Skip to content

Commit c371cdd

Browse files
akien-mgaakien-mga
committed
Mono/macOS: Codesign the editor binary
Using --deep to also sign the AOT cross-compilers.
1 parent a5d0f20 commit c371cdd

File tree

2 files changed

+70
-31
lines changed

2 files changed

+70
-31
lines changed

‎build-macosx/editor_mono.entitlements

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-jit</key>
8+
<true/>
9+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
10+
<true/>
11+
<key>com.apple.security.cs.disable-library-validation</key>
12+
<true/>
13+
<key>com.apple.security.device.audio-input</key>
14+
<true/>
15+
<key>com.apple.security.device.camera</key>
16+
<true/>
17+
</dict>
18+
</plist>

‎build-release.sh

Lines changed: 52 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,61 @@ else
1414
echo "Disabling binary signing as config.sh does not define the required data."
1515
fi
1616

17-
function sign {
17+
sign_windows() {
1818
if [ $can_sign == 0 ]; then
1919
return
2020
fi
2121
./osslsigncode -pkcs12 ${SIGN_KEYSTORE} -pass "${SIGN_PASSWORD}" -n "${SIGN_NAME}" -i "${SIGN_URL}" -t http://timestamp.comodoca.com -in $1 -out $1-signed
2222
mv $1-signed $1
2323
}
2424

25+
sign_macos() {
26+
if [ ! -z "${OSX_HOST}" ]; then
27+
osx_tmpdir=$(ssh "${OSX_HOST}" "mktemp -d")
28+
reldir="$1"
29+
binname="$2"
30+
is_mono="$3"
31+
32+
if [[ "${is_mono}" == "1" ]]; then
33+
appname="Godot_mono.app"
34+
entitlements=editor_mono.entitlements
35+
sharpdir="${appname}/Contents/Resources/GodotSharp"
36+
extra_files="${sharpdir}/Mono/lib/*.dylib ${sharpdir}/Tools/aot-compilers/*/*"
37+
else
38+
appname="Godot.app"
39+
entitlements=editor.entitlements
40+
fi
41+
42+
scp "${reldir}/${binname}.zip" "${OSX_HOST}:${osx_tmpdir}"
43+
scp "${basedir}/build-macosx/${entitlements}" "${OSX_HOST}:${osx_tmpdir}"
44+
ssh "${OSX_HOST}" "
45+
cd ${osx_tmpdir} && \
46+
unzip ${binname}.zip && \
47+
codesign --force --timestamp \
48+
--options=runtime --entitlements ${entitlements} \
49+
-s ${OSX_KEY_ID} -v ${extra_files} ${appname} && \
50+
zip -r ${binname}_signed.zip ${appname}"
51+
52+
request_uuid=$(ssh "${OSX_HOST}" "xcrun altool --notarize-app --primary-bundle-id \"${OSX_BUNDLE_ID}\" --username \"${APPLE_ID}\" --password \"${APPLE_ID_PASSWORD}\" --file ${osx_tmpdir}/${binname}_signed.zip")
53+
request_uuid=$(echo ${request_uuid} | sed -e 's/.*RequestUUID = //')
54+
ssh "${OSX_HOST}" "while xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*in\ progress; do echo Waiting on Apple notarization...; sleep 30s; done"
55+
if ! ssh "${OSX_HOST}" "xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*success"; then
56+
echo "Notarization failed."
57+
notarization_log=$(ssh "${OSX_HOST}" "xcrun altool --notarization-info ${request_uuid} -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\"")
58+
echo "${notarization_log}"
59+
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
60+
exit 1
61+
else
62+
ssh "${OSX_HOST}" "
63+
cd ${osx_tmpdir} && \
64+
xcrun stapler staple ${appname} && \
65+
zip -r ${binname}_stapled.zip ${appname}"
66+
scp "${OSX_HOST}:${osx_tmpdir}/${binname}_stapled.zip" ${reldir}/${binname}.zip
67+
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
68+
fi
69+
fi
70+
}
71+
2572
godot_version=""
2673
templates_version=""
2774
build_classical=1
@@ -117,14 +164,14 @@ if [ "${build_classical}" == "1" ]; then
117164
binname="${godot_basename}_win64.exe"
118165
cp out/windows/x64/tools/godot.windows.opt.tools.64.exe ${binname}
119166
strip ${binname}
120-
sign ${binname}
167+
sign_windows ${binname}
121168
zip -q -9 "${reldir}/${binname}.zip" ${binname}
122169
rm ${binname}
123170

124171
binname="${godot_basename}_win32.exe"
125172
cp out/windows/x86/tools/godot.windows.opt.tools.32.exe ${binname}
126173
strip ${binname}
127-
sign ${binname}
174+
sign_windows ${binname}
128175
zip -q -9 "${reldir}/${binname}.zip" ${binname}
129176
rm ${binname}
130177

@@ -147,34 +194,7 @@ if [ "${build_classical}" == "1" ]; then
147194
chmod +x Godot.app/Contents/MacOS/Godot
148195
zip -q -9 -r "${reldir}/${binname}.zip" Godot.app
149196
rm -rf Godot.app
150-
151-
if [ ! -z "${OSX_HOST}" ]; then
152-
osx_tmpdir=$(ssh "${OSX_HOST}" "mktemp -d")
153-
154-
scp "${reldir}/${binname}.zip" "${OSX_HOST}:${osx_tmpdir}"
155-
scp "${basedir}/build-macosx/editor.entitlements" "${OSX_HOST}:${osx_tmpdir}"
156-
ssh "${OSX_HOST}" "
157-
cd ${osx_tmpdir} && \
158-
unzip ${binname}.zip &&\
159-
codesign --timestamp --options=runtime --entitlements editor.entitlements -s ${OSX_KEY_ID} -v Godot.app/Contents/MacOS/Godot && \
160-
zip -r ${binname}_signed.zip Godot.app"
161-
162-
request_uuid=$(ssh "${OSX_HOST}" "xcrun altool --notarize-app --primary-bundle-id \"${OSX_BUNDLE_ID}\" --username \"${APPLE_ID}\" --password \"${APPLE_ID_PASSWORD}\" --file ${osx_tmpdir}/${binname}_signed.zip")
163-
request_uuid=$(echo ${request_uuid} | sed -e 's/.*RequestUUID = //')
164-
ssh "${OSX_HOST}" "while xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*in\ progress; do echo Waiting on Apple signature; sleep 30s; done"
165-
if ! ssh "${OSX_HOST}" "xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*success"; then
166-
echo "Signing failed?"
167-
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
168-
exit 1
169-
else
170-
ssh "${OSX_HOST}" "
171-
cd ${osx_tmpdir} && \
172-
xcrun stapler staple Godot.app && \
173-
zip -r ${binname}_stapled.zip Godot.app"
174-
scp "${OSX_HOST}:${osx_tmpdir}/${binname}_stapled.zip" ${reldir}/${binname}.zip
175-
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
176-
fi
177-
fi
197+
sign_macos ${reldir} ${binname} 0
178198

179199
# Templates
180200
rm -rf osx_template.app
@@ -373,6 +393,7 @@ if [ "${build_mono}" == "1" ]; then
373393
chmod +x Godot_mono.app/Contents/MacOS/Godot
374394
zip -q -9 -r "${reldir_mono}/${binname}.zip" Godot_mono.app
375395
rm -rf Godot_mono.app
396+
sign_macos ${reldir_mono} ${binname} 1
376397

377398
# Templates
378399
rm -rf osx_template.app

0 commit comments

Comments
 (0)