232-
rouge (~> 2.0.7)
238+
xcpretty (0.4.1)
239+
rouge (~> 3.28.0)
233240
xcpretty-travis-formatter (1.0.1)
234241
xcpretty (~> 0.2, >= 0.0.7)
235242

Makefile

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,24 @@ RELEASE_VERSION = $(shell .build/release/hostmgr --version)
44
SWIFTLINT_VERSION=$(shell awk '/^swiftlint_version:/ {print $$2}' .swiftlint.yml)
55
RUBY_VERSION = $(shell cat .ruby-version)
66

7+
CERTIFICATE_NAME_DEBUG = Apple Development: Created via API (886NX39KP6)
8+
CERTIFICATE_NAME_RELEASE = Apple Distribution: Automattic, Inc. (PZYM8XX95Q)
9+
710
clean:
811
rm -rf .build
912

13+
fetch-codesignging:
14+
bundle install
15+
bundle exec fastlane set_up_signing
16+
17+
fetch-codesignging-debug:
18+
bundle install
19+
bundle exec fastlane set_up_signing_development
20+
21+
fetch-codesignging-release:
22+
bundle install
23+
bundle exec fastlane set_up_signing_release
24+
1025
build:
1126
@echo "--- Building Release"
1227
swift build -c release --arch arm64
@@ -16,8 +31,8 @@ build:
1631
cp .build/arm64-apple-macosx/release/hostmgr .build/artifacts/release/hostmgr
1732
cp .build/arm64-apple-macosx/release/hostmgr-helper .build/artifacts/release/hostmgr-helper
1833

19-
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "Apple Development: Created via API (886NX39KP6)" .build/artifacts/release/hostmgr --force --verbose
20-
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "Apple Development: Created via API (886NX39KP6)" .build/artifacts/release/hostmgr-helper --force --verbose
34+
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "${CERTIFICATE_NAME_RELEASE}" .build/artifacts/release/hostmgr --force --verbose
35+
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "${CERTIFICATE_NAME_RELEASE}" .build/artifacts/release/hostmgr-helper --force --verbose
2136

2237
verify-signing: build
2338
@echo "--- Checking Code Signing"
@@ -39,22 +54,15 @@ release: build
3954
git tag $(RELEASE_VERSION)
4055
git push origin $(RELEASE_VERSION)
4156

42-
create-vm-debug:
43-
@echo "--- Building and Signing hostmgr for Local Development"
44-
swift build
45-
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "Apple Development: Created via API" .build/arm64-apple-macosx/debug/hostmgr -v
46-
47-
./.build/arm64-apple-macosx/debug/hostmgr vm create xcode-143 --disk-size 92
48-
4957
build-debug:
5058
@echo "--- Building and Signing for Local Development"
5159
swift build
52-
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "Apple Development: Created via API" .build/arm64-apple-macosx/debug/hostmgr -v
60+
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "${CERTIFICATE_NAME_DEBUG}" .build/arm64-apple-macosx/debug/hostmgr --force --verbose
5361

5462
build-helper-debug:
5563
@echo "--- Building and Signing helper for Local Development"
5664
swift build
57-
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "Apple Development: Created via API" .build/arm64-apple-macosx/debug/hostmgr-helper -v
65+
codesign --entitlements Sources/hostmgr/hostmgr.entitlements -s "${CERTIFICATE_NAME_DEBUG}" .build/arm64-apple-macosx/debug/hostmgr-helper --force --verbose
5866

5967
run-helper-debug: build-debug build-helper-debug
6068
./.build/arm64-apple-macosx/debug/hostmgr-helper --debug true

fastlane/Fastfile

Lines changed: 39 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -53,24 +53,20 @@ lane :upload_release do
5353
)
5454
end
5555

56-
desc 'Download the development signing certificates to this machine'
56+
desc 'Download all certificates and provisioning profiles for code signing'
5757
lane :set_up_signing do |readonly: true|
58-
require_env_vars!(*ASC_API_KEY_ENV_VARS, *CODE_SIGNING_STORAGE_ENV_VARS)
59-
60-
sync_code_signing(
61-
platform: 'macos',
62-
app_identifier: APPLE_BUNDLE_IDENTIFIER,
63-
team_id: APPLE_TEAM_ID,
64-
api_key: app_store_connect_api_key,
65-
type: 'development',
66-
certificate_id: 'Apple Development: Created via API (886NX39KP6)',
58+
set_up_signing_development(readonly: readonly)
59+
set_up_signing_release(readonly: readonly)
60+
end
6761

68-
storage_mode: 's3',
69-
s3_region: 'us-east-2',
70-
s3_bucket: 'a8c-fastlane-match',
62+
desc 'Download the development signing certificates to this machine'
63+
lane :set_up_signing_development do |readonly: true|
64+
set_up_certificate_in_keychain(type: 'development', readonly: readonly)
65+
end
7166

72-
readonly: readonly
73-
)
67+
desc 'Download the release signing certificates to this machine'
68+
lane :set_up_signing_release do |readonly: true|
69+
set_up_certificate_in_keychain(type: 'appstore', readonly: readonly)
7470
end
7571

7672
def create_release_zip
@@ -98,3 +94,31 @@ def get_required_env!(key)
9894

9995
UI.user_error!("Environment variable `#{key}` is not set.")
10096
end
97+
98+
def set_up_certificate_in_keychain(type:, readonly:)
99+
require_env_vars!(*CODE_SIGNING_STORAGE_ENV_VARS)
100+
if readonly
101+
api_key = nil
102+
else
103+
require_env_vars!(*ASC_API_KEY_ENV_VARS)
104+
api_key = app_store_connect_api_key
105+
end
106+
107+
# This will fetch the certificate and provisioning profile for the given type from remote storage.
108+
# It will then set them up in the local keychain, where 'codesign' looks for identities.
109+
#
110+
# Notice we do not need the provisioning profile because we sign with 'codesign' elsewhere.
111+
# However, there is no other way to set up the certificate in the keychain.
112+
# Fastlane offers a tool called cert, but it only downloads certificates.
113+
sync_code_signing(
114+
platform: 'macos',
115+
app_identifier: APPLE_BUNDLE_IDENTIFIER,
116+
team_id: APPLE_TEAM_ID,
117+
api_key: api_key,
118+
type: type,
119+
storage_mode: 's3',
120+
s3_region: 'us-east-2',
121+
s3_bucket: 'a8c-fastlane-match',
122+
readonly: readonly
123+
)
124+
end

0 commit comments

Comments
 (0)