mirror of
https://github.com/ddworken/hishtory.git
synced 2025-06-21 04:17:45 +02:00
Delete separate signer and start the work of merging it into the SLSA releaser action
This commit is contained in:
parent
a909be7d61
commit
69317e0a85
61
.github/workflows/build-and-sign-macos.yml
vendored
61
.github/workflows/build-and-sign-macos.yml
vendored
@ -1,61 +0,0 @@
|
|||||||
name: Sign macOS binaries
|
|
||||||
on:
|
|
||||||
workflow_run:
|
|
||||||
workflows: ["SLSA go releaser"]
|
|
||||||
types:
|
|
||||||
- completed
|
|
||||||
workflow_dispatch:
|
|
||||||
jobs:
|
|
||||||
macos:
|
|
||||||
runs-on: macos-11.0
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v2
|
|
||||||
- name: Download and sign the latest executables
|
|
||||||
env:
|
|
||||||
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
|
|
||||||
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
|
|
||||||
run: |
|
|
||||||
brew install md5sha1sum
|
|
||||||
export TAG_NAME=`curl -L https://api.github.com/repos/ddworken/hishtory/releases/latest --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'| jq -r .tag_name`
|
|
||||||
if [ $TAG_NAME == "null" ]; then
|
|
||||||
echo "TAG_NAME is null, this shouldn't happen!"
|
|
||||||
curl -L https://api.github.com/repos/ddworken/hishtory/releases/latest
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "Signing binaries for $TAG_NAME"
|
|
||||||
curl -L -o hishtory-darwin-arm64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-arm64 --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
|
|
||||||
curl -L -o hishtory-darwin-amd64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-amd64/hishtory-darwin-amd64 --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
|
|
||||||
echo "Signing the binaries:"
|
|
||||||
file hishtory-*
|
|
||||||
sha1sum hishtory-*
|
|
||||||
if [[ `file hishtory-darwin-arm64` == *"ASCII text"* ]]; then
|
|
||||||
echo "hishtory-darwin-arm64 is ASCII text???"
|
|
||||||
cat hishtory-darwin-arm64
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
if [[ `file hishtory-darwin-amd64` == *"ASCII text"* ]]; then
|
|
||||||
echo "hishtory-darwin-amd64 is ASCII text???"
|
|
||||||
cat hishtory-darwin-amd64
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo $MACOS_CERTIFICATE | base64 -d > certificate.p12
|
|
||||||
security create-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
|
|
||||||
security default-keychain -s build.keychain
|
|
||||||
security unlock-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
|
|
||||||
security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
|
|
||||||
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_CERTIFICATE_PWD build.keychain
|
|
||||||
/usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-arm64 -v
|
|
||||||
/usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-amd64 -v
|
|
||||||
echo "Signed the binaries:"
|
|
||||||
sha1sum hishtory-*
|
|
||||||
# Move them to the released filenames
|
|
||||||
cp hishtory-darwin-arm64 hishtory-darwin-arm64-signed
|
|
||||||
cp hishtory-darwin-amd64 hishtory-darwin-amd64-signed
|
|
||||||
- name: Release
|
|
||||||
uses: softprops/action-gh-release@v1
|
|
||||||
if: startsWith(github.ref, 'refs/tags/')
|
|
||||||
with:
|
|
||||||
files: |
|
|
||||||
hishtory-darwin-arm64-signed.json
|
|
||||||
hishtory-darwin-amd64-signed.json
|
|
94
.github/workflows/slsa-releaser.yml
vendored
94
.github/workflows/slsa-releaser.yml
vendored
@ -28,27 +28,87 @@ jobs:
|
|||||||
id-token: write
|
id-token: write
|
||||||
contents: read
|
contents: read
|
||||||
needs: args
|
needs: args
|
||||||
uses: slsa-framework/slsa-github-generator-go/.github/workflows/builder.yml@2b2bf8753ae8ab14332b72217daf3c2c670272b3
|
uses: /.github/workflows/builder.yml@2b2bf8753ae8ab14332b72217daf3c2c670272b3
|
||||||
with:
|
with:
|
||||||
go-version: 1.17
|
go-version: 1.17
|
||||||
env: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
|
env: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
|
||||||
# Upload to GitHub release.
|
|
||||||
upload:
|
# Sign the binaries (if this is a macos build)
|
||||||
permissions:
|
macos_signer:
|
||||||
contents: write
|
runs-on: macos-11.0
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs: build
|
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
- uses: actions/checkout@v2
|
||||||
with:
|
- name: Download and sign the latest executables
|
||||||
name: ${{ needs.build.outputs.go-binary-name }}
|
env:
|
||||||
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
|
||||||
with:
|
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
|
||||||
name: ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
run: |
|
||||||
|
echo $GITHUB_REF
|
||||||
|
|
||||||
|
# brew install md5sha1sum
|
||||||
|
# export TAG_NAME=`curl -L https://api.github.com/repos/ddworken/hishtory/releases/latest --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'| jq -r .tag_name`
|
||||||
|
# if [ $TAG_NAME == "null" ]; then
|
||||||
|
# echo "TAG_NAME is null, this shouldn't happen!"
|
||||||
|
# curl -L https://api.github.com/repos/ddworken/hishtory/releases/latest
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
# echo "Signing binaries for $TAG_NAME"
|
||||||
|
# curl -L -o hishtory-darwin-arm64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-arm64 --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
# curl -L -o hishtory-darwin-amd64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-amd64/hishtory-darwin-amd64 --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
# echo "Signing the binaries:"
|
||||||
|
# file hishtory-*
|
||||||
|
# sha1sum hishtory-*
|
||||||
|
# if [[ `file hishtory-darwin-arm64` == *"ASCII text"* ]]; then
|
||||||
|
# echo "hishtory-darwin-arm64 is ASCII text???"
|
||||||
|
# cat hishtory-darwin-arm64
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
# if [[ `file hishtory-darwin-amd64` == *"ASCII text"* ]]; then
|
||||||
|
# echo "hishtory-darwin-amd64 is ASCII text???"
|
||||||
|
# cat hishtory-darwin-amd64
|
||||||
|
# exit 1
|
||||||
|
# fi
|
||||||
|
|
||||||
|
# echo $MACOS_CERTIFICATE | base64 -d > certificate.p12
|
||||||
|
# security create-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
|
||||||
|
# security default-keychain -s build.keychain
|
||||||
|
# security unlock-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
|
||||||
|
# security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
|
||||||
|
# security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_CERTIFICATE_PWD build.keychain
|
||||||
|
# /usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-arm64 -v
|
||||||
|
# /usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-amd64 -v
|
||||||
|
# echo "Signed the binaries:"
|
||||||
|
# sha1sum hishtory-*
|
||||||
|
# # Move them to the released filenames
|
||||||
|
# cp hishtory-darwin-arm64 hishtory-darwin-arm64-signed
|
||||||
|
# cp hishtory-darwin-amd64 hishtory-darwin-amd64-signed
|
||||||
- name: Release
|
- name: Release
|
||||||
uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
|
uses: softprops/action-gh-release@v1
|
||||||
if: ${{ startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-') }}
|
if: startsWith(github.ref, 'refs/tags/')
|
||||||
with:
|
with:
|
||||||
files: |
|
files: |
|
||||||
${{ needs.build.outputs.go-binary-name }}
|
hishtory-darwin-arm64-signed.json
|
||||||
${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
hishtory-darwin-amd64-signed.json
|
||||||
|
|
||||||
|
# Upload to GitHub release.
|
||||||
|
# upload:
|
||||||
|
# permissions:
|
||||||
|
# contents: write
|
||||||
|
# runs-on: ubuntu-latest
|
||||||
|
# needs:
|
||||||
|
# - macos_signer
|
||||||
|
# - build
|
||||||
|
# steps:
|
||||||
|
# - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
||||||
|
# with:
|
||||||
|
# name: ${{ needs.macos_signer.outputs.go-binary-name }}
|
||||||
|
# - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
||||||
|
# with:
|
||||||
|
# name: ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
||||||
|
# - name: Release
|
||||||
|
# uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
|
||||||
|
# if: ${{ startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-') }}
|
||||||
|
# with:
|
||||||
|
# files: |
|
||||||
|
# ${{ needs.macos_signer.outputs.go-binary-name }}
|
||||||
|
# ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
||||||
|
Loading…
x
Reference in New Issue
Block a user