| 1 |
1 |
|
#!/usr/bin/env bash
|
| 2 |
|
- |
# build-keychain.sh -- ephemeral Developer ID build keychain for headless signing.
|
|
2 |
+ |
# build-keychain.sh: ephemeral Developer ID build keychain for headless signing.
|
| 3 |
3 |
|
#
|
| 4 |
4 |
|
# Why this exists: over SSH the Mac's login.keychain is locked
|
| 5 |
5 |
|
# ("User interaction is not allowed"), so `security find-identity` reports
|
| 10 |
10 |
|
#
|
| 11 |
11 |
|
# Team-agnostic on purpose: it signs with whatever identity the .p12 contains.
|
| 12 |
12 |
|
# That means remote signing works BEFORE the Apple Developer org transfer to the
|
| 13 |
|
- |
# LLC is finished -- the team only matters at the notarization step, which is a
|
|
13 |
+ |
# LLC is finished; the team only matters at the notarization step, which is a
|
| 14 |
14 |
|
# separate concern (see release-macos.sh --sign-only).
|
| 15 |
15 |
|
#
|
| 16 |
16 |
|
# This is the first concrete piece of Bento (the app-release orchestrator).
|
| 26 |
26 |
|
#
|
| 27 |
27 |
|
# --- Usage (standalone, for inspection/debugging) ---
|
| 28 |
28 |
|
# # setup + teardown run as SEPARATE processes, so pin the keychain path so
|
| 29 |
|
- |
# # both agree (the default is unique per process — see BUILD_KEYCHAIN below):
|
|
29 |
+ |
# # both agree (the default is unique per process, see BUILD_KEYCHAIN below):
|
| 30 |
30 |
|
# export BUILD_KEYCHAIN="${TMPDIR:-/tmp}/bento-build.debug.keychain-db"
|
| 31 |
31 |
|
# ./dist/build-keychain.sh setup # leaves the keychain in place
|
| 32 |
32 |
|
# ./dist/build-keychain.sh identity # print the Developer ID identity it holds
|
| 37 |
37 |
|
# BUILD_P12_PASSWORD password protecting that .p12
|
| 38 |
38 |
|
# BUILD_KEYCHAIN_PASSWORD password for the temp keychain (ephemeral; any value)
|
| 39 |
39 |
|
#
|
| 40 |
|
- |
# One-time prerequisite (cannot be done over SSH -- needs a GUI Terminal on the
|
| 41 |
|
- |
# Mac with login.keychain unlocked) -- export the cert + private key to a .p12:
|
|
40 |
+ |
# One-time prerequisite (cannot be done over SSH, needs a GUI Terminal on the
|
|
41 |
+ |
# Mac with login.keychain unlocked): export the cert + private key to a .p12:
|
| 42 |
42 |
|
# security find-identity -v -p codesigning | grep "Developer ID Application"
|
| 43 |
43 |
|
# # then, in Keychain Access: right-click the "Developer ID Application" identity
|
| 44 |
44 |
|
# # -> Export -> .p12 -> set a password -> save to ~/Code/_private/developer-id.p12
|
| 131 |
131 |
|
# shellcheck disable=SC2086 # word-splitting the list is intentional
|
| 132 |
132 |
|
security list-keychains -d user -s "$BUILD_KEYCHAIN" $orig
|
| 133 |
133 |
|
|
| 134 |
|
- |
echo "build-keychain: ready -- identity: $(bk_identity_name || echo '??')" >&2
|
|
134 |
+ |
echo "build-keychain: ready; identity: $(bk_identity_name || echo '??')" >&2
|
| 135 |
135 |
|
# NOTE: keychain setup is now correct, but codesign STILL needs to run in the
|
| 136 |
136 |
|
# console GUI (Aqua) security session to USE the private key. A pure SSH session
|
| 137 |
137 |
|
# can enumerate the identity but not sign with it ("no identity found"). Drive
|