Merge pull request #188 from menloresearch/ci/macos-notarization

chore: add notarization step for mac

Author: Minh141120

.github/workflows/menlo-build.yml

@@ -399,6 +399,31 @@ jobs:
         run: |
           make codesign CODE_SIGN=true DEVELOPER_ID="${{ secrets.DEVELOPER_ID }}"
 
+      - name: Install Quill for notarization
+        if: runner.os == 'macOS'
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /usr/local/bin
+          quill --version
+
+      - name: Prepare notary key
+        if: runner.os == 'macOS'
+        run: |
+          base64 -d <<< "$NOTARIZE_P8_BASE64" > /tmp/notary-key.p8
+          chmod 600 /tmp/notary-key.p8
+        env:
+          NOTARIZE_P8_BASE64: ${{ secrets.NOTARIZE_P8_BASE64 }}
+
+      - name: Notarize macOS binaries
+        if: runner.os == 'macOS'
+        run: |
+          make notarize NOTARIZE=true QUILL_NOTARY_KEY_ID="${{ secrets.NOTARY_KEY_ID }}" QUILL_NOTARY_ISSUER="${{ secrets.NOTARY_ISSUER }}" QUILL_NOTARY_KEY="/tmp/notary-key.p8"
+
+      - name: Cleanup notary key
+        if: runner.os == 'macOS'
+        run: |
+          rm -f /tmp/notary-key.p8
+          echo "Notary key cleaned up"
+
       - name: Code Signing Windows
         if: runner.os == 'Windows'
         shell: cmd

Makefile

@@ -11,6 +11,10 @@ AZURE_TENANT_ID ?= xxxx
 AZURE_CLIENT_SECRET ?= xxxx
 AZURE_CERT_NAME ?= xxxx
 DEVELOPER_ID ?= xxxx
+NOTARIZE ?= false
+QUILL_NOTARY_KEY_ID ?= ""
+QUILL_NOTARY_ISSUER ?= ""
+QUILL_NOTARY_KEY ?= "/tmp/notary-key.p8"
 
 # Default target, does nothing
 all:
@@ -45,6 +49,33 @@ else
 	find "build/bin" -type f -exec codesign --force -s "$(DEVELOPER_ID)" --options=runtime {} \;
 endif
 
+notarize:
+ifeq ($(NOTARIZE),false)
+	@echo "Skipping Notarization"
+	@exit 0
+endif
+
+ifeq ($(OS),Windows_NT)
+	@echo "Skipping Notarization for Windows"
+	@exit 0
+else ifeq ($(shell uname -s),Linux)
+	@echo "Skipping Notarization for Linux"
+	@exit 0
+else
+	@echo "Starting notarization for macOS binaries..."
+	@find build/bin -type f -exec | while read binary; do \
+		echo "Notarizing $$(basename $$binary)..."; \
+		quill notarize "$$binary"; \
+		if [ $$? -eq 0 ]; then \
+			echo "Successfully notarized $$(basename $$binary)"; \
+		else \
+			echo  Failed to notarize $$(basename $$binary)"; \
+			exit 1; \
+		fi; \
+	done
+	@echo "All macOS binaries notarized successfully"
+endif
+
 package:
 ifeq ($(OS),Windows_NT)
 	@powershell -Command "7z a -ttar temp.tar build\bin\*; 7z a -tgzip llama.tar.gz temp.tar;"