felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

place codesign keychain before signing options
custom release / build-custom-release (push) Successful in 12s
Details

Browse Source
This commit is contained in:
felixfoertsch
2026-05-24 19:35:46 +02:00
parent cda7f54a48
commit 4f2829ed48
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tests/test-custom-release-macos-runner.bats
+9 -1
View File
@@ -75,7 +75,7 @@ setup() {
} }
@test "custom release signs darwin assets with hardened runtime and timestamp" { @test "custom release signs darwin assets with hardened runtime and timestamp" {
run rg -n 'codesign_args=.*--options runtime --timestamp' "$RELEASE_SCRIPT" run rg -n 'codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT" run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
@@ -87,6 +87,14 @@ setup() {
run rg -n 'security find-identity -v -p codesigning "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT" run rg -n 'security find-identity -v -p codesigning "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run awk '
/codesign_args=\(--force\)/ { base = NR }
/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
/codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)/ { sign = NR }
END { exit !(base && keychain && sign && base < keychain && keychain < sign) }
' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ]
run rg -n 'Developer ID Application' "$WORKFLOW" "$RELEASE_SCRIPT" run rg -n 'Developer ID Application' "$WORKFLOW" "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
scripts/update-custom-release.sh
+2 -1
View File
@@ -302,7 +302,7 @@ sign_and_validate_darwin_binary() {
[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds" [[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"
codesign_args=(--force --sign "$codesign_identity" --options runtime --timestamp) codesign_args=(--force)
if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then
security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH" security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH"
@@ -310,6 +310,7 @@ sign_and_validate_darwin_binary() {
security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH" security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH"
codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH") codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
fi fi
codesign_args+=(--sign "$codesign_identity" --options runtime --timestamp)
codesign "${codesign_args[@]}" "$binary" codesign "${codesign_args[@]}" "$binary"
version_output="$("$binary" --version)" version_output="$("$binary" --version)"