detached-sig-create.sh raw

   1  #!/bin/sh
   2  # Copyright (c) 2014-present The Bitcoin Core developers
   3  # Distributed under the MIT software license, see the accompanying
   4  # file COPYING or http://www.opensource.org/licenses/mit-license.php.
   5  
   6  export LC_ALL=C
   7  set -e
   8  
   9  SIGNAPPLE=signapple
  10  TEMPDIR=sign.temp
  11  
  12  BUNDLE_ROOT=dist
  13  BUNDLE_NAME="Bitcoin-Qt.app"
  14  UNSIGNED_BUNDLE="${BUNDLE_ROOT}/${BUNDLE_NAME}"
  15  UNSIGNED_BINARY="${UNSIGNED_BUNDLE}/Contents/MacOS/Bitcoin-Qt"
  16  
  17  ARCH=$(${SIGNAPPLE} info ${UNSIGNED_BINARY} | head -n 1 | cut -d " " -f 1)
  18  
  19  OUTDIR="osx/${ARCH}-apple-darwin"
  20  OUTROOT="${TEMPDIR}/${OUTDIR}"
  21  
  22  OUT="signature-osx-${ARCH}.tar.gz"
  23  
  24  if [ "$#" -ne 3 ]; then
  25    echo "usage: $0 <path to key> <path to app store connect key> <apple developer team uuid>"
  26    exit 1
  27  fi
  28  
  29  rm -rf ${TEMPDIR}
  30  mkdir -p ${TEMPDIR}
  31  
  32  stty -echo
  33  printf "Enter the passphrase for %s: " "$1"
  34  read cs_key_pass
  35  printf "\n"
  36  printf "Enter the passphrase for %s: " "$2"
  37  read api_key_pass
  38  printf "\n"
  39  stty echo
  40  
  41  # Sign and notarize app bundle
  42  ${SIGNAPPLE} sign -f --hardened-runtime --detach "${OUTROOT}/${BUNDLE_ROOT}" --passphrase "${cs_key_pass}" "$1" "${UNSIGNED_BUNDLE}"
  43  ${SIGNAPPLE} apply "${UNSIGNED_BUNDLE}" "${OUTROOT}/${BUNDLE_ROOT}/${BUNDLE_NAME}"
  44  ${SIGNAPPLE} notarize --detach "${OUTROOT}/${BUNDLE_ROOT}" --passphrase "${api_key_pass}" "$2" "$3" "${UNSIGNED_BUNDLE}"
  45  
  46  # Sign each binary
  47  find . -maxdepth 3 \( -wholename "*/bin/*" -o -wholename "*/libexec/*" \) -type f -exec realpath --relative-to=. {} \; | while read -r bin
  48  do
  49      bin_dir=$(dirname "${bin}")
  50      bin_name=$(basename "${bin}")
  51      ${SIGNAPPLE} sign -f --hardened-runtime --detach "${OUTROOT}/${bin_dir}" --passphrase "${cs_key_pass}" "$1" "${bin}"
  52      ${SIGNAPPLE} apply "${bin}" "${OUTROOT}/${bin_dir}/${bin_name}.${ARCH}sign"
  53  done
  54  
  55  # Notarize the binaries
  56  # Binaries cannot have stapled notarizations so this does not actually generate any output
  57  binaries_dir=$(dirname "$(find . -maxdepth 2 -wholename '*/bin' -type d -exec realpath --relative-to=. {} \;)")
  58  ${SIGNAPPLE} notarize --passphrase "${api_key_pass}" "$2" "$3" "${binaries_dir}"
  59  
  60  tar -C "${TEMPDIR}" -czf "${OUT}" "${OUTDIR}"
  61  rm -rf "${TEMPDIR}"
  62  echo "Created ${OUT}"
  63