Skip to content

Sign + notarize macOS forkpress binaries in BK #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mokagio wants to merge 3 commits into
base: mokagio/buildkite-ci-skeleton
Choose a base branch
from
Draft

Sign + notarize macOS forkpress binaries in BK #385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
06ea5e7
Sign + notarize macOS forkpress binaries in BK
mokagio May 19, 2026
2d47ae6
Move codesign + notarize into fastlane lanes
mokagio May 19, 2026
76830c7
DRY mac BK fastlane setup into a sourced helper
mokagio May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .buildkite/commands/_lib/setup-fastlane.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Resolve fastlane gem deps and install the Automattic Developer ID
# Application cert into a temp keychain via the `set_up_signing` lane.
#
# Usage:
# source .buildkite/commands/_lib/setup-fastlane.sh

echo "--- :fastlane: bundle install + cert install"
bundle install
bundle exec fastlane set_up_signing
11 changes: 11 additions & 0 deletions .buildkite/commands/mac-aarch64-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,16 @@ FORKPRESS_TARGET="$TARGET" scripts/build-dist.sh
echo "--- :crab: cargo build --release forkpress ($TARGET)"
cargo build --release --target "$TARGET" -p forkpress-cli --bin forkpress --locked

# shellcheck source=_lib/setup-fastlane.sh
source "$(dirname "$0")/_lib/setup-fastlane.sh"

# Sign before the e2e so the test exercises the same hardened-runtime
# binary the artifact upload ships.
echo "--- :lock: Codesigning forkpress ($TARGET)"
bundle exec fastlane sign_binary binary:"target/$TARGET/release/forkpress"

echo "--- :cow: COW strategy e2e (APFS sparsebundle)"
FORKPRESS_FORCE_MACOS_APFS_SPARSEBUNDLE=1 tests/cow/e2e.sh "target/$TARGET/release/forkpress"

echo "--- :apple: Notarizing forkpress ($TARGET)"
bundle exec fastlane notarize_binary binary:"target/$TARGET/release/forkpress"
10 changes: 10 additions & 0 deletions .buildkite/commands/mac-x86_64-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,13 @@ FORKPRESS_RUNTIME_BUNDLE=/dev/null cargo build --release --target "$TARGET" -p f

ls -lh "target/$TARGET/release/forkpress"
file "target/$TARGET/release/forkpress" || true

# shellcheck source=_lib/setup-fastlane.sh
source "$(dirname "$0")/_lib/setup-fastlane.sh"

# Sign as a smoke check on the codesign chain, but skip notarization —
# this binary has no embedded runtime (built with FORKPRESS_RUNTIME_BUNDLE=
# /dev/null above) and is unrunnable, so notarizing it would waste the
# notary API quota on a non-shippable artifact.
echo "--- :lock: Codesigning forkpress ($TARGET)"
bundle exec fastlane sign_binary binary:"target/$TARGET/release/forkpress"
6 changes: 6 additions & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# frozen_string_literal: true

source 'https://rubygems.org'

gem 'fastlane', '~> 2.233'
gem 'fastlane-plugin-wpmreleasetoolkit', '~> 14.4'
Loading
Loading