Repository navigation
ci(macos): sign and notarize release assets when Developer ID secrets exist - #2116
Merged
Merged
Conversation
… exist The swift-app job and the macOS CLI build now sign with a Developer ID (hardened runtime, secure timestamp), notarize with notarytool, staple the app and verify the downloaded zip with spctl, but only once all five MACOS_* secrets are set. Without them the release stays ad-hoc signed and the job prints a notice; a partial set fails the job. Refs #2034 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #2034
What
Prepares Developer ID signing and notarization so it switches on as soon as the secrets are added. Nothing changes for releases until then.
scripts/macos-release-signing.sh(check,import,sign,notarize,cleanup): checks the secrets, imports the.p12into a temporary keychain, signs with--options runtime --timestamp, submits withxcrun notarytool submit --wait(fails unlessAccepted, prints the notary log), staples and runsstapler validate+spctl --assesson an app.scripts/package-swift-app.sh: signsContents/Helpers/rustcodeand the bundle withMACOS_SIGN_IDENTITYwhen set (hardened runtime + timestamp); otherwise the ad-hoc signing used today.build.ymlbuild(macOS, tag/dispatch only): sign and notarize the CLI binary before it is archived. A bare executable cannot be stapled; Gatekeeper fetches its ticket online.swift-app: import → package (signed) → notarize + staple → zip → unpack the zip, set the browser quarantine flag,stapler validate,spctl --assess,codesign --verify --deep --strict→ delete the keychain (always()).checkprints a::notice::and every signing step is skipped. A partial set fails the job, so a half-done setup is not mistaken for a signed release.macos-swift-ci.yml: runs the ad-hoc packaging path (/usr/bin/truestands in for the engine) andcheckon PRs.docs/macos-release-signing.md(secrets, setup, manual check).docs/install.mdkeeps the quarantine workaround with a note that it goes away with the first notarized release.Secrets the owner must add
MACOS_DEVELOPER_ID_P12_BASE64,MACOS_DEVELOPER_ID_P12_PASSWORD,MACOS_NOTARY_APPLE_ID,MACOS_NOTARY_TEAM_ID,MACOS_NOTARY_PASSWORD.Verification
python3 -c 'yaml.safe_load(...)'on both workflows,actionlint1.7.7 (only the existingmacos-26unknown-label warning, which main already has),bash -non both scripts.checklocally: no secrets → notice,enabled=false, exit 0; one secret → error listing the missing four, exit 1.workflow_dispatchafter adding them (see the doc's Setup step 5).🤖 Generated with Claude Code