toki
e6feb735aa
- jenkins-thin-artifact-ci 마일스톤 계획 수립 - macos certified build 스크립트 및 테스트 업데이트 - docs/macos-certified-build.md 문서 갱신 - ci secrets setup 스크립트 추가
92 lines
2.5 KiB
Bash
Executable file
92 lines
2.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
TEAM_ID="${APPSOK_TEAM_ID:-AWA82DP9WD}"
|
|
IDENTITY="${APPSOK_SIGN_IDENTITY:-Developer ID Application: Dongmyung Lee ($TEAM_ID)}"
|
|
AGE_KEY="${APPSOK_SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/appsok-ci-key.txt}"
|
|
SECRET_FILE="${APPSOK_CI_SECRET_FILE:-secrets/appsok.ci.sops.json}"
|
|
|
|
export PATH="$HOME/SDK/flutter/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
|
|
|
|
cd "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
|
|
|
|
need() {
|
|
if ! command -v "$1" >/dev/null 2>&1; then
|
|
echo "missing command: $1" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
need codesign
|
|
need ditto
|
|
need flutter
|
|
need python3
|
|
need security
|
|
need shasum
|
|
need sops
|
|
need spctl
|
|
need xcrun
|
|
|
|
if [ ! -f "$AGE_KEY" ]; then
|
|
echo "missing SOPS age key: $AGE_KEY" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$SECRET_FILE" ]; then
|
|
echo "missing encrypted CI secret file: $SECRET_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
export SOPS_AGE_KEY_FILE="$AGE_KEY"
|
|
|
|
read_secret() {
|
|
local key="$1"
|
|
sops -d "$SECRET_FILE" | python3 -c "import json, sys; print(json.load(sys.stdin)['$key'])"
|
|
}
|
|
|
|
KEYCHAIN_PASSWORD="$(read_secret keychain_password)"
|
|
NOTARY_PROFILE="$(read_secret notary_profile)"
|
|
|
|
APP_PATH="build/macos/Build/Products/Release/AppSok.app"
|
|
ADB_PATH="$APP_PATH/Contents/Resources/adb-runtime/adb"
|
|
NOTARY_ZIP="build/macos/Build/Products/Release/AppSok-notary.zip"
|
|
FINAL_ZIP="build/macos/Build/Products/Release/AppSok-certified.zip"
|
|
FINAL_SHA256="$FINAL_ZIP.sha256"
|
|
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$HOME/Library/Keychains/login.keychain-db"
|
|
security set-keychain-settings -lut 21600 "$HOME/Library/Keychains/login.keychain-db"
|
|
security set-key-partition-list \
|
|
-S apple-tool:,apple:,codesign: \
|
|
-s \
|
|
-k "$KEYCHAIN_PASSWORD" \
|
|
"$HOME/Library/Keychains/login.keychain-db" >/dev/null
|
|
|
|
flutter pub get
|
|
flutter analyze
|
|
flutter test
|
|
flutter build macos
|
|
|
|
codesign --force --options runtime --timestamp --sign "$IDENTITY" "$ADB_PATH"
|
|
codesign --verify --strict --verbose=2 "$ADB_PATH"
|
|
|
|
codesign \
|
|
--force \
|
|
--deep \
|
|
--options runtime \
|
|
--timestamp \
|
|
--entitlements macos/Runner/Release.entitlements \
|
|
--sign "$IDENTITY" \
|
|
"$APP_PATH"
|
|
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
|
|
|
|
rm -f "$NOTARY_ZIP" "$FINAL_ZIP" "$FINAL_SHA256"
|
|
ditto -c -k --keepParent "$APP_PATH" "$NOTARY_ZIP"
|
|
|
|
xcrun notarytool submit "$NOTARY_ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
|
|
xcrun stapler staple -v "$APP_PATH"
|
|
spctl --assess --type execute --verbose=4 "$APP_PATH"
|
|
|
|
ditto -c -k --keepParent "$APP_PATH" "$FINAL_ZIP"
|
|
shasum -a 256 "$FINAL_ZIP" | tee "$FINAL_SHA256"
|
|
ls -lh "$FINAL_ZIP"
|
|
ls -lh "$FINAL_SHA256"
|