Fixing apple signing #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Build Rust CLI -> .app -> .dmg -> Notarize" | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| jobs: | |
| build-macos-dmg: | |
| name: "Build, .app, Notarize macOS" | |
| runs-on: macos-latest | |
| steps: | |
| # 1) Check out code | |
| - name: Check out code | |
| uses: actions/checkout@v3 | |
| # 2) Install Rust | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@v1 | |
| with: | |
| toolchain: stable | |
| # 3) Build CLI in release mode | |
| - name: Cargo build | |
| run: cargo build --release | |
| # 4) Import Developer ID certificate + AppleWWDRCAG3 intermediate | |
| - name: Install Code Signing Certificate | |
| run: | | |
| echo "$APPLE_CERT" | base64 --decode > signing.p12 | |
| security create-keychain -p "" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "" build.keychain | |
| # Download & import Apple WWDR intermediate certificate | |
| curl -O https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer | |
| security import AppleWWDRCAG3.cer -k build.keychain | |
| # Now import your Developer ID .p12 | |
| security import signing.p12 -k build.keychain -P "$APPLE_CERT_PASS" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain | |
| env: | |
| APPLE_CERT: ${{ secrets.APPLE_CERT }} | |
| APPLE_CERT_PASS: ${{ secrets.APPLE_CERT_PASS }} | |
| # 5) Create .app folder and copy Info.plist from the repo | |
| - name: Create .app bundle | |
| run: | | |
| mkdir -p QuickPass.app/Contents/MacOS | |
| cp target/release/QuickPass QuickPass.app/Contents/MacOS/ | |
| # Copy the Info.plist from your repo | |
| cp .github/workflows/Info.plist QuickPass.app/Contents/Info.plist | |
| # Create the Resources folder and copy icon.icns | |
| mkdir -p QuickPass.app/Contents/Resources | |
| cp .github/workflows/icon.icns QuickPass.app/Contents/Resources/icon.icns | |
| # 6) Code sign .app (no --deep) | |
| - name: Code Sign .app | |
| run: | | |
| codesign --force --options runtime \ | |
| --sign "Developer ID Application: Jacob Kanfer (M7SN262HK4)" \ | |
| QuickPass.app | |
| # 7) Debug-check the signed .app | |
| - name: Debug Signed .app | |
| run: | | |
| echo "=== codesign -dv --verbose=4 ===" | |
| codesign -dv --verbose=4 QuickPass.app | |
| echo "=== spctl -a -vvv QuickPass.app ===" | |
| spctl -a -vvv QuickPass.app || true | |
| # 8) Make .dmg using HFS+ (skip code signing the .dmg) | |
| - name: Create .dmg | |
| run: | | |
| mv QuickPass.app target/release/ | |
| cd target/release | |
| mkdir QuickPassDmgContent | |
| mv QuickPass.app QuickPassDmgContent/ | |
| hdiutil create QuickPass.dmg \ | |
| -volname "QuickPass" \ | |
| -srcfolder "QuickPassDmgContent" \ | |
| -fs HFS+ \ | |
| -ov | |
| # 9) Notarize the .dmg, capturing logs | |
| - name: Notarize .dmg | |
| if: env.APPLE_APP_SPECIFIC_PASSWORD | |
| run: | | |
| cd target/release | |
| xcrun notarytool submit QuickPass.dmg \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --password "$APPLE_APP_SPECIFIC_PASSWORD" \ | |
| --wait 2>&1 | tee notarytool-submit.txt | |
| echo "=== Submission raw output: ===" | |
| cat notarytool-submit.txt | |
| SUBMISSION_ID=$(grep '^ id:' notarytool-submit.txt | head -n1 | sed 's/.*id: //') | |
| echo "Extracted SUBMISSION_ID=${SUBMISSION_ID}" | |
| STATUS=$(grep 'status:' notarytool-submit.txt | tail -n1 | sed 's/.*status: //') | |
| echo "Extracted Notary Status=$STATUS" | |
| if [ "$STATUS" = "Accepted" ]; then | |
| echo "Stapling .dmg..." | |
| xcrun stapler staple QuickPass.dmg | |
| else | |
| echo "Notarization invalid. Fetching logs with SUBMISSION_ID=${SUBMISSION_ID}..." | |
| xcrun notarytool log "$SUBMISSION_ID" \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --password "$APPLE_APP_SPECIFIC_PASSWORD" \ | |
| 2>&1 | tee notarytool-log.txt | |
| echo "=== Detailed Notary Log: ===" | |
| cat notarytool-log.txt | |
| exit 1 | |
| fi | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| # 10) Upload final .dmg | |
| - name: Upload notarized .dmg | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: QuickPass-macOS-dmg | |
| path: target/release/QuickPass.dmg | |
| overwrite: true |