Skip to content

Commit 3d3db75

Browse files
craig[bot]rail
craig[bot]
and
rail
committed
Merge #144345
144345: ci: sign nightly and customized darwin builds r=rickystewart a=rail Previously, we didn't sign nightly and customized darwin builds. In some cases, it is easier to use dev machines to verify some functionality, but without signing, MacOS will not allow the app to run. This commit adds a script to sign darwin binaries generated by the nightly and customized builds. Additionally, it adds sanity checks to ensure that the signing process is run on correct type of machines and correct service account is used. Fixes: RE-794 Release note: none Co-authored-by: Rail Aliiev <[email protected]>
2 parents d6ffcc8 + 8a72343 commit 3d3db75

File tree

6 files changed

+117
-1
lines changed

6 files changed

+117
-1
lines changed

‎build/teamcity/internal/cockroach/release/publish/sign_staged_macos_release_on_linux.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,14 @@
55
# Use of this software is governed by the CockroachDB Software License
66
# included in the /LICENSE file.
77

8-
98
set -xeuo pipefail
109

10+
service_account=$(curl --header "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" || echo "")
11+
if [[ $service_account != "[email protected]" ]]; then
12+
echo "Not running on a signing agent, skipping signing"
13+
exit 1
14+
fi
15+
1116
dir="$(dirname $(dirname $(dirname $(dirname $(dirname $(dirname "${0}"))))))"
1217
source "$dir/teamcity-support.sh" # For log_into_gcloud
1318

@@ -20,6 +25,9 @@ remove_files_on_exit() {
2025
trap remove_files_on_exit EXIT
2126

2227
mkdir -p .secrets
28+
# Explicitly set the account to the signing agent. This is helpful if one of the previous
29+
# commands failed and left the account set to something else.
30+
gcloud config set account "[email protected]"
2331
gcloud secrets versions access latest --secret=apple-signing-cert | base64 -d > "$curr_dir/.secrets/cert.p12"
2432
gcloud secrets versions access latest --secret=apple-signing-cert-password > "$curr_dir/.secrets/cert.pass"
2533
gcloud secrets versions access latest --secret=appstoreconnect-api-key > "$curr_dir/.secrets/api_key.json"

‎build/teamcity/internal/release/process/make-and-publish-build-artifacts-darwin-sign.sh‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2025 The Cockroach Authors.
4+
#
5+
# Use of this software is governed by the CockroachDB Software License
6+
# included in the /LICENSE file.
7+
8+
9+
set -euxo pipefail
10+
11+
service_account=$(curl --header "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" || echo "")
12+
13+
if [[ $service_account != "[email protected]" ]]; then
14+
echo "Not running on a signing agent, skipping signing"
15+
exit 0
16+
fi
17+
18+
dir="$(dirname $(dirname $(dirname $(dirname $(dirname "${0}")))))"
19+
source "$dir/release/teamcity-support.sh"
20+
21+
tc_start_block "Variable Setup"
22+
23+
build_name=$(git describe --tags --dirty --match=v[0-9]* 2> /dev/null || git rev-parse --short HEAD;)
24+
25+
# On no match, `grep -Eo` returns 1. `|| echo""` makes the script not error.
26+
release_branch="$(echo "$build_name" | grep -Eo "^v[0-9]+\.[0-9]+" || echo"")"
27+
is_customized_build="$(echo "$TC_BUILD_BRANCH" | grep -Eo "^custombuild-" || echo "")"
28+
is_release_build="$(echo "$TC_BUILD_BRANCH" | grep -Eo "^((staging|release|rc)-(v)?[0-9][0-9]\.[0-9](\.0)?).*|master$" || echo "")"
29+
30+
if [[ -z "${DRY_RUN}" ]] ; then
31+
if [[ -z "${is_release_build}" ]] ; then
32+
gcs_bucket="cockroach-customized-builds-artifacts-prod"
33+
google_credentials="$GOOGLE_CREDENTIALS_CUSTOMIZED"
34+
else
35+
gcs_bucket="cockroach-builds-artifacts-prod"
36+
google_credentials="$GCS_CREDENTIALS_PROD"
37+
fi
38+
else
39+
gcs_bucket="cockroach-builds-artifacts-dryrun"
40+
build_name="${build_name}.dryrun"
41+
google_credentials="$GCS_CREDENTIALS_DEV"
42+
fi
43+
44+
cat << EOF
45+
46+
build_name: $build_name
47+
release_branch: $release_branch
48+
is_customized_build: $is_customized_build
49+
gcs_bucket: $gcs_bucket
50+
is_release_build: $is_release_build
51+
52+
EOF
53+
tc_end_block "Variable Setup"
54+
55+
secrets_dir="$(mktemp -d)"
56+
_on_exit() {
57+
rm -rf "$secrets_dir"
58+
gcloud config set account "[email protected]"
59+
}
60+
trap _on_exit EXIT
61+
62+
63+
# Explicitly set the account to the signing agent. This is helpful if one of the previous
64+
# commands failed and left the account set to something else.
65+
gcloud config set account "[email protected]"
66+
gcloud secrets versions access latest --secret=apple-signing-cert | base64 -d > "$secrets_dir/cert.p12"
67+
gcloud secrets versions access latest --secret=apple-signing-cert-password > "$secrets_dir/cert.pass"
68+
gcloud secrets versions access latest --secret=appstoreconnect-api-key > "$secrets_dir/api_key.json"
69+
70+
google_credentials="$google_credentials" log_into_gcloud
71+
72+
workdir="$(mktemp -d)"
73+
cd "$workdir"
74+
75+
for product in cockroach cockroach-sql; do
76+
# In case we want to sign darwin-10.9-amd64, we can add it here.
77+
for platform in darwin-11.0-arm64; do
78+
gsutil cp "gs://$gcs_bucket/$product-$build_name.$platform.unsigned.tgz" "$product-$build_name.$platform.unsigned.tgz"
79+
tar -xzf "$product-$build_name.$platform.unsigned.tgz"
80+
mv "$product-$build_name.$platform.unsigned" "$product-$build_name.$platform"
81+
rcodesign sign \
82+
--p12-file "$secrets_dir/cert.p12" --p12-password-file "$secrets_dir/cert.pass" \
83+
--code-signature-flags runtime \
84+
"$product-$build_name.$platform/$product"
85+
zip -r crl.zip "$product-$build_name.$platform/$product"
86+
rcodesign notary-submit --api-key-file "$secrets_dir/api_key.json" --wait crl.zip
87+
tar -czf "$product-$build_name.$platform.tgz" "$product-$build_name.$platform"
88+
shasum --algorithm 256 "$product-$build_name.$platform.tgz" > "$product-$build_name.$platform.tgz.sha256sum"
89+
gsutil cp "$product-$build_name.$platform.tgz" "gs://$gcs_bucket/$product-$build_name.$platform.tgz"
90+
gsutil cp "$product-$build_name.$platform.tgz.sha256sum" "gs://$gcs_bucket/$product-$build_name.$platform.tgz.sha256sum"
91+
rm -rf "$product-$build_name.$platform" \
92+
"$product-$build_name.$platform.tgz" \
93+
"$product-$build_name.$platform.tgz.sha256sum" \
94+
crl.zip
95+
done
96+
done

‎build/teamcity/internal/release/process/make-and-publish-build-artifacts-per-platform.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ The binaries will be available at:
146146
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.linux-amd64.tgz
147147
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.linux-amd64-fips.tgz
148148
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.linux-arm64.tgz
149+
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.darwin-11.0-arm64.tgz
149150
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.darwin-10.9-amd64.tgz
150151
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.windows-6.2-amd64.zip
151152

‎build/teamcity/internal/release/process/make-and-publish-build-tagging.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ Build ID: ${build_name}
104104
The binaries are available at:
105105
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.linux-amd64.tgz
106106
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.linux-arm64.tgz
107+
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.darwin-11.0-arm64.tgz
107108
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.darwin-10.9-amd64.tgz
108109
https://storage.googleapis.com/$gcs_bucket/cockroach-$build_name.windows-6.2-amd64.zip
109110

‎build/teamcity/internal/release/sign-patched-go.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,22 @@
88

99
set -xeuo pipefail
1010

11+
service_account=$(curl --header "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" || echo "")
12+
if [[ $service_account != "[email protected]" ]]; then
13+
echo "Not running on a signing agent, skipping signing"
14+
exit 1
15+
fi
16+
1117
cleanup() {
1218
rm -rf darwin.zip staging darwin-amd64 darwin-arm64 ./*.tar.gz TIMESTAMP.txt
1319
rm -rf .secrets
1420
}
1521
trap cleanup EXIT
1622

1723
mkdir -p .secrets
24+
# Explicitly set the account to the signing agent. This is helpful if one of the previous
25+
# commands failed and left the account set to something else.
26+
gcloud config set account "[email protected]"
1827
gcloud secrets versions access latest --secret=apple-signing-cert | base64 -d > .secrets/cert.p12
1928
gcloud secrets versions access latest --secret=apple-signing-cert-password > .secrets/cert.pass
2029
gcloud secrets versions access latest --secret=appstoreconnect-api-key > .secrets/api_key.json

‎scripts/tag-custom-build.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ The binaries will be available at:
8686
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.linux-amd64.tgz
8787
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.linux-amd64-fips.tgz
8888
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.linux-arm64.tgz
89+
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.darwin-11.0-arm64.tgz
8990
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.darwin-10.9-amd64.tgz
9091
https://storage.googleapis.com/cockroach-customized-builds-artifacts-prod/cockroach-$ID.windows-6.2-amd64.zip
9192

0 commit comments

Comments
 (0)