| # Copyright 2020 Mark Callow | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # notarize.sh | |
| # Checks pkg for a valid signature. If valid, uploads the pkg for | |
| # notarization and waits for the notarization status | |
| # Usage: notarize.sh <path/to/pkg> <appleid> <devteam> <password> | |
| # path/to/pkg - path a signed .pkg file to be notarized. | |
| # appleid - Apple developer login. | |
| # devteam - 10 character development team identifier. Use Khronos dev | |
| # team id when notarizing apps signed with Khronos cert. | |
| # password - app-specific password for to use when logging in to | |
| # <appleid>. The same app-specific password can be used | |
| # for both altool and notarytool. If the password is stored | |
| # in the keychain then this argument should be of the form | |
| # @keychain:<pw_label> where <pw_label> is the label of the | |
| # password in the keychain. | |
| # | |
| # Retrieving this password from the keychain during a Travis-CI build was | |
| # not working for altool for reasons that are not clear. altool would hang. | |
| # Likely macOS security is asking for permission for altool to access the | |
| # keychain, even though this was set up. This has not been tried with | |
| # notarytool. | |
| # Thanks to Armin Briegel for the script that inspired this one. | |
| # Code starts here | |
| if [[ $# != 4 ]]; then | |
| echo "Usage: $0: <path/to/pkg> <appleid> <devteam> <password>" | |
| exit 1 | |
| else | |
| pkg=$1 | |
| appleid=$2 | |
| devteam=$3 | |
| passwd=$4 | |
| fi | |
| logfile=notarization.json | |
| # functions | |
| notarizefile() { # $1: path to file to notarize | |
| # upload file | |
| echo "## Sending $1 for notarization." | |
| echo "## Will await result. This may take some time..." | |
| if nt_out=$(xcrun notarytool submit "$1" \ | |
| --wait \ | |
| --apple-id "$appleid" \ | |
| --password "$passwd" \ | |
| --team-id "$devteam") | |
| then | |
| # N.B. notarytool outputs 2 lines starting with "status:". The first | |
| # initially says "In Progress" and is later overwritten with the | |
| # final status. This is done by sending a CR followed by the new text. | |
| # The second "status:" line is output at the end. All interim and | |
| # final messages are recorded in $nt_out. To avoid matching any interim | |
| # messages - "In" is a particular problem - use entire status response | |
| # words in this RE. | |
| # | |
| # A big thank to Apples, NOT :-(, for failing to document in the | |
| # command help or even the TechNotes about notarization, the output | |
| # from notarytool during --wait or to give any example of use. | |
| if [[ "$nt_out" =~ "status: (Accepted|Invalid|Rejected)" ]]; then | |
| ntz_status=$match[1] | |
| # There are many "id:" lines in the output. Fortunately they | |
| # all have the same value. | |
| [[ $nt_out =~ "id: ([0-9a-f\-]+)" ]] && id=$match[1] | |
| if ! xcrun notarytool log $id $logfile \ | |
| --apple-id "$appleid" \ | |
| --password "$passwd" \ | |
| --team-id "$devteam" | |
| then | |
| echo "$0: Retrieval of notarization log for id $id failed." | |
| exit 1 | |
| fi | |
| echo "## Notarization status: $ntz_status. Log:" | |
| cat $logfile | |
| echo | |
| rm $logfile | |
| else | |
| echo "$0: \"status:\" not found in notarytool output." | |
| exit 1 | |
| fi | |
| else | |
| echo "$0: Error while attempting to notarize $1." | |
| echo $nt_out | |
| exit 1 | |
| fi | |
| if [[ $ntz_status != "Accepted" ]]; then | |
| echo "## $1 not notarized. Exiting" | |
| exit 1 | |
| fi | |
| } | |
| # Check if pkg exists where we expect it | |
| if [[ ! -f $pkg ]]; then | |
| echo "$0: Couldn't find pkg $pkg" | |
| exit 1 | |
| fi | |
| # Check the package is signed | |
| if ! pkgutil --check-signature $pkg > /dev/null; then | |
| echo "$0: Package $pkg does not have a valid signature." | |
| exit 2 | |
| fi | |
| # Upload for notarization | |
| notarizefile "$pkg" | |
| # staple result | |
| echo "## Stapling $pkg" | |
| xcrun stapler staple "$pkg" | |
| echo '## Done!' | |
| exit 0 | |
| # vim:ai:ts=4:sts=2:sw=2:expandtab | |