notarize: limit concurrent uploads to avoid error -18000

Author: mitchellh

cmd/gon/item.go

@@ -43,23 +43,27 @@ type processOptions struct {
 	// Prefix is the prefix string for output
 	Prefix string
 
-	// Lock protects access to the terminal output.
-	Lock *sync.Mutex
+	// OutputLock protects access to the terminal output.
+	//
+	// UploadLock protects simultaneous notary submission.
+	OutputLock *sync.Mutex
+	UploadLock *sync.Mutex
 }
 
 // notarize notarize & staples the item.
 func (i *item) notarize(ctx context.Context, opts *processOptions) error {
-	lock := opts.Lock
+	lock := opts.OutputLock
 
 	// Start notarization
 	_, err := notarize.Notarize(ctx, &notarize.Options{
-		File:     i.Path,
-		BundleId: opts.Config.BundleId,
-		Username: opts.Config.AppleId.Username,
-		Password: opts.Config.AppleId.Password,
-		Provider: opts.Config.AppleId.Provider,
-		Logger:   opts.Logger.Named("notarize"),
-		Status:   &statusHuman{Prefix: opts.Prefix, Lock: lock},
+		File:       i.Path,
+		BundleId:   opts.Config.BundleId,
+		Username:   opts.Config.AppleId.Username,
+		Password:   opts.Config.AppleId.Password,
+		Provider:   opts.Config.AppleId.Provider,
+		Logger:     opts.Logger.Named("notarize"),
+		Status:     &statusHuman{Prefix: opts.Prefix, Lock: lock},
+		UploadLock: opts.UploadLock,
 	})
 
 	// Save our state

cmd/gon/main.go

@@ -176,18 +176,19 @@ func realMain() int {
 
 	// Start our notarizations
 	var wg sync.WaitGroup
-	var lock sync.Mutex
+	var lock, uploadLock sync.Mutex
 	var totalErr error
 	for idx := range items {
 		wg.Add(1)
 		go func(idx int) {
 			defer wg.Done()
 
 			err := items[idx].notarize(context.Background(), &processOptions{
-				Config: cfg,
-				Lock:   &lock,
-				Logger: logger,
-				Prefix: prefixes[idx],
+				Config:     cfg,
+				Logger:     logger,
+				Prefix:     prefixes[idx],
+				OutputLock: &lock,
+				UploadLock: &uploadLock,
 			})
 
 			if err != nil {

notarize/notarize.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os/exec"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/hashicorp/go-hclog"
@@ -32,6 +33,12 @@ type Options struct {
 	// providers.
 	Provider string
 
+	// UploadLock, if specified, will limit concurrency when uploading
+	// packages. The notary submission process does not allow concurrent
+	// uploads of packages with the same bundle ID, it appears. If you set
+	// this lock, we'll hold the lock while we upload.
+	UploadLock *sync.Mutex
+
 	// Status, if non-nil, will be invoked with status updates throughout
 	// the notarization process.
 	Status Status
@@ -66,9 +73,16 @@ func Notarize(ctx context.Context, opts *Options) (*Info, error) {
 		status = noopStatus{}
 	}
 
+	lock := opts.UploadLock
+	if lock == nil {
+		lock = &sync.Mutex{}
+	}
+
 	// First perform the upload
+	lock.Lock()
 	status.Submitting()
 	uuid, err := upload(ctx, opts)
+	lock.Unlock()
 	if err != nil {
 		return nil, err
 	}