ci: Notarize MacOS Binaries and Add Flat Package Installers #3571

chipbuster · 2022-02-07T03:23:35Z

Description

This PR adds notarization, codesigning, and flat packages (.pkg) to our deploy workflow.

It also adds internal documentation for the procedure, since it was so stupidly complicated.

Motivation and Context

Closes #1774

Screenshots (if appropriate):

(Unfortunately, it looks like the logos don't show up in dark mode, for any flat installers)

How Has This Been Tested?

This was tested by using a dummy job (consisting of part of the github_build job from the deploy workflow) to build simulated build artifacts, then placing the new job after that as a dependent workflow.

There is no guarantee that this will work in the real deploy workflow, but I think this is the best that I can do.

To see the GitHub workflow that I (believe) verified that this was basically-working, see https://github.com/starship/starship/blob/c3932b327a2bec9e1e919f17cf4934e96cf9f1a8/.github/workflows/apple_deploy.yml.

To see the artifacts generated by that workflow, see https://github.com/starship/starship/actions/runs/1843775397 (will expire approximately at the end of Feb).

Checklist:

I have updated the documentation accordingly.
I have updated the tests accordingly.

chipbuster · 2022-02-14T22:44:48Z

I apologize for the somewhat horrific mess of commits involved here. There are interesting implications to only being able to test code by pushing.

davidkna · 2022-02-15T17:45:36Z

I'm getting a "starship cannot run because it is from an unidentified developer" prompt when running starship via starship-aarch64-apple-darwin.tar.gz from the linked workflow artifacts. Is that supposed to happen?

I think it might be to test the current version of the workflow with a workflow_dispatch trigger.

chipbuster · 2022-02-15T17:54:04Z

I'm getting a "starship cannot run because it is from an unidentified developer" prompt when running starship via starship-aarch64-apple-darwin.tar.gz from the linked workflow artifacts. Is that supposed to happen?

No, I don't think that's supposed to happen. In fact, I don't know why the workflow is generating these artifacts at all, since I'm not uploading them from the workflow.

However, it would probably be best to modify this action to re-upload the binaries, since I codesign them as part of this workflow, and I don't think Gatekeeper will attempt to verify notarization for unsigned binaries. (I was originally focused on getting signed .pkg files out, but it's probably good to distribute signed binaries as well while we're doing this work).

I think it might be to test the current version of the workflow with a workflow_dispatch trigger.

From my understanding, we can just keep the trigger permanently embedded this into the deploy workflow?

davidkna · 2022-02-15T17:57:03Z

From my understanding, we can just keep the trigger permanently embedded this into the deploy workflow?

I think so.

chipbuster · 2022-02-15T18:13:52Z

Okay. I'll need to do some thinking on how to best do this, since I think it's dangerous to allow all steps of the deploy workflow to fire on a test (in particular, things like pushing to the docs website and publishing to cargo on a test workflow seem dicey).

My current inclination is to do something like this:

If a version tag is present, fire all workflow jobs
Else, an input string is provided to specify which jobs in the workflow to fire
If public external state is modified by the job (e.g. cargo deploy, gh release), then both the string to specify this job and an additional string like "DEPLOY_OVERRIDE" must be provided in order to fire the job.

chipbuster · 2022-02-22T22:49:13Z

Rebased to get rid of some nasty shenanigans where my fork's master branch somehow picked up a bunch of unrelated PRs.

(Also to get rid of the 50+ commits which were starting to hurt when I looked at them).

matchai

Looks great (as a person with zero experience with signing and notarization)!
Thank you for taking on this huge task!!

matchai · 2022-02-27T16:36:15Z

.github/workflows/deploy.yml

+        P12_PASSWORD: ${{ secrets.APPLEDEV_SIGNKEY_PASS }}
+        KEYCHAIN_PASSWORD: ${{ secrets.APPLEDEV_SIGNKEY_PASS }}
+        APPLEID_USERNAME: ${{ secrets.APPLEDEV_ID_NAME }}
+        APPLEID_TEAMID: ${{ secrets.APPLEDEV_TEAM_ID }}


Out of curiosity, will this be signed as Starship or as you?
(Also, please please don't hesitate to expense this to our OpenCollective)

This is going to be signed by me. We can get signing certificates for at least one other mission control member as well, in case I get kidnapped by cephalopods or hit by a bus, but Apple has some rather high requirements for enrolling an organization: in particular, the organization needs to have legal entity status (be capable of sued) and a DUNS number.

Also, I believe the signing certificate I exported was due to expire in 2027, so if it happens in the next couple years, you should have quite a bit of time to work out a replacement :)

I'm not at my computer right now, but we may qualify as part of our Open Collective fiscal sponsorship, which qualifies us as a non-profit in the US, which may give us that legal status.

Oh interesting. If that's the case, I believe you would have to be the one to do the registration, since another requirement is

As the person enrolling your organization in the Apple Developer Program, you must have the legal authority to bind your organization to legal agreements. You must be the organization’s owner/founder, executive team member, senior project lead, or an employee with legal authority granted to you by a senior employee.

Once that's done though, I believe individuals should be able to acquire signing keys that work on behalf of the organization.

I don't believe that signing keys from an organization would fundamentally be any different than those from an individual (the organization ID + signing key IDs would have to change in the GH secrets, but that's about it) so switching over if we decide to go for an Apple Dev organization shouldn't be too much of an issue.

matchai · 2022-02-27T16:37:36Z

install/macos_packages/build_and_notarize.sh

+arch="$3"
+pkgname="${4:-}"
+
+if [[ ! -d "$starship_docs_dir/.vuepress/dist" ]]; then


matchai · 2022-02-27T16:45:15Z

install/macos_packages/build_component_package.sh

+mkdir -p "$pkgdir/usr/local/bin"
+cp "$starship_program_file" "$pkgdir/usr/local/bin/starship"
+
+# Now we get to make documentation! Vuepress was not designed to build locally


Oof. If it must be done! 🙃

Yeah, I was a little surprised that npm serve didn't actually yield an HTML hierarchy that could be scraped by wget. It seems to do the thing where you have a single line of JS which can be evaluated to generate the DOM for the real deal, but wget can't evaluate the JS, so it just pulls a single script.

matchai · 2022-02-27T16:48:32Z

install/macos_packages/readme.md

@@ -0,0 +1,262 @@
+# MacOS Codesigning Scripts


Absolutely love this documentation! 😍
Hopefully we won't need to refer to it too often 🤞

chipbuster · 2022-02-27T17:23:19Z

install/macos_packages/build_and_notarize.sh

+fi
+
+if [[ -z ${KEYCHAIN_FILENAME+x} ]]; then
+  error "Environmental variable KEYCHAIN_ENTRY must be set."


chipbuster · 2022-02-27T18:43:55Z

Results from a straight copy-paste of the current subsection of the deploy workflow can be found at https://github.com/starship/starship/actions/runs/1906861805 (with irrelevant artifacts deleted).

If someone could confirm that the binaries in the .tar.gz are notarized and the .pkg files are notarized, I think we'd be ready to merge.

Command to check notarization: spctl -a -vvv -t install <file>

williamwebb · 2022-02-27T18:58:25Z

If someone could confirm that the binaries in the .tar.gz are notarized and the .pkg files are notarized, I think we'd be ready to merge.

Command to check notarization: spctl -a -vvv -t install <file>

Both LGTM

davidkna · 2022-02-27T18:59:03Z

The binaries in the tar.gz file are reported as signed and notarized. The pkg are only reported as validly signed (but with a notarized Developer ID), but there's no warning when attempting to run it and the installed binary is reported as signed and notarized.

davidkna · 2022-02-27T19:03:47Z

Also, Finder still doesn't seem to like the binary files from the tar.gz files.

chipbuster · 2022-02-27T19:15:22Z

Also, Finder still doesn't seem to like the binary files from the tar.gz files.

What does it do? On my system it seems to display a terminal executable and that's about it

williamwebb · 2022-02-27T19:25:05Z

When attempting to run starship directly from finder you get,

Which I believe is because of this,

chipbuster · 2022-02-27T19:30:54Z

Oh I see. I'm not sure why, but I'm not getting that even when using the versions downloaded from the GH Action. Possibly because I codesigned something with an identical hash locally, so Gatekeeper is letting it through?

Did previous releases of starship have this issue? Not sure if there's much we can do about that at the moment since binaries still can't be stapled.

davidkna · 2022-02-27T19:42:50Z

Did previous releases of starship have this issue?

I don't think any past release got past gatekeeper.

Also, despite the missing stapling, Terminal.app will execute it without complaints. So it's probably fine.

chipbuster · 2022-02-27T20:00:25Z

Alright. I'd like to do one last set of tests on a clean slate Mac (my university has a few public access terminals that should work nicely) and if those all come up clean, I'll go ahead and merged this.

chipbuster · 2022-02-27T21:56:13Z

Unfortunately, I am unable to replicate these results on any Macs I tested, including school macs, which should (in principle) be running on the strictest policy possible. I don't know what's causing the difference, but all systems I tried reported that the new binaries and pkgs are notarized and David reports that the binaries run in the Terminal without problems, so I'm going to go ahead and declare that this is working and accept new issues to the contrary.

chipbuster · 2022-02-27T21:58:18Z

Thank you @davidkna, @matchai, @williamwebb, and @JaySoyer for ideas, verification, debugging, and review! This was a hell of a PR and I couldn't have gotten any of this done without your help.

chipbuster force-pushed the apple-notarize branch 2 times, most recently from 0bcff4f to f7a2afb Compare February 13, 2022 04:27

chipbuster marked this pull request as ready for review February 14, 2022 22:44

chipbuster requested a review from a team February 14, 2022 22:44

chipbuster changed the title ~~ci: Notarize MacOS Binaries~~ ci: Notarize MacOS Binaries and Add Flat Package Installers Feb 14, 2022

chipbuster force-pushed the apple-notarize branch 2 times, most recently from baf68fd to 8936794 Compare February 22, 2022 22:48

chipbuster mentioned this pull request Feb 25, 2022

ci: Make parts of deploy workflow testable #3659

Closed

chipbuster force-pushed the apple-notarize branch from 641fd75 to 2f5373d Compare February 27, 2022 05:26

ci: Notarize MacOS

2f5373d

matchai approved these changes Feb 27, 2022

View reviewed changes

chipbuster commented Feb 27, 2022

View reviewed changes

chipbuster added 2 commits February 27, 2022 12:08

Modify logging and documentation to be better

1c3f9ed

Make a copy of certain parts of the deploy workflow

b36f5b0

Delete testing workflow

355e9c1

chipbuster merged commit 955a0f7 into master Feb 27, 2022

chipbuster deleted the apple-notarize branch February 27, 2022 21:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Notarize MacOS Binaries and Add Flat Package Installers #3571

ci: Notarize MacOS Binaries and Add Flat Package Installers #3571

chipbuster commented Feb 7, 2022 •

edited

chipbuster commented Feb 14, 2022

davidkna commented Feb 15, 2022

chipbuster commented Feb 15, 2022 •

edited

davidkna commented Feb 15, 2022

chipbuster commented Feb 15, 2022

chipbuster commented Feb 22, 2022

matchai left a comment

matchai Feb 27, 2022 •

edited

chipbuster Feb 27, 2022

matchai Feb 27, 2022

chipbuster Feb 27, 2022

matchai Feb 27, 2022

matchai Feb 27, 2022

chipbuster Feb 27, 2022

matchai Feb 27, 2022

chipbuster Feb 27, 2022

chipbuster commented Feb 27, 2022

williamwebb commented Feb 27, 2022

davidkna commented Feb 27, 2022 •

edited

davidkna commented Feb 27, 2022

chipbuster commented Feb 27, 2022

williamwebb commented Feb 27, 2022

chipbuster commented Feb 27, 2022

davidkna commented Feb 27, 2022

chipbuster commented Feb 27, 2022

chipbuster commented Feb 27, 2022

chipbuster commented Feb 27, 2022

ci: Notarize MacOS Binaries and Add Flat Package Installers #3571

ci: Notarize MacOS Binaries and Add Flat Package Installers #3571

Conversation

chipbuster commented Feb 7, 2022 • edited

Description

Motivation and Context

Screenshots (if appropriate):

How Has This Been Tested?

Checklist:

chipbuster commented Feb 14, 2022

davidkna commented Feb 15, 2022

chipbuster commented Feb 15, 2022 • edited

davidkna commented Feb 15, 2022

chipbuster commented Feb 15, 2022

chipbuster commented Feb 22, 2022

matchai left a comment

Choose a reason for hiding this comment

matchai Feb 27, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chipbuster commented Feb 27, 2022

williamwebb commented Feb 27, 2022

davidkna commented Feb 27, 2022 • edited

davidkna commented Feb 27, 2022

chipbuster commented Feb 27, 2022

williamwebb commented Feb 27, 2022

chipbuster commented Feb 27, 2022

davidkna commented Feb 27, 2022

chipbuster commented Feb 27, 2022

chipbuster commented Feb 27, 2022

chipbuster commented Feb 27, 2022

chipbuster commented Feb 7, 2022 •

edited

chipbuster commented Feb 15, 2022 •

edited

matchai Feb 27, 2022 •

edited

davidkna commented Feb 27, 2022 •

edited