77 lines
2.7 KiB
Bash
Executable File
77 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
source "$ROOT_DIR/scripts/atlas/signing-common.sh"
|
|
|
|
APP_IDENTITY_OVERRIDE="${ATLAS_CODESIGN_IDENTITY:-}"
|
|
INSTALLER_IDENTITY_OVERRIDE="${ATLAS_INSTALLER_SIGN_IDENTITY:-}"
|
|
NOTARY_PROFILE_OVERRIDE="${ATLAS_NOTARY_PROFILE:-}"
|
|
|
|
codesign_output="$(security find-identity -v -p codesigning 2>/dev/null || true)"
|
|
basic_output="$(security find-identity -v -p basic 2>/dev/null || true)"
|
|
|
|
app_identity_detected="$(printf '%s\n' "$codesign_output" | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -1)"
|
|
installer_identity_detected="$(printf '%s\n' "$basic_output" | sed -n 's/.*"\(Developer ID Installer:.*\)"/\1/p' | head -1)"
|
|
|
|
app_identity="${APP_IDENTITY_OVERRIDE:-$app_identity_detected}"
|
|
installer_identity="${INSTALLER_IDENTITY_OVERRIDE:-$installer_identity_detected}"
|
|
local_identity=""
|
|
if atlas_local_identity_exists; then
|
|
local_identity="$(atlas_local_signing_identity_name)"
|
|
fi
|
|
|
|
printf 'Atlas signing preflight\n'
|
|
printf '======================\n'
|
|
printf 'Developer ID Application: %s\n' "${app_identity:-MISSING}"
|
|
printf 'Developer ID Installer: %s\n' "${installer_identity:-MISSING}"
|
|
printf 'Notary profile: %s\n' "${NOTARY_PROFILE_OVERRIDE:-MISSING}"
|
|
if [[ -n "$local_identity" ]]; then
|
|
printf 'Stable local app identity: %s\n' "$local_identity"
|
|
else
|
|
printf 'Stable local app identity: MISSING\n'
|
|
fi
|
|
|
|
status=0
|
|
if [[ -z "$app_identity" ]]; then
|
|
echo '✗ Missing Developer ID Application identity'
|
|
status=1
|
|
fi
|
|
if [[ -z "$installer_identity" ]]; then
|
|
echo '✗ Missing Developer ID Installer identity'
|
|
status=1
|
|
fi
|
|
if [[ -z "$NOTARY_PROFILE_OVERRIDE" ]]; then
|
|
echo '✗ Missing notarytool keychain profile name in ATLAS_NOTARY_PROFILE'
|
|
status=1
|
|
fi
|
|
|
|
if [[ -n "$NOTARY_PROFILE_OVERRIDE" ]]; then
|
|
if xcrun notarytool history --keychain-profile "$NOTARY_PROFILE_OVERRIDE" >/dev/null 2>&1; then
|
|
echo '✓ notarytool profile is usable'
|
|
else
|
|
echo '✗ notarytool profile could not be validated'
|
|
status=1
|
|
fi
|
|
fi
|
|
|
|
if [[ $status -eq 0 ]]; then
|
|
echo '✓ Release signing prerequisites are present'
|
|
echo "export ATLAS_CODESIGN_IDENTITY='$app_identity'"
|
|
echo "export ATLAS_INSTALLER_SIGN_IDENTITY='$installer_identity'"
|
|
echo "export ATLAS_NOTARY_PROFILE='$NOTARY_PROFILE_OVERRIDE'"
|
|
else
|
|
echo
|
|
echo 'To unblock signed/notarized release packaging, provide or install:'
|
|
echo ' 1. Developer ID Application certificate'
|
|
echo ' 2. Developer ID Installer certificate'
|
|
echo ' 3. notarytool keychain profile name via ATLAS_NOTARY_PROFILE'
|
|
if [[ -z "$local_identity" ]]; then
|
|
echo
|
|
echo 'For stable local TCC-friendly builds without Apple release credentials, run:'
|
|
echo ' ./scripts/atlas/ensure-local-signing-identity.sh'
|
|
fi
|
|
fi
|
|
|
|
exit $status
|