notarize.sh
bash
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠ breaking
25 days ago
| 1 | #!/bin/bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | kind="" |
| 5 | artifact="" |
| 6 | profile="" |
| 7 | evidence="" |
| 8 | while [[ $# -gt 0 ]]; do |
| 9 | case "$1" in |
| 10 | --kind) kind="$2"; shift 2 ;; |
| 11 | --artifact) artifact="$2"; shift 2 ;; |
| 12 | --keychain-profile) profile="$2"; shift 2 ;; |
| 13 | --evidence) evidence="$2"; shift 2 ;; |
| 14 | *) echo "unknown argument: $1" >&2; exit 2 ;; |
| 15 | esac |
| 16 | done |
| 17 | |
| 18 | [[ "$kind" == "app" || "$kind" == "pkg" ]] || { echo "--kind must be app or pkg" >&2; exit 2; } |
| 19 | [[ -e "$artifact" && -n "$evidence" ]] || { echo "--artifact and --evidence are required" >&2; exit 2; } |
| 20 | [[ -n "$profile" && "$profile" != *'<'* ]] || { echo "real notary keychain profile required" >&2; exit 1; } |
| 21 | mkdir -p "$(dirname "$evidence")" |
| 22 | |
| 23 | submission="$artifact" |
| 24 | temporary="" |
| 25 | if [[ "$kind" == "app" ]]; then |
| 26 | temporary="${artifact%/}.notary.zip" |
| 27 | rm -f "$temporary" |
| 28 | ditto -c -k --sequesterRsrc --keepParent "$artifact" "$temporary" |
| 29 | submission="$temporary" |
| 30 | fi |
| 31 | trap 'if [[ -n "$temporary" ]]; then rm -f "$temporary"; fi' EXIT |
| 32 | |
| 33 | xcrun notarytool submit "$submission" \ |
| 34 | --keychain-profile "$profile" \ |
| 35 | --wait \ |
| 36 | --output-format json > "$evidence" |
| 37 | NOTARY_EVIDENCE="$evidence" node - <<'NODE' |
| 38 | const fs = require('fs'); |
| 39 | const result = JSON.parse(fs.readFileSync(process.env.NOTARY_EVIDENCE, 'utf8')); |
| 40 | if (result.status !== 'Accepted' || typeof result.id !== 'string') { |
| 41 | throw new Error(`notarization was not accepted: ${result.status ?? 'unknown'}`); |
| 42 | } |
| 43 | NODE |
| 44 | submission_id="$(NOTARY_EVIDENCE="$evidence" node -p \ |
| 45 | "JSON.parse(require('fs').readFileSync(process.env.NOTARY_EVIDENCE, 'utf8')).id")" |
| 46 | xcrun notarytool log "$submission_id" \ |
| 47 | --keychain-profile "$profile" \ |
| 48 | "$evidence.log.json" |
| 49 | xcrun stapler staple "$artifact" |
| 50 | xcrun stapler validate "$artifact" |
| 51 | echo "$evidence" |
File History
1 commit
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700
feat(companion): add production macOS distribution path
Human
minor
⚠
25 days ago