aaronrene / knowtation public
sign.sh bash
125 lines 5.5 KB
Raw
sha256:56bbbe3047d952e0671d57d15aaf40a8047e876b9d4a1898ee2b90a4d3981de7 fix: accept Apple Developer ID Keychain authorization Human minor ⚠ breaking 25 days ago
1 #!/bin/bash
2 set -euo pipefail
3
4 app=""
5 identity=""
6 output=""
7 while [[ $# -gt 0 ]]; do
8 case "$1" in
9 --app) app="$2"; shift 2 ;;
10 --application-identity) identity="$2"; shift 2 ;;
11 --output) output="$2"; shift 2 ;;
12 *) echo "unknown argument: $1" >&2; exit 2 ;;
13 esac
14 done
15
16 [[ -d "$app" && -n "$output" ]] || { echo "--app and --output are required" >&2; exit 2; }
17 [[ -n "$identity" && "$identity" != *'<'* ]] || { echo "real Developer ID Application identity required" >&2; exit 1; }
18 [[ -n "${KNOWTATION_UPDATE_KEY_ID:-}" && "$KNOWTATION_UPDATE_KEY_ID" != *'<'* ]] || {
19 echo "KNOWTATION_UPDATE_KEY_ID is required" >&2; exit 1;
20 }
21 [[ -n "${KNOWTATION_UPDATE_PUBLIC_KEY_BASE64:-}" && "$KNOWTATION_UPDATE_PUBLIC_KEY_BASE64" != *'<'* ]] || {
22 echo "KNOWTATION_UPDATE_PUBLIC_KEY_BASE64 is required" >&2; exit 1;
23 }
24 [[ "${KNOWTATION_SOURCE_MUSE_REVISION:-}" =~ ^sha256:[0-9a-f]{64}$ ]] || {
25 echo "exact KNOWTATION_SOURCE_MUSE_REVISION is required" >&2; exit 1;
26 }
27 [[ "${KNOWTATION_SOURCE_GIT_REVISION:-}" =~ ^[0-9a-f]{40}$ ]] || {
28 echo "exact KNOWTATION_SOURCE_GIT_REVISION is required" >&2; exit 1;
29 }
30 [[ "${KNOWTATION_APPLE_TEAM_ID:-}" =~ ^[A-Z0-9]{10}$ ]] || {
31 echo "KNOWTATION_APPLE_TEAM_ID is required" >&2; exit 1;
32 }
33 [[ -f "${KNOWTATION_CUSTODY_PROVISIONING_PROFILE:-}" ]] || {
34 echo "KNOWTATION_CUSTODY_PROVISIONING_PROFILE is required" >&2; exit 1;
35 }
36
37 repo_root="$(cd "$(dirname "$0")/../../.." && pwd)"
38 rm -rf "$output"
39 ditto "$app" "$output"
40 cp "$KNOWTATION_CUSTODY_PROVISIONING_PROFILE" \
41 "$output/Contents/Library/LaunchServices/KnowtationCustodyAgent.app/Contents/embedded.provisionprofile"
42 custody_entitlements="$(mktemp "${TMPDIR:-/tmp}/knowtation-custody-entitlements.XXXXXX")"
43 profile_plist="$(mktemp "${TMPDIR:-/tmp}/knowtation-custody-profile.XXXXXX")"
44 trap 'rm -f "$custody_entitlements" "$profile_plist"' EXIT
45 sed "s/__APPLE_TEAM_ID__/$KNOWTATION_APPLE_TEAM_ID/g" \
46 "$repo_root/release/macos/entitlements/custody.plist" > "$custody_entitlements"
47 plutil -lint "$custody_entitlements" >/dev/null
48 security cms -D -i "$KNOWTATION_CUSTODY_PROVISIONING_PROFILE" > "$profile_plist"
49 test "$(/usr/libexec/PlistBuddy -c 'Print :TeamIdentifier:0' "$profile_plist")" = \
50 "$KNOWTATION_APPLE_TEAM_ID"
51 test "$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.application-identifier' "$profile_plist")" = \
52 "$KNOWTATION_APPLE_TEAM_ID.store.knowtation.companion.custody"
53 required_keychain_group="$KNOWTATION_APPLE_TEAM_ID.store.knowtation.companion.custody"
54 profile_authorizes_keychain_group=false
55 profile_group_index=0
56 # Apple Developer ID profiles normally authorize Keychain groups with TEAM_ID.*.
57 # The custody signature still claims only the exact group above.
58 while profile_group="$(/usr/libexec/PlistBuddy \
59 -c "Print :Entitlements:keychain-access-groups:$profile_group_index" \
60 "$profile_plist" 2>/dev/null)"; do
61 if [[ "$profile_group" = "$required_keychain_group" || \
62 "$profile_group" = "$KNOWTATION_APPLE_TEAM_ID.*" ]]; then
63 profile_authorizes_keychain_group=true
64 fi
65 profile_group_index=$((profile_group_index + 1))
66 done
67 if [[ "$profile_authorizes_keychain_group" != true ]]; then
68 echo "custody provisioning profile does not authorize the required Keychain group" >&2
69 exit 1
70 fi
71 if /usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.security.get-task-allow' \
72 "$profile_plist" 2>/dev/null | grep -qx true; then
73 echo "custody provisioning profile permits debugging" >&2
74 exit 1
75 fi
76 UPDATE_TRUST="$output/Contents/Resources/update-trust.json" \
77 node - <<'NODE'
78 const fs = require('fs');
79 const raw = Buffer.from(process.env.KNOWTATION_UPDATE_PUBLIC_KEY_BASE64, 'base64');
80 if (raw.length !== 32) throw new Error('Ed25519 update public key must be 32 raw bytes');
81 const file = process.env.UPDATE_TRUST;
82 const trust = JSON.parse(fs.readFileSync(file, 'utf8'));
83 trust.activeKey = {
84 keyID: process.env.KNOWTATION_UPDATE_KEY_ID,
85 publicKey: process.env.KNOWTATION_UPDATE_PUBLIC_KEY_BASE64,
86 };
87 fs.writeFileSync(file, `${JSON.stringify(trust, null, 2)}\n`);
88 NODE
89
90 while IFS= read -r -d '' code; do
91 codesign --force --timestamp --options runtime --sign "$identity" "$code"
92 done < <(find "$output/Contents/Resources/runtime" -type f \( -name '*.node' -o -name '*.dylib' \) -print0)
93
94 codesign --force --timestamp --options runtime \
95 --identifier store.knowtation.runtime.node \
96 --entitlements "$repo_root/release/macos/entitlements/runtime.plist" \
97 --sign "$identity" "$output/Contents/Resources/runtime/node/bin/node"
98
99 codesign --force --timestamp --options runtime \
100 --identifier store.knowtation.cli \
101 --entitlements "$repo_root/release/macos/entitlements/launcher.plist" \
102 --sign "$identity" "$output/Contents/Helpers/knowtation"
103
104 codesign --force --timestamp --options runtime \
105 --identifier store.knowtation.mcp \
106 --entitlements "$repo_root/release/macos/entitlements/launcher.plist" \
107 --sign "$identity" "$output/Contents/Helpers/knowtation-mcp"
108
109 # Nested signatures change runtime bytes. Regenerate the sealed runtime manifest
110 # after signing all runtime code and before applying the outer app signature.
111 node "$repo_root/scripts/release/macos/generate-manifest.mjs" \
112 --stage unsigned \
113 --app "$output" \
114 --output "$output/Contents/Resources/runtime-manifest.json"
115
116 codesign --force --timestamp --options runtime \
117 --entitlements "$custody_entitlements" \
118 --sign "$identity" "$output/Contents/Library/LaunchServices/KnowtationCustodyAgent.app"
119
120 codesign --force --timestamp --options runtime \
121 --entitlements "$repo_root/release/macos/entitlements/app.plist" \
122 --sign "$identity" "$output"
123
124 codesign --verify --deep --strict --verbose=4 "$output"
125 echo "$output"
File History 1 commit
sha256:56bbbe3047d952e0671d57d15aaf40a8047e876b9d4a1898ee2b90a4d3981de7 fix: accept Apple Developer ID Keychain authorization Human minor ⚠ 25 days ago