From 867df989581c8f01d75a897ad1d66e9a142c022c Mon Sep 17 00:00:00 2001 From: Adrian Bonpin Date: Fri, 4 Sep 2026 02:02:54 +0000 Subject: [PATCH] fix: sign bundled DB tools with Developer ID for notarization (#15) --- scripts/release-mac.sh | 141 +++++++++++++++++++++-------------------- 1 file changed, 71 insertions(+), 70 deletions(-) diff --git a/scripts/release-mac.sh b/scripts/release-mac.sh index 7904c46..d74a51e 100755 --- a/scripts/release-mac.sh +++ b/scripts/release-mac.sh @@ -51,76 +51,6 @@ get_token() { GITEA_TOKEN="$(get_token)" -# ---- build bundled DB tools (macOS) ---------------------------------------- -WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)" -OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools" -OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools" - -echo ">> Building PostgreSQL client tools..." -mkdir -p "$OUT_PG" -PG_VER="16.4" -curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2 -tar -xf /tmp/pg.tar.bz2 -C /tmp -cd /tmp/postgresql-${PG_VER} -ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2" -sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c -make -C src/backend generated-headers -make -C src/interfaces/libpq all -make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all -make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all -cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/ -cp src/bin/psql/psql "$OUT_PG"/ -cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib -for b in pg_dump pg_restore psql; do - libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}') - install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b" -done -# install_name_tool invalidates the linker's ad-hoc signature; re-sign so the -# bundle passes notarization (every code object inside must be signed). -for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do - codesign --force --sign - "$f" 2>/dev/null || true -done - -echo ">> Building MariaDB client tools..." -mkdir -p "$OUT_MY" -MARIADB_VER="11.4.5" -git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server -cd /tmp/mariadb-server -if [ "$(uname -m)" = arm64 ]; then - SSL_DIR="/opt/homebrew/opt/openssl" -else - SSL_DIR="/usr/local/opt/openssl" -fi -[ -d "$SSL_DIR" ] || brew install openssl -cmake -DCMAKE_BUILD_TYPE=Release \ - -DWITHOUT_SERVER=ON \ - -DWITHOUT_TOKUDB=1 \ - -DWITHOUT_ROCKSDB=1 \ - -DWITHOUT_MROONGA=1 \ - -DWITHOUT_SPIDER=1 \ - -DWITHOUT_SEQUENCE=1 \ - -DWITH_UNIT_TESTS=OFF \ - -DWITH_SSL="$SSL_DIR" \ - -DWITH_ZLIB=bundled . -make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb -for b in mariadb-dump mariadb; do - src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true) - test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true) - test -n "$src" || { echo "build produced no $b binary"; exit 1; } - cp "$src" "$OUT_MY"/ -done -for pass in 1 2 3 4 5 6; do - for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do - [ -f "$dylib" ] || continue - otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do - base=$(basename "$lib") - if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi - install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true - done || true - codesign --force --sign - "$dylib" 2>/dev/null || true - done -done - # ---- macOS signing + notarization ----------------------------------------- # Requires a "Developer ID Application" certificate in the login keychain and # an App Store Connect API key for notarization. See the README's "macOS @@ -173,6 +103,77 @@ else echo ">> Notarization: API key ${APPLE_API_KEY} (issuer ${APPLE_API_ISSUER})" fi +# ---- build bundled DB tools (macOS) ---------------------------------------- +WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)" +OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools" +OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools" + +echo ">> Building PostgreSQL client tools..." +mkdir -p "$OUT_PG" +PG_VER="16.4" +curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2 +tar -xf /tmp/pg.tar.bz2 -C /tmp +cd /tmp/postgresql-${PG_VER} +ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2" +sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c +make -C src/backend generated-headers +make -C src/interfaces/libpq all +make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all +make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all +cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/ +cp src/bin/psql/psql "$OUT_PG"/ +cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib +for b in pg_dump pg_restore psql; do + libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}') + install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b" +done +# install_name_tool invalidates the linker's signature; re-sign with the +# Developer ID identity + hardened runtime + secure timestamp so the bundle +# passes notarization (Apple rejects ad-hoc-signed nested executables). +for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do + codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$f" +done + +echo ">> Building MariaDB client tools..." +mkdir -p "$OUT_MY" +MARIADB_VER="11.4.5" +git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server +cd /tmp/mariadb-server +if [ "$(uname -m)" = arm64 ]; then + SSL_DIR="/opt/homebrew/opt/openssl" +else + SSL_DIR="/usr/local/opt/openssl" +fi +[ -d "$SSL_DIR" ] || brew install openssl +cmake -DCMAKE_BUILD_TYPE=Release \ + -DWITHOUT_SERVER=ON \ + -DWITHOUT_TOKUDB=1 \ + -DWITHOUT_ROCKSDB=1 \ + -DWITHOUT_MROONGA=1 \ + -DWITHOUT_SPIDER=1 \ + -DWITHOUT_SEQUENCE=1 \ + -DWITH_UNIT_TESTS=OFF \ + -DWITH_SSL="$SSL_DIR" \ + -DWITH_ZLIB=bundled . +make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb +for b in mariadb-dump mariadb; do + src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true) + test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true) + test -n "$src" || { echo "build produced no $b binary"; exit 1; } + cp "$src" "$OUT_MY"/ +done +for pass in 1 2 3 4 5 6; do + for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do + [ -f "$dylib" ] || continue + otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do + base=$(basename "$lib") + if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi + install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true + done || true + codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$dylib" + done +done + # ---- build the app (both arches) ------------------------------------------ cd "${WORKSPACE}/desktop" echo ">> Installing frontend dependencies..."