Skip to content

Commit f0f04ae

Browse files
timon-schellingtimon-schelling
committed
TEST
1 parent ea9a48f commit f0f04ae

File tree

4 files changed

+155
-203
lines changed

4 files changed

+155
-203
lines changed

‎.github/workflows/build-mac-bundle-sign-test.yml‎

Lines changed: 0 additions & 96 deletions
This file was deleted.

‎.github/workflows/build-mac-bundle.yml‎

Lines changed: 73 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
name: Build Mac Bundle
22

33
on:
4-
workflow_dispatch: {}
5-
# push:
4+
push:
5+
branches:
6+
- desktop-builds-mac-and-windows-in-ci
67

78
jobs:
89
build:
@@ -79,3 +80,73 @@ jobs:
7980
with:
8081
name: graphite-mac-bundle
8182
path: target/artifacts
83+
84+
- name: Signing Preparation
85+
env:
86+
APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
87+
APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
88+
run: |
89+
echo "$APPLE_CERT_BASE64" | base64 --decode > .sign/certificate.p12
90+
91+
security create-keychain -p "" .sign/main.keychain
92+
security default-keychain -s .sign/main.keychain
93+
security unlock-keychain -p "" .sign/main.keychain
94+
security set-keychain-settings -t 3600 -u .sign/main.keychain
95+
96+
security import .sign/certificate.p12 -k .sign/main.keychain -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
97+
security set-key-partition-list -S apple-tool:,apple: -s -k "" .sign/main.keychain
98+
99+
- name: Sign and Notarize Mac Bundle
100+
env:
101+
APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }}
102+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
103+
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
104+
APPLE_CERT_NAME: ${{ secrets.APPLE_CERT_NAME }}
105+
run: |
106+
cat > .sign/entitlements.plist <<'EOF'
107+
<?xml version="1.0" encoding="UTF-8"?>
108+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
109+
<plist version="1.0">
110+
<dict>
111+
<key>com.apple.security.cs.allow-jit</key>
112+
<true/>
113+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
114+
<true/>
115+
<key>com.apple.security.cs.disable-executable-page-protection</key>
116+
<true/>
117+
<key>com.apple.security.cs.disable-library-validation</key>
118+
<true/>
119+
</dict>
120+
</plist>
121+
EOF
122+
123+
CERTIFICATE="$APPLE_CERT_NAME"
124+
ENTITLEMENTS=".sign/entitlements.plist"
125+
APP_PATH="target/artifacts/Graphite.app"
126+
ZIP_PATH=".sign/Graphite.zip"
127+
128+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper.app"
129+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (GPU).app"
130+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (Renderer).app"
131+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework"
132+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib"
133+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libEGL.dylib"
134+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libGLESv2.dylib"
135+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libvk_swiftshader.dylib"
136+
codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH" --deep
137+
138+
codesign --verify --deep --strict --verbose=4 "$APP_PATH"
139+
140+
ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
141+
xcrun notarytool submit "$ZIP_PATH" --wait --apple-id "$APPLE_EMAIL" --team-id "$APPLE_TEAM_ID" --password "$APPLE_PASSWORD"
142+
rm "$ZIP_PATH"
143+
144+
xcrun stapler staple -v "$APP_PATH"
145+
146+
spctl -a -vv "$APP_PATH"
147+
148+
- name: Upload Mac Bundle Signed
149+
uses: actions/upload-artifact@v4
150+
with:
151+
name: graphite-mac-bundle-signed
152+
path: target/artifacts

‎.github/workflows/build-win-bundle-sign-test.yml‎

Lines changed: 0 additions & 103 deletions
This file was deleted.

‎.github/workflows/build-win-bundle.yml‎

Lines changed: 82 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
name: Build Windows Bundle
22

33
on:
4-
workflow_dispatch: {}
5-
# push:
4+
push:
5+
branches:
6+
- desktop-builds-mac-and-windows-in-ci
67

78
jobs:
89
build:
@@ -80,3 +81,82 @@ jobs:
8081
with:
8182
name: graphite-windows-bundle
8283
path: target/artifacts
84+
85+
- name: Azure login
86+
uses: azure/login@v1
87+
with:
88+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
89+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
90+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
91+
enable-AzPSSession: true
92+
93+
- name: Sign
94+
uses: azure/artifact-signing-action@v1
95+
with:
96+
endpoint: https://eus.codesigning.azure.net/
97+
signing-account-name: Graphite
98+
certificate-profile-name: Graphite
99+
files: |
100+
${{ github.workspace }}\target\artifacts\Graphite\Graphite.exe
101+
${{ github.workspace }}\target\artifacts\Graphite\libcef.dll
102+
${{ github.workspace }}\target\artifacts\Graphite\chrome_elf.dll
103+
${{ github.workspace }}\target\artifacts\Graphite\vulkan-1.dll
104+
${{ github.workspace }}\target\artifacts\Graphite\dxcompiler.dll
105+
${{ github.workspace }}\target\artifacts\Graphite\libEGL.dll
106+
${{ github.workspace }}\target\artifacts\Graphite\libGLESv2.dll
107+
${{ github.workspace }}\target\artifacts\Graphite\vk_swiftshader.dll
108+
file-digest: SHA256
109+
timestamp-rfc3161: http://timestamp.acs.microsoft.com
110+
timestamp-digest: SHA256
111+
correlation-id: ${{ github.sha }}
112+
- name: Verify Signatures
113+
shell: pwsh
114+
run: |
115+
$ErrorActionPreference = "Stop"
116+
117+
$TargetDir = "target\artifacts\Graphite"
118+
119+
if (-not (Test-Path $TargetDir)) {
120+
throw "TargetDir not found: $TargetDir"
121+
}
122+
123+
$UnsignedOrBad = @()
124+
125+
Get-ChildItem -Path $TargetDir -Recurse -File -Include *.exe,*.dll | ForEach-Object {
126+
$sig = Get-AuthenticodeSignature -FilePath $_.FullName
127+
128+
if ($sig.Status -ne 'Valid') {
129+
$UnsignedOrBad += "$($_.FullName) (Status=$($sig.Status))"
130+
}
131+
}
132+
133+
if ($UnsignedOrBad.Count -gt 0) {
134+
Write-Host "Unsigned or invalid binaries detected:"
135+
$UnsignedOrBad | ForEach-Object {
136+
Write-Host "::error::$_"
137+
}
138+
139+
if ($env:GITHUB_STEP_SUMMARY) {
140+
"## ❌ Unsigned or invalid binaries detected" |
141+
Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
142+
"" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
143+
$UnsignedOrBad | ForEach-Object {
144+
"* `$_" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
145+
}
146+
}
147+
148+
exit 1
149+
}
150+
151+
Write-Host "All binaries are signed and valid."
152+
153+
if ($env:GITHUB_STEP_SUMMARY) {
154+
"## ✅ All binaries are signed and valid" |
155+
Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
156+
}
157+
158+
- name: Upload Windows Bundle Signed
159+
uses: actions/upload-artifact@v4
160+
with:
161+
name: graphite-windows-bundle-signed
162+
path: target/artifacts

0 commit comments

Comments
 (0)