Notarize the GitX app by insha · Pull Request #334 · gitx/gitx

insha · 2022-09-16T20:34:43Z

Changes include:

Hardened Runtime entitlement has been added to all targets
BuildPR workflow has been updated to include step to keychain prep with certificate and provisioning profile, archive, export, and notarize the resulting binary.

💡 Author's Note
This is a work in progress and will need testing and fine tuning. All secrets have been added to the repository using GitHub Secrets and used by the action workflow. Please do leave feedback, if any, thank you.

Changes include: - Hardened Runtime entitlement has been added to all targets - BuildPR workflow has been updated to include step to keychain prep with certificate and provisioning profile, archive, export, and notarize the resulting binary.

hannesa2

Nice, even the verify of the notarization shows me an "accepted"

It looks good to me, any improvement can be done later too

hannesa2 · 2022-09-18T16:16:45Z

.github/workflows/BuildPR.yml

+          xcrun stapler staple "$APP_PATH"
+          ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+      - name: Check Notarization
+        run: spctl -a -vv GitX.app


I added this verify of the notarization

hannesa2 · 2022-09-18T16:28:49Z

Thanks a lot of your generous help here @insha

hannesa2 · 2022-09-18T16:51:30Z

Unfortunately we only notarize the pull request pipeline, and forgot the release. I will drop the release and recreate it again

insha · 2022-09-18T17:19:20Z

Indeed. I figured once the PR workflow was working the release workflow would follow since the GitHub actions steps would be the same. Also do we need the notary steps for the PR flow?

…

On Sep 18, 2022, at 11:51 AM, Hannes Achleitner ***@***.***> wrote: Unfortunately we only notarize the pull request pipeline, and forgot the release. I will drop the release and recreate it again — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

hannesa2 · 2022-09-18T17:36:36Z

Also do we need the notary steps for the PR flow?

I already did it

insha · 2022-09-18T18:11:06Z

You are awesome 🙌. Thank you 👍

…

On Sep 18, 2022, at 12:36 PM, Hannes Achleitner ***@***.***> wrote: Also do we need the notary steps for the PR flow? I already did it — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

hannesa2 · 2022-09-19T14:12:36Z

.github/workflows/BuildPR.yml

+        env:
+          EXPORT_OPTIONS: ${{ secrets.NOTARY_EXPORT_OPTIONS }}
        run: |
-          mv GitX.xcarchive/Products/Applications/GitX.app .


it's about #337 and #336
@insha Before we move GitX.xcarchive/Products/Applications/GitX.app to root .

hannesa2 · 2022-09-19T14:13:57Z

.github/workflows/BuildPR.yml

        run: cd External/objective-git && script/bootstrap && script/update_libgit2 && cd ../..
      - name: Build project
-        run: xcodebuild -workspace GitX.xcworkspace -scheme GitX -archivePath ./GitX archive ARCHS="${{ matrix.abi }}"
+        run: xcodebuild -workspace GitX.xcworkspace -scheme GitX -archivePath ./GitX archive ARCHS="${{ matrix.abi }}" PRODUCT_BUNDLE_IDENTIFIER=${{ secrets.NOTARY_BUNDLE_IDENTIFIER}}


@insha can it be this secrets.NOTARY_BUNDLE_IDENTIFIER can have a relation to this meaning identifier net.phere.GitX ?

hannesa2 · 2022-09-19T14:14:59Z

.github/workflows/BuildPR.yml

+
+          echo -n "$EXPORT_OPTIONS" > EXPORT_OPTIONS_PATH
+
+          xcodebuild -exportArchive -archivePath GitX.xcarchive -exportPath . -exportOptionsPlist EXPORT_OPTIONS_PATH


Now we create a new archive and using this. Not sure if this is an issue

insha · 2022-09-19T21:37:02Z

Yes, the issue with #336 and #337 is caused by the bundle identifier that used for the scripting bridge and the one that is assigned for notarizing the app. I mentioned this in a reply [here](#336 (comment)). The `gitx` client need to use the bundle identifier that is used for notarizing the app. Note that the only place where this change is needed is in the `GitXScriptingConstants.h` file; but haven’t had a chance to test it.

…

On Sep 19, 2022, at 9:15 AM, Hannes Achleitner ***@***.***> wrote: @hannesa2 commented on this pull request. In .github/workflows/BuildPR.yml: > run: | - mv GitX.xcarchive/Products/Applications/GitX.app . it's about #337 and #336 @insha Before we move GitX.xcarchive/Products/Applications/GitX.app to root . In .github/workflows/BuildPR.yml: > - name: pre build run: cd External/objective-git && script/bootstrap && script/update_libgit2 && cd ../.. - name: Build project - run: xcodebuild -workspace GitX.xcworkspace -scheme GitX -archivePath ./GitX archive ARCHS="${{ matrix.abi }}" + run: xcodebuild -workspace GitX.xcworkspace -scheme GitX -archivePath ./GitX archive ARCHS="${{ matrix.abi }}" PRODUCT_BUNDLE_IDENTIFIER=${{ secrets.NOTARY_BUNDLE_IDENTIFIER}} @insha can it be this secrets.NOTARY_BUNDLE_IDENTIFIER can have a relation to this meaning identifier net.phere.GitX ? In .github/workflows/BuildPR.yml: > run: | - mv GitX.xcarchive/Products/Applications/GitX.app . + EXPORT_OPTIONS_PATH=$RUNNER_TEMP/ExportOptions.plist + + echo -n "$EXPORT_OPTIONS" > EXPORT_OPTIONS_PATH + + xcodebuild -exportArchive -archivePath GitX.xcarchive -exportPath . -exportOptionsPlist EXPORT_OPTIONS_PATH Now we create a new archive and using this. Not sure if this is an issue — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

hannesa2 · 2022-09-20T04:35:44Z

This sounds promising.

To clarify this secrets.NOTARY_BUNDLE_IDENTIFIER :
Which one do you used for notarizing to be clear what I should use in kGitXBundleIdentifier in the GitXScriptingConstants.h ?

insha · 2022-09-20T05:06:02Z

The bundle identifier that is used for the notarization is `com.themacronaut.net.phere.GitX`. This should be the value of the `kGitXBundleIdentifier` in the `GitXScriptingConstants.h` file when the build is created using the `Release`. Meaning, you may get better mileage by wrapping it in the `#ifndef DEBUG …`; but you can just set it to the above identifier and make a build and see if it works and then refactor to allow for conditional use.

…

On Sep 19, 2022, at 11:35 PM, Hannes Achleitner ***@***.***> wrote: This sounds promising. To clarify this secrets.NOTARY_BUNDLE_IDENTIFIER : Which one do you used for notarizing to be clear what I should use in kGitXBundleIdentifier in the GitXScriptingConstants.h ? — Reply to this email directly, view it on GitHub <#334 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJP653L7AZH2MC5MOA5FGDV7E5KVANCNFSM6AAAAAAQOUUZ3A>. You are receiving this because you were mentioned.

ADTC · 2023-02-25T07:13:14Z

@insha can you please check why PR builds are failing?

ADTC · 2023-02-25T08:39:22Z

@hannesa2 It looks like the environment variables from the GitHub Actions secrets are coming up as empty.

These secrets would be shown masked with asterisks, not removed completely, as you can see from this old build log.

Can you please check the settings?

ADTC · 2023-02-25T15:27:53Z

Quick update: The secrets and variables for actions are not passed to workflows that are triggered by a pull request from a fork (using pull_request event).

From GitHub documentation (suggested by this comment), I'm gathering three ideas on how to resolve this:

~~Use the pull_request_target event instead to run the workflow in the context of the PR's base. Apparently this event type will have access to secrets.~~ This won't work because the base context will not contain the changes in the PR.
Use two workflows, first with pull_request that does nothing, and a second with workflow_run which runs when the first one has completed. Apparently, the second workflow will have access to secrets. This won't work because it can only run from the default branch.
Have a separate workflow for pull_request event which doesn't make use of any secret. In our case, it means it shouldn't attempt to notarize the build. It should just do a normal build without any Apple certificate or notarization (which isn't required for a PR build anyway).

Pull requests opened from forks will not have access to secrets and variables. We don't need to notarize builds on the master branch or on pull requests. Only the builds from BuildRelease workflow file need to be notarized before making a release.

hannesa2 · 2023-02-25T20:58:17Z

The variables are all there and all is fine concerning this

ADTC · 2023-02-25T21:04:49Z

That's good to know. But they can't be accessed in a forked PR for security reasons. It's a GitHub limitation to safeguard against leaks. That's why the PRs must build without needing any secret. Anyway we don't need to notarize builds in PR. We just need to know that the builds are successful.

hannesa2 · 2023-02-25T21:09:58Z

Please see my recommendation #365 (review)

hannesa2 · 2024-01-13T07:52:48Z

.github/workflows/BuildPR.yml

+        run: xcodebuild -workspace GitX.xcworkspace -scheme GitX -archivePath ./GitX archive ARCHS="${{ matrix.abi }}" PRODUCT_BUNDLE_IDENTIFIER=${{ secrets.NOTARY_BUNDLE_IDENTIFIER}}
      - name: Prepare artifact
+        env:
+          EXPORT_OPTIONS: ${{ secrets.NOTARY_EXPORT_OPTIONS }}


@insha
I try to do the same on an other project, but I've no clue what's the content of NOTARY_EXPORT_OPTIONS is.
I guess it's not a secret, am I right ?
If yes, please can you write me the content of it ?

@hannesa2 Apologies for the delayed response. The value of this secret variable is the contents of the export options plist file. It is in secrets because it contains my Apple Team ID. The contents are as follows with my team ID redacted:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>destination</key> <string>export</string> <key>method</key> <string>developer-id</string> <key>provisioningProfiles</key> <dict> <key>com.themacronaut.net.phere.GitX</key> <string>GitX Notarized Distribution</string> </dict> <key>signingCertificate</key> <string>Developer ID Application</string> <key>signingStyle</key> <string>manual</string> <key>teamID</key> <string>---REDACTED---</string> </dict> </plist>

You mean to say the entire XML content is put inside an environment variable? 🤔

Yes, from what I recall, that is correct. The reason being that the plist files has sensitive information in it.

insha requested review from claytonrcarter and hannesa2 September 16, 2022 20:34

insha force-pushed the feature/Apple-Notary-Submission branch 4 times, most recently from cb671fd to 3c297b7 Compare September 16, 2022 20:57

Adding notarization steps to the CI pipeline

726339f

Changes include: - Hardened Runtime entitlement has been added to all targets - BuildPR workflow has been updated to include step to keychain prep with certificate and provisioning profile, archive, export, and notarize the resulting binary.

insha force-pushed the feature/Apple-Notary-Submission branch from 3c297b7 to 726339f Compare September 16, 2022 21:20

insha added enhancement WIP Work in progress labels Sep 16, 2022

hannesa2 removed the WIP Work in progress label Sep 18, 2022

Check notarization

ef79590

hannesa2 force-pushed the feature/Apple-Notary-Submission branch from dc8185c to ef79590 Compare September 18, 2022 16:14

hannesa2 approved these changes Sep 18, 2022

View reviewed changes

hannesa2 changed the title ~~WIP: Adding notarization steps to the CI pipeline~~ Notarizate the GitX app Sep 18, 2022

hannesa2 mentioned this pull request Sep 18, 2022

Sparkle is not working #279

Open

hannesa2 merged commit 7cc0658 into master Sep 18, 2022

hannesa2 deleted the feature/Apple-Notary-Submission branch September 18, 2022 16:28

hannesa2 changed the title ~~Notarizate the GitX app~~ Notarize the GitX app Sep 18, 2022

hannesa2 reviewed Sep 19, 2022

View reviewed changes

hannesa2 mentioned this pull request Sep 19, 2022

Can't use gitx command line using latest version #338

Closed

ADTC mentioned this pull request Feb 25, 2023

Improve the build & installation instructions #364

Merged

ADTC mentioned this pull request Feb 25, 2023

Revert changes from #334 on BuildPR workflow file #365

Closed

hannesa2 reviewed Jan 13, 2024

View reviewed changes


		echo -n "$EXPORT_OPTIONS" > EXPORT_OPTIONS_PATH

		xcodebuild -exportArchive -archivePath GitX.xcarchive -exportPath . -exportOptionsPlist EXPORT_OPTIONS_PATH

Conversation

insha commented Sep 16, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hannesa2 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hannesa2 commented Sep 18, 2022

Uh oh!

hannesa2 commented Sep 18, 2022

Uh oh!

insha commented Sep 18, 2022 via email

Uh oh!

hannesa2 commented Sep 18, 2022

Uh oh!

insha commented Sep 18, 2022 via email

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

insha commented Sep 19, 2022 via email

Uh oh!

hannesa2 commented Sep 20, 2022

Uh oh!

insha commented Sep 20, 2022 via email

Uh oh!

ADTC commented Feb 25, 2023

Uh oh!

ADTC commented Feb 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ADTC commented Feb 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hannesa2 commented Feb 25, 2023

Uh oh!

ADTC commented Feb 25, 2023

Uh oh!

hannesa2 commented Feb 25, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

insha commented Sep 16, 2022 •

edited

Loading

ADTC commented Feb 25, 2023 •

edited

Loading

ADTC commented Feb 25, 2023 •

edited

Loading