44 lines
1.9 KiB
Python
44 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Import the CI certificate into an isolated keychain for one release command."""
|
|
import base64
|
|
import os
|
|
import re
|
|
import secrets
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
|
|
def security(*args):
|
|
result = subprocess.run(["security", *args], capture_output=True, text=True)
|
|
if result.returncode:
|
|
raise RuntimeError(f"security {args[0]} failed (output withheld to protect credentials)")
|
|
return result.stdout
|
|
|
|
|
|
with tempfile.TemporaryDirectory(prefix="meetingnotes-signing-", dir=os.environ["RUNNER_TEMP"]) as directory:
|
|
keychain = str(Path(directory) / "release.keychain-db")
|
|
certificate = Path(directory) / "certificate.p12"
|
|
certificate.write_bytes(base64.b64decode(os.environ["APPLE_CERTIFICATE_P12"]))
|
|
certificate.chmod(0o600)
|
|
password = secrets.token_urlsafe(32)
|
|
created = False
|
|
try:
|
|
security("create-keychain", "-p", password, keychain)
|
|
created = True
|
|
security("set-keychain-settings", "-lut", "21600", keychain)
|
|
security("unlock-keychain", "-p", password, keychain)
|
|
security("import", str(certificate), "-k", keychain, "-P", os.environ["APPLE_CERTIFICATE_PASSWORD"], "-T", "/usr/bin/codesign", "-T", "/usr/bin/security")
|
|
security("set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychain)
|
|
identities = security("find-identity", "-v", "-p", "codesigning", keychain)
|
|
match = re.search(r'([0-9A-F]{40}) "Developer ID Application:', identities)
|
|
if not match:
|
|
raise RuntimeError("The certificate contains no valid Developer ID Application identity")
|
|
environment = dict(os.environ, SIGNING_IDENTITY=match[1], SIGNING_KEYCHAIN=keychain)
|
|
status = subprocess.run(sys.argv[1:], env=environment).returncode
|
|
finally:
|
|
if created:
|
|
security("delete-keychain", keychain)
|
|
sys.exit(status)
|