aaronrene / knowtation public
sign.sh bash
109 lines 4.9 KB
Raw
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700 feat(companion): add production macOS distribution path Human minor ⚠ breaking 24 days ago
1 #!/bin/bash
2 set -euo pipefail
3
4 app=""
5 identity=""
6 output=""
7 while [[ $# -gt 0 ]]; do
8 case "$1" in
9 --app) app="$2"; shift 2 ;;
10 --application-identity) identity="$2"; shift 2 ;;
11 --output) output="$2"; shift 2 ;;
12 *) echo "unknown argument: $1" >&2; exit 2 ;;
13 esac
14 done
15
16 [[ -d "$app" && -n "$output" ]] || { echo "--app and --output are required" >&2; exit 2; }
17 [[ -n "$identity" && "$identity" != *'<'* ]] || { echo "real Developer ID Application identity required" >&2; exit 1; }
18 [[ -n "${KNOWTATION_UPDATE_KEY_ID:-}" && "$KNOWTATION_UPDATE_KEY_ID" != *'<'* ]] || {
19 echo "KNOWTATION_UPDATE_KEY_ID is required" >&2; exit 1;
20 }
21 [[ -n "${KNOWTATION_UPDATE_PUBLIC_KEY_BASE64:-}" && "$KNOWTATION_UPDATE_PUBLIC_KEY_BASE64" != *'<'* ]] || {
22 echo "KNOWTATION_UPDATE_PUBLIC_KEY_BASE64 is required" >&2; exit 1;
23 }
24 [[ "${KNOWTATION_SOURCE_MUSE_REVISION:-}" =~ ^sha256:[0-9a-f]{64}$ ]] || {
25 echo "exact KNOWTATION_SOURCE_MUSE_REVISION is required" >&2; exit 1;
26 }
27 [[ "${KNOWTATION_SOURCE_GIT_REVISION:-}" =~ ^[0-9a-f]{40}$ ]] || {
28 echo "exact KNOWTATION_SOURCE_GIT_REVISION is required" >&2; exit 1;
29 }
30 [[ "${KNOWTATION_APPLE_TEAM_ID:-}" =~ ^[A-Z0-9]{10}$ ]] || {
31 echo "KNOWTATION_APPLE_TEAM_ID is required" >&2; exit 1;
32 }
33 [[ -f "${KNOWTATION_CUSTODY_PROVISIONING_PROFILE:-}" ]] || {
34 echo "KNOWTATION_CUSTODY_PROVISIONING_PROFILE is required" >&2; exit 1;
35 }
36
37 repo_root="$(cd "$(dirname "$0")/../../.." && pwd)"
38 rm -rf "$output"
39 ditto "$app" "$output"
40 cp "$KNOWTATION_CUSTODY_PROVISIONING_PROFILE" \
41 "$output/Contents/Library/LaunchServices/KnowtationCustodyAgent.app/Contents/embedded.provisionprofile"
42 custody_entitlements="$(mktemp "${TMPDIR:-/tmp}/knowtation-custody-entitlements.XXXXXX")"
43 profile_plist="$(mktemp "${TMPDIR:-/tmp}/knowtation-custody-profile.XXXXXX")"
44 trap 'rm -f "$custody_entitlements" "$profile_plist"' EXIT
45 sed "s/__APPLE_TEAM_ID__/$KNOWTATION_APPLE_TEAM_ID/g" \
46 "$repo_root/release/macos/entitlements/custody.plist" > "$custody_entitlements"
47 plutil -lint "$custody_entitlements" >/dev/null
48 security cms -D -i "$KNOWTATION_CUSTODY_PROVISIONING_PROFILE" > "$profile_plist"
49 test "$(/usr/libexec/PlistBuddy -c 'Print :TeamIdentifier:0' "$profile_plist")" = \
50 "$KNOWTATION_APPLE_TEAM_ID"
51 test "$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.application-identifier' "$profile_plist")" = \
52 "$KNOWTATION_APPLE_TEAM_ID.store.knowtation.companion.custody"
53 test "$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:keychain-access-groups:0' "$profile_plist")" = \
54 "$KNOWTATION_APPLE_TEAM_ID.store.knowtation.companion.custody"
55 if /usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.security.get-task-allow' \
56 "$profile_plist" 2>/dev/null | grep -qx true; then
57 echo "custody provisioning profile permits debugging" >&2
58 exit 1
59 fi
60 UPDATE_TRUST="$output/Contents/Resources/update-trust.json" \
61 node - <<'NODE'
62 const fs = require('fs');
63 const raw = Buffer.from(process.env.KNOWTATION_UPDATE_PUBLIC_KEY_BASE64, 'base64');
64 if (raw.length !== 32) throw new Error('Ed25519 update public key must be 32 raw bytes');
65 const file = process.env.UPDATE_TRUST;
66 const trust = JSON.parse(fs.readFileSync(file, 'utf8'));
67 trust.activeKey = {
68 keyID: process.env.KNOWTATION_UPDATE_KEY_ID,
69 publicKey: process.env.KNOWTATION_UPDATE_PUBLIC_KEY_BASE64,
70 };
71 fs.writeFileSync(file, `${JSON.stringify(trust, null, 2)}\n`);
72 NODE
73
74 while IFS= read -r -d '' code; do
75 codesign --force --timestamp --options runtime --sign "$identity" "$code"
76 done < <(find "$output/Contents/Resources/runtime" -type f \( -name '*.node' -o -name '*.dylib' \) -print0)
77
78 codesign --force --timestamp --options runtime \
79 --identifier store.knowtation.runtime.node \
80 --entitlements "$repo_root/release/macos/entitlements/runtime.plist" \
81 --sign "$identity" "$output/Contents/Resources/runtime/node/bin/node"
82
83 codesign --force --timestamp --options runtime \
84 --identifier store.knowtation.cli \
85 --entitlements "$repo_root/release/macos/entitlements/launcher.plist" \
86 --sign "$identity" "$output/Contents/Helpers/knowtation"
87
88 codesign --force --timestamp --options runtime \
89 --identifier store.knowtation.mcp \
90 --entitlements "$repo_root/release/macos/entitlements/launcher.plist" \
91 --sign "$identity" "$output/Contents/Helpers/knowtation-mcp"
92
93 # Nested signatures change runtime bytes. Regenerate the sealed runtime manifest
94 # after signing all runtime code and before applying the outer app signature.
95 node "$repo_root/scripts/release/macos/generate-manifest.mjs" \
96 --stage unsigned \
97 --app "$output" \
98 --output "$output/Contents/Resources/runtime-manifest.json"
99
100 codesign --force --timestamp --options runtime \
101 --entitlements "$custody_entitlements" \
102 --sign "$identity" "$output/Contents/Library/LaunchServices/KnowtationCustodyAgent.app"
103
104 codesign --force --timestamp --options runtime \
105 --entitlements "$repo_root/release/macos/entitlements/app.plist" \
106 --sign "$identity" "$output"
107
108 codesign --verify --deep --strict --verbose=4 "$output"
109 echo "$output"
File History 1 commit
sha256:bd1eb24434d281fe65142038c1bf217493421f5a86880c22dff7e6037d2d4700 feat(companion): add production macOS distribution path Human minor ⚠ 24 days ago