hishtory/.github/workflows/build-and-sign-macos.yml

70 lines
3.3 KiB
YAML

name: Sign macOS binaries
on:
workflow_run:
workflows: ["SLSA go releaser"]
types:
- completed
workflow_dispatch:
push:
tags:
- "*"
jobs:
macos:
runs-on: macos-11.0
steps:
- uses: actions/checkout@v2
- name: Download and sign the latest executables
env:
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
run: |
sleep 1200
brew install md5sha1sum
export TAG_NAME=`curl -L https://api.github.com/repos/ddworken/hishtory/releases/latest | jq -r .tag_name`
curl -L -o hishtory-darwin-arm64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-arm64
curl -L -o hishtory-darwin-amd64 https://github.com/ddworken/hishtory/releases/download/$TAG_NAME-darwin-arm64/hishtory-darwin-amd64
echo "Signing the binaries:"
sha1sum hishtory-*
echo $MACOS_CERTIFICATE | base64 -d > certificate.p12
security create-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_CERTIFICATE_PWD build.keychain
/usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-arm64 -v
/usr/bin/codesign --force -s 6D4E1575A0D40C370E294916A8390797106C8A6E hishtory-darwin-amd64 -v
echo "Signed the binaries:"
sha1sum hishtory-*
echo "xattr:"
xattr hishtory-darwin-arm64
echo "Exporting xattr for hishtory-darwin-arm64"
export CD=`xattr -p com.apple.cs.CodeDirectory hishtory-darwin-arm64`
export CR=`xattr -p com.apple.cs.CodeRequirements hishtory-darwin-arm64`
export CR1=`xattr -p com.apple.cs.CodeRequirements-1 hishtory-darwin-arm64`
export CS=`xattr -p com.apple.cs.CodeSignature hishtory-darwin-arm64`
jq --null-input \
--arg cd "$CD" \
--arg cr "$CR" \
--arg cr1 "$CR1" \
--arg cs "$CS" \
'{"cd": $cd, "cr": $cr, "cr1": $cr1, "cs": $cs}' > hishtory-darwin-arm64-xattr.json
cat hishtory-darwin-arm64-xattr.json
echo "Exporting xattr for hishtory-darwin-amd64"
export CD=`xattr -p com.apple.cs.CodeDirectory hishtory-darwin-amd64`
export CR=`xattr -p com.apple.cs.CodeRequirements hishtory-darwin-amd64`
export CR1=`xattr -p com.apple.cs.CodeRequirements-1 hishtory-darwin-amd64`
export CS=`xattr -p com.apple.cs.CodeSignature hishtory-darwin-amd64`
jq --null-input \
--arg cd "$CD" \
--arg cr "$CR" \
--arg cr1 "$CR1" \
--arg cs "$CS" \
'{"cd": $cd, "cr": $cr, "cr1": $cr1, "cs": $cs}' > hishtory-darwin-amd64-xattr.json
cat hishtory-darwin-amd64-xattr.json
- name: Release
uses: softprops/action-gh-release@v1
if: startsWith(github.ref, 'refs/tags/')
with:
files: |
hishtory-darwin-arm64-xattr.json
hishtory-darwin-amd64-xattr.json