name: Sign macOS binaries on: workflow_run: workflows: ["SLSA go releaser"] types: - completed workflow_dispatch: jobs: macos: runs-on: macos-11.0 steps: - uses: actions/checkout@v2 - name: Download and sign the latest executables env: MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} run: | brew install md5sha1sum export TAG_NAME=`curl https://api.github.com/repos/ddworken/hishtory/releases/latest | jq -r .tag_name` curl -o hishtory-darwin-arm64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-arm64 curl -o hishtory-darwin-amd64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-amd64 echo "Signing the binaries:" sha1sum hishtory-* echo "xattr:" xattr hishtory-darwin-arm64 echo $MACOS_CERTIFICATE | base64 -d > certificate.p12 security create-keychain -p $MACOS_CERTIFICATE_PWD build.keychain security default-keychain -s build.keychain security unlock-keychain -p $MACOS_CERTIFICATE_PWD build.keychain security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_CERTIFICATE_PWD build.keychain /usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-arm64 -v /usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-amd64 -v echo "Signed the binaries:" sha1sum hishtory-* echo "xattr:" xattr hishtory-darwin-arm64 echo "Exporting xattr" xattr -lp hishtory-darwin-arm64 >> hishtory-darwin-arm64.xattr xattr -lp hishtory-darwin-amd64 >> hishtory-darwin-amd64.xattr - name: Release uses: softprops/action-gh-release@v1 with: files: | hishtory-darwin-arm64.xattr hishtory-darwin-amd64.xattr