Repository navigation
Prepare Developer ID signing and notarization for macOS - #188
Merged
Merged
Conversation
The release workflow already holds the macOS signing steps behind the MACOS_SIGNING_ENABLED variable. This makes them safe to switch on: - When signing is off, the macOS job says so in the run summary and as a notice, so a skip cannot be read as a pass. - When signing is on, the job checks the Developer ID Application authority, the Team ID, the hardened runtime and the timestamp after signing, and asserts that Gatekeeper reports the binary as Notarized Developer ID and that the package is signed, stapled and accepted. It writes the result to the run summary. - A new on-demand "macOS signing check" workflow, bound to the release-signing environment, runs the same chain on a throwaway executable and package. It fails and lists the names of any missing secret. - docs/release-signing.md describes the identities, the secrets, who may change them and what to do if they are compromised; docs/verifying-releases.md explains how to verify the signatures. The signing steps stay inline in both workflows: the signing job checks nothing out and runs no repository code, and a shared script would break that. Refs #50 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #50
Release workflow
MACOS_SIGNING_ENABLEDnottrue, or a manual dry run): the macOS job writesmacOS signing: skipped — MACOS_SIGNING_ENABLED is not true; the binary is not Developer ID signed or notarized.to the run summary and emits a::notice::. Nothing else changes.codesign --verify --strict, andcodesign -dvvmust show theDeveloper ID Applicationauthority, aTeamIdentifier, the hardened runtime and a timestamp;spctl --assess --type executemust reportsource=Notarized Developer IDfor the binary (retried briefly, since the ticket is looked up online), and the package must show aDeveloper ID Installersignature, passstapler validateandspctl --assess --type install;macOS signing check (new,
workflow_dispatchonly)Bound to the
release-signingenvironment, so it needs the same approval. It builds a tiny universal executable, then runs import, codesign, notarize and verify on it and on a throwaway.pkg, deletes the temporary keychain always, and uploads nothing. If any of the nine secrets is absent it fails and lists the missing names in the step summary; it never skips.The signing steps are kept inline in both workflows rather than moved to a script: the
sign-macosjob deliberately checks nothing out and runs no repository code, and a shared script would need a checkout in the job that holds the keys. Both files carry a comment to keep them in step.Note for enabling: the
release-signingenvironment accepts deployments fromv*tags only, so running the check needsmainadded to its allowed branches temporarily (documented).Docs and changelog
docs/release-signing.md(identities, secret names, who may change them, enabling steps, compromise procedure),docs/verifying-releases.md(macOS verification, applies from the first Developer ID signed release), CHANGELOG entry.I could not run actionlint or zizmor locally; shellcheck over every new or changed
runblock is clean.workflow-lintwill run on this PR.