build: sign macos binaries for arm and amd architectures and universal packagings #124
Conversation
zimeg
added
semver:patch
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #124 +/- ##
=======================================
Coverage 63.48% 63.48%
=======================================
Files 212 212
Lines 22344 22344
=======================================
Hits 14185 14185
Misses 7079 7079
Partials 1080 1080 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
📣 From the logs, these changes appear to be signing darwin builds from https://github.com/slackapi/slack-cli/releases/tag/v3.3.0-zimeg-build-sign-macos-archs-feature Linked in the release above, downloads can be collected and tested with these commands: $ curl -fsSL https://downloads.slack-edge.com/slack-cli/install-dev.sh | bash -s -- -v 3.3.0-zimeg-build-sign-macos-archs-feature lack-dev
$ file $(readlink $(which lack-dev))
~/.slack/dev-build/bin/slack: Mach-O universal binary with 2 architectures: [arm64:\012- Mach-O 64-bit arm64 executable, flags:<|DYLDLINK|PIE>] [\012- x86_64]
$ spctl -a -vvv -t install $(which lack-dev)
/usr/local/bin/lack-dev: accepted
source=Notarized Developer ID
origin=Developer ID Application: SLACK TECHNOLOGIES L.L.C. (BQR82RBBHL)Attempt an installation for the architecture: $ ./scripts/install-dev.sh -v 3.3.0-zimeg-build-sign-macos-archs-feature lack-dev
$ file $(readlink $(which lack-dev))
~/.slack/dev-build/bin/slack: Mach-O 64-bit arm64 executable, flags:<|DYLDLINK|PIE>
$ spctl -a -vvv -t install $(which lack-dev)
/usr/local/bin/lack-dev: accepted
source=Notarized Developer ID
origin=Developer ID Application: SLACK TECHNOLOGIES L.L.C. (BQR82RBBHL)Confirm another architecture is signed: $ curl https://downloads.slack-edge.com/slack-cli/slack_cli_3.3.0-zimeg-build-sign-macos-archs-feature_macOS_amd64.tar.gz > amd64.tar.gz
$ tar -xf amd64.tar.gz
$ file ./bin/slack
./bin/slack: Mach-O 64-bit x86_64 executable, flags:<|DYLDLINK|PIE>
$ spctl -a -vvv -t install ./bin/slack
./bin/slack: accepted
source=Notarized Developer ID
origin=Developer ID Application: SLACK TECHNOLOGIES L.L.C. (BQR82RBBHL) |
|
🔍 FWIW I noticed the notarization doesn't happen right after the script completes and might take a few minutes. That was confusing me when testing this, but it resolved after a bit. |
There was a problem hiding this comment.
✅ We have arm support with code signed binaries for tagged releases! 🎉
🧪 I manually downloaded the .zip and .tar.gz files from https://github.com/slackapi/slack-cli/releases/tag/v3.3.0-zimeg-build-sign-macos-archs-feature and verified that all 13 files are code signed using:
$ codesign -dv --verbose=4 ~/Downloads/bin/slack⚒️ Fantastic work @zimeg! This is very exciting!
| cd "${ARTIFACTS_DIR}" | ||
|
|
||
| for package in "${PROD_NAME}"*macOS_*.zip; do | ||
| echo "Signing: ${package}" | ||
| unzip "${package}" | ||
| codesign --force --deep --verbose --verify --sign "Developer ID Application: SLACK TECHNOLOGIES L.L.C. (BQR82RBBHL)" --options runtime "${PROD_NAME}" | ||
| codesign -vvv --deep --strict "${PROD_NAME}" | ||
| zip -r "${package}" "${PROD_NAME}" | ||
| rm "${PROD_NAME}" | ||
| xcrun notarytool submit "${package}" -p "HERMES_NOTARY" | ||
| done |
There was a problem hiding this comment.
Nice refactor to use the loop 👌🏻 ✨
Originally, I think this code was meant to stay in-sync with the other mac code sign implementation. But, since we need to use a loop we're naturally going to need to refactor it.
There was a problem hiding this comment.
Originally, I think this code was meant to stay in-sync with the other mac code sign implementation.
Ooh I might not be familiar with that implementation, but I'd love to know about it for future reference if possible 🤖
I'm hoping that a loop instead of repeated script lines is more ideal with multiple binaries now needing signed as well!
|
@mwbrooks What a collection of tasks this was with so much learning of our CI setups! I'm glad we're improving this before next release too, so upgrades go smooth. 👾 If more build updates are needed I'll also be sure to make fast fixes, but for now let's merge this so our nightly builds can exercise this 🐮 🚲 🌝 |
Summary
This PR attempts to sign all macOS binaries before packaging these into development and latest bundles for a tarball.
Notes
A feature build will be tagged in this PR to test this!
Requirements