|
|
1
|
+#!/bin/bash
|
|
|
2
|
+set -e
|
|
|
3
|
+
|
|
|
4
|
+function exit_error {
|
|
|
5
|
+ for msg in "$@"
|
|
|
6
|
+ do
|
|
|
7
|
+ echo "$msg" >&2
|
|
|
8
|
+ done
|
|
|
9
|
+ exit 1
|
|
|
10
|
+}
|
|
|
11
|
+
|
|
|
12
|
+test $# -eq 2 || exit_error "Wrong number of arguments"
|
|
|
13
|
+dmg_file="$1"
|
|
|
14
|
+display_name="$2"
|
|
|
15
|
+
|
|
|
16
|
+output_file="/home/signing-macos/last-signed-$display_name.tar.zst"
|
|
|
17
|
+rm -f "$output_file"
|
|
|
18
|
+
|
|
|
19
|
+rcodesign=/signing/rcodesign-128/rcodesign
|
|
|
20
|
+rcodesign_signing_p12_file=/home/signing-macos/keys/key-1.p12
|
|
|
21
|
+test -f "$rcodesign_signing_p12_file" || exit_error "$rcodesign_signing_p12_file is missing"
|
|
|
22
|
+
|
|
|
23
|
+tmpdir=$(mktemp -d)
|
|
|
24
|
+trap "rm -Rf $tmpdir" EXIT
|
|
|
25
|
+cd "$tmpdir"
|
|
|
26
|
+7z x "$dmg_file"
|
|
|
27
|
+
|
|
|
28
|
+# Fix permission on files:
|
|
|
29
|
+# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2957050
|
|
|
30
|
+# FIXME: Maybe we should extract the .mar file instead of the .dmg to
|
|
|
31
|
+# preserve permissions
|
|
|
32
|
+chmod ugo+x "$display_name/$display_name.app/Contents/MacOS"/* \
|
|
|
33
|
+ "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/MacOS"/* \
|
|
|
34
|
+ "$display_name/$display_name.app/Contents/MacOS/plugin-container.app/Contents/MacOS"/* \
|
|
|
35
|
+ "$display_name/$display_name.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS"/* \
|
|
|
36
|
+ "$display_name/$display_name.app/Contents/MacOS/gpu-helper.app/Contents/MacOS"/* \
|
|
|
37
|
+ "$display_name/$display_name.app/Contents/Frameworks/ChannelPrefs.framework/ChannelPrefs" \
|
|
|
38
|
+ "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework/UpdateSettings"
|
|
|
39
|
+test -d "$display_name/$display_name.app/Contents/MacOS/Tor" && \
|
|
|
40
|
+ chmod -R ugo+x "$display_name/$display_name.app/Contents/MacOS/Tor"
|
|
|
41
|
+
|
|
|
42
|
+pwdir=/run/lock/rcodesign-pw
|
|
|
43
|
+trap "rm -Rf $pwdir" EXIT
|
|
|
44
|
+rm -Rf "$pwdir"
|
|
|
45
|
+mkdir "$pwdir"
|
|
|
46
|
+chmod 700 "$pwdir"
|
|
|
47
|
+cat > "$pwdir/rcodesign-pw-2" << EOF
|
|
|
48
|
+$RCODESIGN_PW
|
|
|
49
|
+EOF
|
|
|
50
|
+tr -d '\n' < "$pwdir/rcodesign-pw-2" > "$pwdir/rcodesign-pw"
|
|
|
51
|
+rm "$pwdir/rcodesign-pw-2"
|
|
|
52
|
+
|
|
|
53
|
+# unset RCODESIGN_PW since it conflicts with rcodesign config
|
|
|
54
|
+unset RCODESIGN_PW
|
|
|
55
|
+rcodesign_opts="
|
|
|
56
|
+ --code-signature-flags runtime
|
|
|
57
|
+ --timestamp-url http://timestamp.apple.com:8080/ts01
|
|
|
58
|
+ --p12-file $rcodesign_signing_p12_file
|
|
|
59
|
+ --p12-password-file $pwdir/rcodesign-pw
|
|
|
60
|
+ "
|
|
|
61
|
+
|
|
|
62
|
+flags=()
|
|
|
63
|
+for dir in Contents/MacOS Contents/MacOS/Tor Contents/MacOS/Tor/PluggableTransports
|
|
|
64
|
+do
|
|
|
65
|
+ d="$display_name/$display_name.app/$dir"
|
|
|
66
|
+ test -d "$d" || continue
|
|
|
67
|
+ pushd "$d"
|
|
|
68
|
+ for file in *
|
|
|
69
|
+ do
|
|
|
70
|
+ test -f "$file" || continue
|
|
|
71
|
+ flags+=('--code-signature-flags' "$dir/$file:runtime")
|
|
|
72
|
+ done
|
|
|
73
|
+ popd
|
|
|
74
|
+done
|
|
|
75
|
+echo "code-signature-flags: ${flags[@]}"
|
|
|
76
|
+
|
|
|
77
|
+echo "**** Signing main bundle ($display_name.app) ****"
|
|
|
78
|
+$rcodesign sign \
|
|
|
79
|
+ $rcodesign_opts \
|
|
|
80
|
+ "${flags[@]}" \
|
|
|
81
|
+ --code-signature-flags Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework:runtime \
|
|
|
82
|
+ --code-signature-flags Contents/MacOS/updater.app:runtime \
|
|
|
83
|
+ --code-signature-flags Contents/Frameworks/ChannelPrefs.framework:runtime \
|
|
|
84
|
+ --code-signature-flags Contents/MacOS/plugin-container.app:runtime \
|
|
|
85
|
+ --code-signature-flags Contents/MacOS/media-plugin-helper.app:runtime \
|
|
|
86
|
+ --code-signature-flags Contents/MacOS/gpu-helper.app:runtime \
|
|
|
87
|
+ --entitlements-xml-path Contents/MacOS/Tor/tor:/signing/tor-browser-build/tools/signing/macos-entitlements/tor.xml \
|
|
|
88
|
+ --entitlements-xml-path Contents/MacOS/plugin-container.app:/signing/tor-browser-build/tools/signing/macos-entitlements/plugin-container.xml \
|
|
|
89
|
+ --entitlements-xml-path Contents/MacOS/media-plugin-helper.app:/signing/tor-browser-build/tools/signing/macos-entitlements/media-plugin-helper.xml \
|
|
|
90
|
+ --entitlements-xml-path /signing/tor-browser-build/tools/signing/macos-entitlements/firefox.browser.xml \
|
|
|
91
|
+ -- \
|
|
|
92
|
+ "$display_name/$display_name.app"
|
|
|
93
|
+
|
|
|
94
|
+rm -f "$pwdir/rcodesign-pw"
|
|
|
95
|
+rmdir "$pwdir"
|
|
|
96
|
+tar -C "$display_name" -caf "$output_file" "$display_name.app"
|
|
|
97
|
+cd -
|
|
|
98
|
+rm -Rf "$tmpdir" |