Skip to content

fix notarizing code #277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 7, 2024
Merged

fix notarizing code #277

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2d67be7
use correct go version, and use correct paths
nammn Mar 6, 2024
12f4f52
only trigger on git tags
nammn Mar 6, 2024
40d2327
first changelog release
nammn Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions .evergreen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
variables:

- &go_env
XDG_CONFIG_HOME: ${go_base_path}${workdir}
GO111MODULE: "on"
GOROOT: "/opt/golang/go1.21"
functions:

"clone":
Expand Down Expand Up @@ -42,24 +45,27 @@ functions:
type: setup
params:
working_dir: src/github.com/mongodb/mongodb-enterprise-kubernetes/tools/multicluster
add_to_path:
- src/github.com/mongodb/tools
- src/github.com/mongodb/tools/linux_amd64
include_expansions_in_env:
- GITHUB_TOKEN
- macos_notary_keyid
- macos_notary_secret
- workdir
- triggered_by_git_tag
Copy link
Collaborator Author

@nammn nammn Mar 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

${triggered_by_git_tag} is the name of the tag that triggered this version, if applicable

env:
<<: *go_env
MACOS_NOTARY_KEY: ${macos_notary_keyid}
MACOS_NOTARY_SECRET: ${macos_notary_secret}
GORELEASER_CURRENT_TAG: ${triggered_by_git_tag}
Copy link
Collaborator Author

@nammn nammn Mar 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just copy paste in what we had prior

# shell.exec EVG Task doesn't have add_to_path, so we need to explicitly add the path export below.
script: |
set -Eeu pipefail

${workdir}/goreleaser release

export PATH=$GOROOT/bin:$PATH
${workdir}/goreleaser release --rm-dist

tasks:
- name: package_goreleaser
git_tag_only: true
Copy link
Collaborator Author

@nammn nammn Mar 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

according to our evergreen setting page and this documentation: https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Project-and-Distro-Settings/#triggering-versions-with-git-tags this should suffice.

mms-build-account is part of the allowed users to create tags. So we will have the following release process:

  • mms-build-account creates a new release tag
  • evergreen picks that up and will run this tasks/variants
  • profit? 💸

tags: ["packaging"]
commands:
- func: "clone"
Expand Down
28 changes: 0 additions & 28 deletions .github/workflows/release-multicluster-cli.yaml
View file
Open in desktop

This file was deleted.

6 changes: 3 additions & 3 deletions tools/multicluster/kubectl_mac_notarize.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ set -Eeou pipefail
# This depends on binaries being generated in a goreleaser manner and gon being set up.
# goreleaser should already take care of calling this script as a hook.

if [[ -f "./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb" && -f "./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb" && ! -f "./dist/kubectl-mongodb_macos_signed.zip" ]]; then
if [[ -f "./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb" && -f "./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb" && ! -f "./dist/kubectl-mongodb_macos_signed.zip" ]]; then
echo "notarizing macOs binaries"
zip -r ./dist/kubectl-mongodb_amd64_arm64_bin.zip ./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb ./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb # The Notarization Service takes an archive as input
"${workdir:-.}"/linux_amd64/macnotary \
Expand All @@ -30,6 +30,6 @@ if [[ -f "./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb" && -f "./dist/kub
-o ./dist/kubectl-mongodb_macos_signed.zip

echo "replacing original files"
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/macos_darwin_amd64_v1/kubectl-mongodb -d ./dist/macos_darwin_amd64_v1/
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/macos_darwin_arm64/kubectl-mongodb -d ./dist/macos_darwin_arm64/
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_amd64_v1/
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_arm64/
fi