capture-evidence.sh
bash
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠ breaking
24 days ago
| 1 | #!/bin/bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | dist="" |
| 5 | build="" |
| 6 | output="" |
| 7 | verification_log="" |
| 8 | test_log="" |
| 9 | signed_callers_log="" |
| 10 | while [[ $# -gt 0 ]]; do |
| 11 | case "$1" in |
| 12 | --dist) dist="$2"; shift 2 ;; |
| 13 | --build) build="$2"; shift 2 ;; |
| 14 | --output) output="$2"; shift 2 ;; |
| 15 | --verification-log) verification_log="$2"; shift 2 ;; |
| 16 | --test-log) test_log="$2"; shift 2 ;; |
| 17 | --signed-callers-log) signed_callers_log="$2"; shift 2 ;; |
| 18 | *) echo "unknown argument: $1" >&2; exit 2 ;; |
| 19 | esac |
| 20 | done |
| 21 | |
| 22 | [[ -d "$dist" && -d "$build" && -n "$output" ]] || { echo "--dist, --build, and --output are required" >&2; exit 2; } |
| 23 | for required_log in "$verification_log" "$test_log" "$signed_callers_log"; do |
| 24 | [[ -f "$required_log" ]] || { echo "verification, test, and signed-caller logs are required" >&2; exit 2; } |
| 25 | done |
| 26 | [[ "${KNOWTATION_SOURCE_MUSE_REVISION:-}" =~ ^sha256:[0-9a-f]{64}$ ]] || { |
| 27 | echo "exact KNOWTATION_SOURCE_MUSE_REVISION is required" >&2; exit 1; |
| 28 | } |
| 29 | [[ "${KNOWTATION_SOURCE_GIT_REVISION:-}" =~ ^[0-9a-f]{40}$ ]] || { |
| 30 | echo "exact KNOWTATION_SOURCE_GIT_REVISION is required" >&2; exit 1; |
| 31 | } |
| 32 | mkdir -p "$output" |
| 33 | |
| 34 | cp "$dist/release-manifest.json" "$output/release-manifest.json" |
| 35 | cp "$dist/release-manifest.sig" "$output/release-manifest.sig" |
| 36 | cp "$dist/SHA256SUMS" "$output/SHA256SUMS" |
| 37 | cp "$dist/sbom.spdx.json" "$output/sbom.spdx.json" |
| 38 | cp "$dist/LICENSE" "$output/LICENSE" |
| 39 | cp "$dist/THIRD-PARTY-NOTICES.txt" "$output/THIRD-PARTY-NOTICES.txt" |
| 40 | cp "$build/evidence/app-notary-submission.json" "$output/app-notary-submission.json" |
| 41 | cp "$build/evidence/app-notary-submission.json.log.json" "$output/app-notary-log.json" |
| 42 | cp "$build/evidence/pkg-notary-submission.json" "$output/pkg-notary-submission.json" |
| 43 | cp "$build/evidence/pkg-notary-submission.json.log.json" "$output/pkg-notary-log.json" |
| 44 | cp "$build/signed/Knowtation.app/Contents/Resources/runtime-manifest.json" \ |
| 45 | "$output/runtime-manifest.json" |
| 46 | cp "$build/signed/Knowtation.app/Contents/Resources/release-lock.json" \ |
| 47 | "$output/release-lock.json" |
| 48 | cp "$dist/Knowtation-0.1.0-100-macos-arm64.zip" "$output/Knowtation-0.1.0-100-macos-arm64.zip" |
| 49 | cp "$dist/Knowtation-0.1.0-100-macos-arm64.pkg" "$output/Knowtation-0.1.0-100-macos-arm64.pkg" |
| 50 | cp "$verification_log" "$output/release-verification.log" |
| 51 | cp "$test_log" "$output/release-tests.log" |
| 52 | cp "$signed_callers_log" "$output/signed-callers.log" |
| 53 | |
| 54 | SOURCE_MUSE="$KNOWTATION_SOURCE_MUSE_REVISION" SOURCE_GIT="$KNOWTATION_SOURCE_GIT_REVISION" \ |
| 55 | node -e 'const fs=require("fs"); fs.writeFileSync(process.argv[1], JSON.stringify({schema:1,sourceRevision:{status:"committed",muse:process.env.SOURCE_MUSE,github:process.env.SOURCE_GIT}}, null, 2)+"\n")' \ |
| 56 | "$output/source-revisions.json" |
| 57 | |
| 58 | xcodebuild -version > "$output/xcode-version.txt" |
| 59 | swift --version > "$output/swift-version.txt" 2>&1 |
| 60 | uname -m > "$output/architecture.txt" |
| 61 | sw_vers > "$output/macos-version.txt" |
| 62 | codesign -d --verbose=4 "$build/signed/Knowtation.app" > "$output/app-signature.txt" 2>&1 |
| 63 | codesign -d --entitlements :- "$build/signed/Knowtation.app" > "$output/app-entitlements.plist" 2>&1 |
| 64 | codesign -d --verbose=4 "$build/signed/Knowtation.app/Contents/Library/LaunchServices/KnowtationCustodyAgent.app" \ |
| 65 | > "$output/custody-signature.txt" 2>&1 |
| 66 | codesign -d --entitlements :- "$build/signed/Knowtation.app/Contents/Library/LaunchServices/KnowtationCustodyAgent.app" \ |
| 67 | > "$output/custody-entitlements.plist" 2>&1 |
| 68 | codesign -d --verbose=4 "$build/signed/Knowtation.app/Contents/Helpers/knowtation" \ |
| 69 | > "$output/cli-signature.txt" 2>&1 |
| 70 | codesign -d --verbose=4 "$build/signed/Knowtation.app/Contents/Helpers/knowtation-mcp" \ |
| 71 | > "$output/mcp-signature.txt" 2>&1 |
| 72 | pkgutil --check-signature "$dist/Knowtation-0.1.0-100-macos-arm64.pkg" > "$output/pkg-signature.txt" 2>&1 |
| 73 | pkgutil --payload-files "$dist/Knowtation-0.1.0-100-macos-arm64.pkg" > "$output/pkg-payload-files.txt" |
| 74 | xcrun stapler validate "$build/signed/Knowtation.app" > "$output/app-stapler.txt" 2>&1 |
| 75 | xcrun stapler validate "$dist/Knowtation-0.1.0-100-macos-arm64.pkg" > "$output/pkg-stapler.txt" 2>&1 |
| 76 | (cd "$output" && shasum -a 256 -c SHA256SUMS) > "$output/checksum-verification.txt" 2>&1 |
| 77 | |
| 78 | echo "$output" |
File History
1 commit
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠
24 days ago