diff --git a/.github/workflows/build-all.yml b/.github/workflows/build-all.yml index 15da4ba..5c2b3ec 100644 --- a/.github/workflows/build-all.yml +++ b/.github/workflows/build-all.yml @@ -247,6 +247,8 @@ jobs: BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }} P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }} KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} + APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} + APPLE_API_KEY_NAME: ${{ secrets.APPLE_API_KEY_NAME }} run: | # create variables CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 @@ -263,15 +265,20 @@ jobs: # import certificate to keychain security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH -T /usr/bin/codesign security list-keychain -d user -s $KEYCHAIN_PATH + + # import api key from secrets + mkdir "${HOME}/private_keys" + echo -n "$APPLE_API_KEY_BASE64" | base64 --decode --output "${HOME}/private_keys/AuthKey_$APPLE_API_KEY_NAME.p8" - name: Build run: | chmod +x compile_macosx.sh - ./compile_macosx.sh amd64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" + ./compile_macosx.sh amd64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" ${{ secrets.APPLE_TEAM_NAME }} ${{ secrets.APPLE_API_KEY_NAME }} ${{ secrets.APPLE_API_KEY_ISSUER }} - name: Clean up keychain if: ${{ always() }} run: | security delete-keychain $RUNNER_TEMP/app-signing.keychain-db + rm -rf "${HOME}/private_keys" - name: Export distribution uses: actions/upload-release-asset@v1 env: @@ -307,6 +314,8 @@ jobs: BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }} P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }} KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} + APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} + APPLE_API_KEY_NAME: ${{ secrets.APPLE_API_KEY_NAME }} run: | # create variables CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 @@ -323,15 +332,20 @@ jobs: # import certificate to keychain security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH -T /usr/bin/codesign security list-keychain -d user -s $KEYCHAIN_PATH + + # import api key from secrets + mkdir "${HOME}/private_keys" + echo -n "$APPLE_API_KEY_BASE64" | base64 --decode --output "${HOME}/private_keys/AuthKey_$APPLE_API_KEY_NAME.p8" - name: Build run: | chmod +x compile_macosx.sh - ./compile_macosx.sh arm64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" + ./compile_macosx.sh arm64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" ${{ secrets.APPLE_TEAM_NAME }} ${{ secrets.APPLE_API_KEY_NAME }} ${{ secrets.APPLE_API_KEY_ISSUER }} - name: Clean up keychain if: ${{ always() }} run: | security delete-keychain $RUNNER_TEMP/app-signing.keychain-db + rm -rf "${HOME}/private_keys" - name: Export distribution uses: actions/upload-release-asset@v1 env: diff --git a/.github/workflows/build-macosx-arm64.yml b/.github/workflows/build-macosx-arm64.yml index e05eb48..1a96e71 100644 --- a/.github/workflows/build-macosx-arm64.yml +++ b/.github/workflows/build-macosx-arm64.yml @@ -27,6 +27,8 @@ jobs: BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }} P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }} KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} + APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} + APPLE_API_KEY_NAME: ${{ secrets.APPLE_API_KEY_NAME }} run: | # create variables CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 @@ -43,15 +45,20 @@ jobs: # import certificate to keychain security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH -T /usr/bin/codesign security list-keychain -d user -s $KEYCHAIN_PATH + + # import api key from secrets + mkdir "${HOME}/private_keys" + echo -n "$APPLE_API_KEY_BASE64" | base64 --decode --output "${HOME}/private_keys/AuthKey_$APPLE_API_KEY_NAME.p8" - name: Build run: | chmod +x compile_macosx.sh - ./compile_macosx.sh arm64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" + ./compile_macosx.sh arm64 Release ${{ github.event.inputs.repo }} ${{ github.event.inputs.ref }} "${{ secrets.APPLE_BUILD_CERTIFICATE_NAME }}" ${{ secrets.APPLE_TEAM_NAME }} ${{ secrets.APPLE_API_KEY_NAME }} ${{ secrets.APPLE_API_KEY_ISSUER }} - name: Clean up keychain if: ${{ always() }} run: | security delete-keychain $RUNNER_TEMP/app-signing.keychain-db + rm -rf "${HOME}/private_keys" - name: Export artifacts uses: actions/upload-artifact@v2 diff --git a/macosx_codesign.sh b/macosx_codesign.sh index 7056ea3..ac4cf07 100755 --- a/macosx_codesign.sh +++ b/macosx_codesign.sh @@ -28,7 +28,6 @@ chmod +x macosx_notarize.sh echo "Signing helpers..." codesign --force --options runtime --entitlements "$ENTITLEMENTS_HELPER" --sign "$2" --timestamp --verbose "$APP_DIR/$APP_NAME/$FRAMEWORKS_DIR/jcef Helper.app" bash macosx_notarize.sh "$APP_DIR/$APP_NAME/$FRAMEWORKS_DIR/jcef Helper.app" "$2" $3 org.jcef.jcef.helper $4 $5 -exit 1 codesign --force --options runtime --entitlements "$ENTITLEMENTS_HELPER" --sign "$2" --timestamp --verbose "$APP_DIR/$APP_NAME/$FRAMEWORKS_DIR/jcef Helper (GPU).app" bash macosx_notarize.sh "$APP_DIR/$APP_NAME/$FRAMEWORKS_DIR/jcef Helper (GPU).app" "$2" $3 org.jcef.jcef.helper.gpu $4 $5 codesign --force --options runtime --entitlements "$ENTITLEMENTS_HELPER" --sign "$2" --timestamp --verbose "$APP_DIR/$APP_NAME/$FRAMEWORKS_DIR/jcef Helper (Plugin).app" diff --git a/macosx_notarize.sh b/macosx_notarize.sh index cc742e1..000647f 100755 --- a/macosx_notarize.sh +++ b/macosx_notarize.sh @@ -36,9 +36,12 @@ requestUUID=$(xcrun altool --notarize-app \ --file "$1.zip" 2>&1 \ | awk '/RequestUUID/ { print $NF; }') # --asc-provider "$3" \ - + echo "Notarization RequestUUID: $requestUUID" +# clean up zip +rm -f "$APP_NAME.zip" + if [[ $requestUUID == "" ]]; then echo "Could not upload for notarization" exit 1 @@ -48,7 +51,7 @@ fi request_status="in progress" while [[ "$request_status" == "in progress" ]]; do echo -n "waiting... " - sleep 10 + sleep 60 request_status=$(xcrun altool --notarization-info "$requestUUID" \ --apiKey "$5" \ --apiIssuer "$6" 2>&1 \ @@ -70,7 +73,4 @@ fi # staple xcrun stapler staple "$1" -# clean up -rm -f "$APP_NAME.zip" - echo "##########################################################"