felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

sign releases with imported keychain identity
custom release / build-custom-release (push) Successful in 11s
Details

Browse Source
This commit is contained in:
felixfoertsch
2026-05-24 19:10:02 +02:00
parent 083f8e7068
commit 55f5a70ff5
3 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/tests/test-custom-release-macos-runner.bats
+13 -1
View File
@@ -41,6 +41,15 @@ setup() {
run rg -n 'security import .* -P "\$DEVELOPER_ID_APPLICATION_P12_PASSWORD"' "$WORKFLOW"
[ "$status" -eq 0 ]
run rg -n 'security find-identity -v -p codesigning "\$keychain_path"' "$WORKFLOW"
[ "$status" -eq 0 ]
run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY=\$codesign_identity' "$WORKFLOW"
[ "$status" -eq 0 ]
run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW"
[ "$status" -ne 0 ]
run rg -n 'security create-keychain' "$WORKFLOW"
[ "$status" -eq 0 ]
@@ -63,7 +72,10 @@ setup() {
}
@test "custom release signs darwin assets with hardened runtime and timestamp" {
run rg -n 'codesign .*--options runtime .*--timestamp' "$RELEASE_SCRIPT"
run rg -n 'codesign_args=.*--options runtime --timestamp' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ]
run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ]
run rg -n 'Developer ID Application' "$WORKFLOW" "$RELEASE_SCRIPT"
scripts/update-custom-release.sh
+6 -1
View File
@@ -298,10 +298,15 @@ sign_and_validate_darwin_binary() {
local binary="$1"
local version_output
local codesign_details
local codesign_args
[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"
codesign --force --sign "$codesign_identity" --options runtime --timestamp "$binary"
codesign_args=(--force --sign "$codesign_identity" --options runtime --timestamp)
if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
fi
codesign "${codesign_args[@]}" "$binary"
version_output="$("$binary" --version)"
if [[ "$version_output" == *modernc-sqlite* ]]; then