Skip to content

Commit c646527

Browse files
infeoinfeo
committed
add code signing for macOS and windows [ci skip]
1 parent 2a05bb8 commit c646527

File tree

3 files changed

+136
-4
lines changed

3 files changed

+136
-4
lines changed

‎.github/workflows/build-mac.yml‎

Lines changed: 74 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,11 @@ jobs:
2828
outputs:
2929
semVerStr: ${{ steps.determine-version.outputs.version }}
3030
semVerNum: ${{steps.determine-number.outputs.number}}
31+
revisionNum: ${{steps.determine-number.outputs.revision}}
3132
steps:
33+
- uses: actions/checkout@v4
34+
with:
35+
fetch-depth: 0
3236
- id: determine-version
3337
shell: pwsh
3438
run: |
@@ -45,6 +49,8 @@ jobs:
4549
run: |
4650
SEM_VER_NUM=$(echo "${{ steps.determine-version.outputs.version }}" | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/')
4751
echo "number=${SEM_VER_NUM}" >> "$GITHUB_OUTPUT"
52+
REVISION_NUM=`git rev-list --count HEAD`
53+
echo "revision=${REVISION_NUM}" >> "$GITHUB_OUTPUT"
4854
4955
build-binary:
5056
name: Build java app image
@@ -110,10 +116,76 @@ jobs:
110116
name: cryptomator-cli-mac-${{ matrix.architecture }}
111117
path: ./target/cryptomator-cli.app
112118
if-no-files-found: error
113-
- name: TODO sign binaries
114-
run: echo "TODO sign it and notarize it"
119+
- name: Patch Cryptomator.app
120+
run: |
121+
sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" ./target/Cryptomator.app/Contents/Info.plist
122+
sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" ./target/Cryptomator.app/Contents/Info.plist
123+
echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode --output ./target/Cryptomator.app/Contents/embedded.provisionprofile
124+
env:
125+
VERSION_NO: ${{ needs.prepare.outputs.semVerNum }}
126+
REVISION_NO: ${{ needs.prepare.outputs.revisionNum }}
127+
PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }}
128+
- name: Install codesign certificate
129+
run: |
130+
# create variables
131+
CERTIFICATE_PATH=$RUNNER_TEMP/codesign.p12
132+
KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain-db
133+
134+
# import certificate and provisioning profile from secrets
135+
echo -n "$CODESIGN_P12_BASE64" | base64 --decode --output $CERTIFICATE_PATH
136+
137+
# create temporary keychain
138+
security create-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
139+
security set-keychain-settings -lut 900 $KEYCHAIN_PATH
140+
security unlock-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
141+
142+
# import certificate to keychain
143+
security import $CERTIFICATE_PATH -P "$CODESIGN_P12_PW" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
144+
security list-keychain -d user -s $KEYCHAIN_PATH
145+
env:
146+
CODESIGN_P12_BASE64: ${{ secrets.MACOS_CODESIGN_P12_BASE64 }}
147+
CODESIGN_P12_PW: ${{ secrets.MACOS_CODESIGN_P12_PW }}
148+
CODESIGN_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_CODESIGN_TMP_KEYCHAIN_PW }}
149+
- name: Codesign
150+
run: |
151+
echo "Codesigning jdk files..."
152+
find ./target/cryptomator-cli.app/Contents/runtime/Contents/Home/lib/ -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
153+
find ./target/cryptomator-cli.app/Contents/runtime/Contents/Home/lib/ \( -name 'jspawnhelper' -o -name 'pauseengine' -o -name 'simengine' \) -exec codesign --force -o runtime -s ${CODESIGN_IDENTITY} {} \;
154+
echo "Codesigning jar contents..."
155+
find ./target/cryptomator-cli.app/Contents/runtime/Contents/MacOS -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
156+
for JAR_PATH in `find ./target/cryptomator-cli.app -name "*.jar"`; do
157+
if [[ `unzip -l ${JAR_PATH} | grep '.dylib\|.jnilib'` ]]; then
158+
JAR_FILENAME=$(basename ${JAR_PATH})
159+
OUTPUT_PATH=${JAR_PATH%.*}
160+
echo "Codesigning libs in ${JAR_FILENAME}..."
161+
unzip -q ${JAR_PATH} -d ${OUTPUT_PATH}
162+
find ${OUTPUT_PATH} -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
163+
find ${OUTPUT_PATH} -name '*.jnilib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
164+
rm ${JAR_PATH}
165+
pushd ${OUTPUT_PATH} > /dev/null
166+
zip -qr ../${JAR_FILENAME} *
167+
popd > /dev/null
168+
rm -r ${OUTPUT_PATH}
169+
fi
170+
done
171+
echo "Codesigning Cryptomator.app..."
172+
sed -i '' "s|###APP_IDENTIFIER_PREFIX###|${TEAM_IDENTIFIER}.|g" dist/mac/cryptomator-cli.entitlements
173+
sed -i '' "s|###TEAM_IDENTIFIER###|${TEAM_IDENTIFIER}|g" dist/mac/cryptomator-cli.entitlements
174+
codesign --force --deep --entitlements dist/mac/cryptomator-cli.entitlements -o runtime -s ${CODESIGN_IDENTITY} ./target/cryptomator-cli.app
175+
env:
176+
CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
177+
TEAM_IDENTIFIER: ${{ secrets.MACOS_TEAM_IDENTIFIER }}
115178
- name: Zip binary for release
116179
run: zip -r ./${{ matrix.artifact-name}} ./target/cryptomator-cli.app
180+
- name: Notarize .dmg
181+
if: startsWith(github.ref, 'refs/tags/')
182+
uses: cocoalibs/xcode-notarization-action@v1
183+
with:
184+
app-path: ${{ matrix.artifact-name }}
185+
apple-id: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
186+
password: ${{ secrets.MACOS_NOTARIZATION_PW }}
187+
team-id: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
188+
xcode-path: '/Applications/Xcode_16.app'
117189
- name: Create detached GPG signature with key 615D449FE6E6A235
118190
run: |
119191
echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import

‎.github/workflows/build-win.yml‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,50 @@ jobs:
103103
name: cryptomator-cli-win-x64
104104
path: ./target/cryptomator-cli
105105
if-no-files-found: error
106-
- name: TODO Sign binaries
107-
run: echo TODO
106+
- name: Fix permissions
107+
run: attrib -r target/cryptomator-cli/cryptomator-cli.exe
108+
shell: pwsh
109+
- name: Extract jars with DLLs for Codesigning
110+
shell: pwsh
111+
run: |
112+
Add-Type -AssemblyName "System.io.compression.filesystem"
113+
$jarFolder = Resolve-Path ".\target\Cryptomator-clie\app\mods"
114+
$jarExtractDir = New-Item -Path ".\target\jar-extract" -ItemType Directory
115+
116+
#for all jars inspect
117+
Get-ChildItem -Path $jarFolder -Filter "*.jar" | ForEach-Object {
118+
$jar = [Io.compression.zipfile]::OpenRead($_.FullName)
119+
if (@($jar.Entries | Where-Object {$_.Name.ToString().EndsWith(".dll")} | Select-Object -First 1).Count -gt 0) {
120+
#jars containing dlls extract
121+
Set-Location $jarExtractDir
122+
Expand-Archive -Path $_.FullName
123+
}
124+
$jar.Dispose()
125+
}
126+
- name: Codesign
127+
uses: skymatic/code-sign-action@v3
128+
with:
129+
certificate: ${{ secrets.WIN_CODESIGN_P12_BASE64 }}
130+
password: ${{ secrets.WIN_CODESIGN_P12_PW }}
131+
certificatesha1: 5FC94CE149E5B511E621F53A060AC67CBD446B3A
132+
description: Cryptomator
133+
timestampUrl: 'http://timestamp.digicert.com'
134+
folder: target
135+
recursive: true
136+
- name: Replace DLLs inside jars with signed ones
137+
shell: pwsh
138+
run: |
139+
$jarExtractDir = Resolve-Path ".\target\jar-extract"
140+
$jarFolder = Resolve-Path ".\target\cryptomator-cli\app\mods"
141+
Get-ChildItem -Path $jarExtractDir | ForEach-Object {
142+
$jarName = $_.Name
143+
$jarFile = "${jarFolder}\${jarName}.jar"
144+
Set-Location $_
145+
Get-ChildItem -Path $_ -Recurse -File "*.dll" | ForEach-Object {
146+
# update jar with signed dll
147+
jar --file="$jarFile" --update $(Resolve-Path -Relative -Path $_)
148+
}
149+
}
108150
- name: Zip binary for release
109151
shell: pwsh
110152
run: Compress-Archive -Path .\target\cryptomator-cli -DestinationPath .\${{ env.artifact-name}}

‎dist/mac/cryptomator-cli.entitlements‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.application-identifier</key>
6+
<string>###APP_IDENTIFIER_PREFIX###org.cryptomator</string>
7+
<key>com.apple.developer.team-identifier</key>
8+
<string>###TEAM_IDENTIFIER###</string>
9+
<key>com.apple.security.cs.allow-jit</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
12+
<true/>
13+
<!--key>com.apple.security.cs.disable-executable-page-protection</key>
14+
<true/-->
15+
<!--key>com.apple.security.cs.disable-library-validation</key>
16+
<true/-->
17+
</dict>
18+
</plist>

0 commit comments

Comments
 (0)