felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

order codesign signing arguments
custom release / build-custom-release (push) Failing after 10s
Details

Browse Source
This commit is contained in:
felixfoertsch
2026-05-24 19:52:13 +02:00
parent 4b71e4f324
commit b8ea748973
3 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/custom-release.yml
+1 -1
View File
@@ -82,7 +82,7 @@ jobs:
probe_binary="$RUNNER_TEMP/codesign-probe" probe_binary="$RUNNER_TEMP/codesign-probe"
cp /usr/bin/true "$probe_binary" cp /usr/bin/true "$probe_binary"
codesign --force --dryrun --keychain "$keychain_path" --sign "$codesign_identity" --options runtime --timestamp "$probe_binary" codesign --force --dryrun --sign "$codesign_identity" --keychain "$keychain_path" --options runtime --timestamp "$probe_binary"
echo "CUSTOM_RELEASE_CODESIGN_IDENTITY=$codesign_identity" >> "$GITHUB_ENV" echo "CUSTOM_RELEASE_CODESIGN_IDENTITY=$codesign_identity" >> "$GITHUB_ENV"
echo "CUSTOM_RELEASE_CODESIGN_IDENTITY_SHA1=$codesign_identity_sha1" >> "$GITHUB_ENV" echo "CUSTOM_RELEASE_CODESIGN_IDENTITY_SHA1=$codesign_identity_sha1" >> "$GITHUB_ENV"
scripts/tests/test-custom-release-macos-runner.bats
+8 -5
View File
@@ -62,7 +62,7 @@ setup() {
run rg -n 'CUSTOM_RELEASE_KEYCHAIN_PASSWORD=\$keychain_password' "$WORKFLOW" run rg -n 'CUSTOM_RELEASE_KEYCHAIN_PASSWORD=\$keychain_password' "$WORKFLOW"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run rg -n 'codesign --force --dryrun --keychain "\$keychain_path" --sign "\$codesign_identity" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW" run rg -n 'codesign --force --dryrun --sign "\$codesign_identity" --keychain "\$keychain_path" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW" run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW"
@@ -90,12 +90,15 @@ setup() {
} }
@test "custom release signs darwin assets with hardened runtime and timestamp" { @test "custom release signs darwin assets with hardened runtime and timestamp" {
run rg -n 'codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)' "$RELEASE_SCRIPT" run rg -n 'codesign_args=\(--force --sign "\$codesign_identity"\)' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT" run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run rg -n 'codesign_args\+=\(--options runtime --timestamp\)' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ]
run rg -n 'security unlock-keychain -p "\$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT" run rg -n 'security unlock-keychain -p "\$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
@@ -103,10 +106,10 @@ setup() {
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
run awk ' run awk '
/codesign_args=\(--force\)/ { base = NR } /codesign_args=\(--force --sign "\$codesign_identity"\)/ { sign = NR }
/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR } /codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
/codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)/ { sign = NR } /codesign_args\+=\(--options runtime --timestamp\)/ { options = NR }
END { exit !(base && keychain && sign && base < keychain && keychain < sign) } END { exit !(sign && keychain && options && sign < keychain && keychain < options) }
' "$RELEASE_SCRIPT" ' "$RELEASE_SCRIPT"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
scripts/update-custom-release.sh
+2 -2
View File
@@ -302,7 +302,7 @@ sign_and_validate_darwin_binary() {
[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds" [[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"
codesign_args=(--force) codesign_args=(--force --sign "$codesign_identity")
if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PASSWORD:-}" ]]; then
security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH" security unlock-keychain -p "$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "$CUSTOM_RELEASE_KEYCHAIN_PATH"
@@ -310,7 +310,7 @@ sign_and_validate_darwin_binary() {
security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH" security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH"
codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH") codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
fi fi
codesign_args+=(--sign "$codesign_identity" --options runtime --timestamp) codesign_args+=(--options runtime --timestamp)
codesign "${codesign_args[@]}" "$binary" codesign "${codesign_args[@]}" "$binary"
version_output="$("$binary" --version)" version_output="$("$binary" --version)"