Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

added code signing and notariziation #3755

Open
wants to merge 2 commits into
base: debug_macos
Choose a base branch
from
Open

added code signing and notariziation #3755

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fca9a7a
fix rc script
supermerill Aug 11, 2022
e262633
added code signing and notariziation
timschneider Mar 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 24 additions & 15 deletions .github/workflows/ccpp_mac_rc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,14 @@ jobs:
build:

runs-on: macos-12

env:
MACOS_CERTIFICATE: ${{ secrets.MACOS_P12 }}
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_PASSWD }}
MACOS_APP_PWD: ${{ secrets.MACOS_NOTARIZATION_PASS }}
MACOS_APP_MAIL: ${{ secrets.MACOS_NOTARIZATION_USER }}
MACOS_APP_DEVELOPER_ID: ${{ vars.MACOS_APP_DEVELOPER_ID }}
MACOS_APP_TEAM_ID: ${{ vars.MACOS_APP_TEAM_ID }}
MACOS_KEYCHAIN_TEMP_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_TEMP_PASSWORD }}
steps:
- uses: actions/checkout@v2
with:
Expand All @@ -22,24 +29,22 @@ jobs:
- name: relink zstd
run: install_name_tool -change /usr/local/opt/zstd/lib/libzstd.1.dylib @executable_path/libzstd.1.dylib ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/SuperSlicer
- name: Codesign executable conf
env:
MACOS_CERTIFICATE: ${{ secrets.MACOS_P12 }}
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_PASSWD }}
MACOS_APP: ${{ secrets.MAC_APP_PWD }}
run: |
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
security create-keychain -p temp_password build.keychain
security create-keychain -p "$MACOS_KEYCHAIN_TEMP_PASSWORD" build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p temp_password build.keychain
security unlock-keychain -p "$MACOS_KEYCHAIN_TEMP_PASSWORD" build.keychain
security set-keychain-settings -lut 21600 build.keychain
security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
- name: verify certificate presence
run: security find-identity -v
- name: register codesign
run: |
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k temp_password build.keychain
security set-key-partition-list -S apple-tool:,apple:,codesign:,notarytool: -s -k "$MACOS_KEYCHAIN_TEMP_PASSWORD" build.keychain
- name: run codesign on exe
run: |
/usr/bin/codesign --options=runtime --force -s "Developer ID Application: Remi Durand (LDTLFRHP3G)" ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/SuperSlicer -v
/usr/bin/codesign --options=runtime --force -s "$MACOS_APP_DEVELOPER_ID" ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/libzstd.1.dylib
/usr/bin/codesign --options=runtime --force -s "$MACOS_APP_DEVELOPER_ID" ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/SuperSlicer -v
codesign -vvv --deep --strict ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/SuperSlicer
codesign -dvv ./build/pack/SuperSlicer/SuperSlicer.app/Contents/MacOS/SuperSlicer
- name: create the dmg
Expand All @@ -48,25 +53,29 @@ jobs:
hdiutil convert temp.dmg -format UDZO -o SuperSlicer.dmg
- name: run codesign on the dmg
run: |
/usr/bin/codesign -s "Developer ID Application: Remi Durand (LDTLFRHP3G)" SuperSlicer.dmg -v
/usr/bin/codesign -s "$MACOS_APP_DEVELOPER_ID" SuperSlicer.dmg -v
codesign -vvv --deep --strict SuperSlicer.dmg
codesign -dvv SuperSlicer.dmg
- name: notarize the dmg
run: |
xcrun altool --notarize-app -f SuperSlicer.dmg --primary-bundle-id org.slic3r.superslicer -u [email protected] -p $MACOS_APP
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_APP_MAIL" --team-id "$MACOS_APP_TEAM_ID" --password "$MACOS_APP_PWD"
xcrun notarytool submit "SuperSlicer.dmg" --keychain-profile "notarytool-profile" --wait
spctl -a -t open --context context:primary-signature -v SuperSlicer.dmg
- name: run codesign on app
run: |
/usr/bin/codesign --force -s "Developer ID Application: Remi Durand (LDTLFRHP3G)" ./build/pack/SuperSlicer/SuperSlicer.app -v
/usr/bin/codesign --force -s "$MACOS_APP_DEVELOPER_ID" ./build/pack/SuperSlicer/SuperSlicer.app -v
codesign -vvv --deep --strict ./build/pack/SuperSlicer/SuperSlicer.app
codesign -dvv ./build/pack/SuperSlicer/SuperSlicer.app
- name: Upload artifact
- name: run stapler
run: |
xcrun stapler staple SuperSlicer.dmg
- name: Upload App artifact
uses: actions/[email protected]
with:
name: rc_macos.app
path: build/pack/SuperSlicer/SuperSlicer.app
- name: Upload artifact
- name: Upload DMG artifact
uses: actions/[email protected]
with:
name: rc_macos.dmg
path: build/SuperSlicer.dmg
path: SuperSlicer.dmg