Handle notarization

Author: bikmazefe

clients/cli/.github/workflows/release.yml

@@ -65,6 +65,9 @@ jobs:
           SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           DIST_DIR: "dist"
+          NOTARIZATION_APPLE_ID: ${{ secrets.NOTARIZATION_APPLE_ID }}
+          NOTARIZATION_APP_PASSWORD: ${{ secrets.NOTARIZATION_APP_PASSWORD }}
+          NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }}
       - name: Upload signed binaries to Draft Release
         uses: softprops/action-gh-release@v1
         with:

clients/cli/build/sign.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -eo pipefail
+set -euo pipefail
 
 CERTIFICATE_BASE64="${SIGNING_CERTIFICATE}"
 P12_PASSWORD="${CERTIFICATE_PASSWORD}"
@@ -10,10 +10,37 @@ DIST_DIR="${DIST_DIR:-dist}"
 CERTIFICATE_PATH="./build_certificate.p12"
 KEYCHAIN_PATH="./my-signing.keychain-db"
 
+# Basic env validation to fail fast
+require_env() {
+  local name="$1" value="$2"
+  if [[ -z "$value" ]]; then
+    echo "❌ Missing required environment variable: $name" >&2
+    exit 1
+  fi
+}
+
+require_env "SIGNING_CERTIFICATE" "${CERTIFICATE_BASE64}"
+require_env "CERTIFICATE_PASSWORD" "${P12_PASSWORD}"
+require_env "SIGNING_IDENTITY" "${SIGNING_IDENTITY}"
+require_env "KEYCHAIN_PASSWORD" "${KEYCHAIN_PASSWORD}"
+require_env "NOTARIZATION_APPLE_ID" "${NOTARIZATION_APPLE_ID:-}"
+require_env "NOTARIZATION_APP_PASSWORD" "${NOTARIZATION_APP_PASSWORD:-}"
+require_env "NOTARIZATION_TEAM_ID" "${NOTARIZATION_TEAM_ID:-}"
+
+
+cleanup() {
+  echo "🧹 Cleaning up keychain and certificate..."
+  # Attempt to delete the temporary keychain
+  security delete-keychain "$KEYCHAIN_PATH" || true
+  # Remove certificate file
+  rm -f "$CERTIFICATE_PATH" || true
+}
+trap cleanup EXIT
+
 echo "🔐 Setting up certificate and keychain..."
 
-# Decode the certificate
-echo "$CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"
+# Decode the certificate (macOS-only)
+echo "$CERTIFICATE_BASE64" | /usr/bin/base64 -D > "$CERTIFICATE_PATH"
 
 # Create temporary keychain
 security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
@@ -22,16 +49,44 @@ security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
 
 # Import certificate into keychain
 security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
-security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-security list-keychain -d user -s "$KEYCHAIN_PATH"
+security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+# Show available signing identities for visibility
+echo "🔎 Available signing identities (codesigning):"
+security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
 
 # Find and sign all macOS binaries dynamically
 echo "🔎 Searching for macOS binaries in $DIST_DIR..."
 
-find "$DIST_DIR" -type f \( -name "phrase_macosx_*" ! -name "*.tar.gz" \) | while read -r binary; do
+find "$DIST_DIR" -type f \( -name "phrase_macosx_*" ! -name "*.tar.gz" \) -print0 | while IFS= read -r -d '' binary; do
   echo "🔏 Signing $binary..."
-  codesign --timestamp --options runtime --sign "$SIGNING_IDENTITY" "$binary"
-  codesign --verify --verbose=2 "$binary"
+  codesign --timestamp --options runtime --keychain "$KEYCHAIN_PATH" --sign "$SIGNING_IDENTITY" "$binary"
+  codesign --verify --verbose=2 --keychain "$KEYCHAIN_PATH" "$binary"
+done
+
+echo "✅ All macOS binaries signed successfully."
+
+# --- Zip artifacts for notarization ---
+echo "📦 Zipping macOS binaries for notarization..."
+shopt -s nullglob
+for bin in "$DIST_DIR"/phrase_macosx_*; do
+  [[ "$bin" == *.tar.gz ]] && continue
+  zip_name="${bin}.zip"
+  echo "Creating ${zip_name}"
+  /usr/bin/zip -j -o "$zip_name" "$bin"
+done
+
+# --- Notarization via Apple notarytool (Apple ID + app-specific password) ---
+echo "📝 Notarizing zipped binaries with Apple Notary (Apple ID)..."
+for zip in "$DIST_DIR"/phrase_macosx_*.zip; do
+  [[ -e "$zip" ]] || continue
+  echo "Submitting $zip to Apple Notary..."
+  xcrun notarytool submit "$zip" \
+    --apple-id "$NOTARIZATION_APPLE_ID" \
+    --password "$NOTARIZATION_APP_PASSWORD" \
+    --team-id "$NOTARIZATION_TEAM_ID" \
+    --wait
+  echo "ℹ️ Notarization complete for $zip."
 done
 
-echo "✅ All macOS binaries signed successfully."
+echo "🎉 Signing and notarization finished."