fix: sign bundled DB tools with Developer ID for notarization (#15)
This commit was merged in pull request #15.
This commit is contained in:
+71
-70
@@ -51,76 +51,6 @@ get_token() {
|
|||||||
|
|
||||||
GITEA_TOKEN="$(get_token)"
|
GITEA_TOKEN="$(get_token)"
|
||||||
|
|
||||||
# ---- build bundled DB tools (macOS) ----------------------------------------
|
|
||||||
WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
|
|
||||||
OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools"
|
|
||||||
OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
|
|
||||||
|
|
||||||
echo ">> Building PostgreSQL client tools..."
|
|
||||||
mkdir -p "$OUT_PG"
|
|
||||||
PG_VER="16.4"
|
|
||||||
curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
|
|
||||||
tar -xf /tmp/pg.tar.bz2 -C /tmp
|
|
||||||
cd /tmp/postgresql-${PG_VER}
|
|
||||||
ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
|
|
||||||
sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c
|
|
||||||
make -C src/backend generated-headers
|
|
||||||
make -C src/interfaces/libpq all
|
|
||||||
make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all
|
|
||||||
make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all
|
|
||||||
cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/
|
|
||||||
cp src/bin/psql/psql "$OUT_PG"/
|
|
||||||
cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib
|
|
||||||
for b in pg_dump pg_restore psql; do
|
|
||||||
libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}')
|
|
||||||
install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b"
|
|
||||||
done
|
|
||||||
# install_name_tool invalidates the linker's ad-hoc signature; re-sign so the
|
|
||||||
# bundle passes notarization (every code object inside must be signed).
|
|
||||||
for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do
|
|
||||||
codesign --force --sign - "$f" 2>/dev/null || true
|
|
||||||
done
|
|
||||||
|
|
||||||
echo ">> Building MariaDB client tools..."
|
|
||||||
mkdir -p "$OUT_MY"
|
|
||||||
MARIADB_VER="11.4.5"
|
|
||||||
git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
|
|
||||||
cd /tmp/mariadb-server
|
|
||||||
if [ "$(uname -m)" = arm64 ]; then
|
|
||||||
SSL_DIR="/opt/homebrew/opt/openssl"
|
|
||||||
else
|
|
||||||
SSL_DIR="/usr/local/opt/openssl"
|
|
||||||
fi
|
|
||||||
[ -d "$SSL_DIR" ] || brew install openssl
|
|
||||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
|
||||||
-DWITHOUT_SERVER=ON \
|
|
||||||
-DWITHOUT_TOKUDB=1 \
|
|
||||||
-DWITHOUT_ROCKSDB=1 \
|
|
||||||
-DWITHOUT_MROONGA=1 \
|
|
||||||
-DWITHOUT_SPIDER=1 \
|
|
||||||
-DWITHOUT_SEQUENCE=1 \
|
|
||||||
-DWITH_UNIT_TESTS=OFF \
|
|
||||||
-DWITH_SSL="$SSL_DIR" \
|
|
||||||
-DWITH_ZLIB=bundled .
|
|
||||||
make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb
|
|
||||||
for b in mariadb-dump mariadb; do
|
|
||||||
src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
|
|
||||||
test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
|
|
||||||
test -n "$src" || { echo "build produced no $b binary"; exit 1; }
|
|
||||||
cp "$src" "$OUT_MY"/
|
|
||||||
done
|
|
||||||
for pass in 1 2 3 4 5 6; do
|
|
||||||
for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do
|
|
||||||
[ -f "$dylib" ] || continue
|
|
||||||
otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do
|
|
||||||
base=$(basename "$lib")
|
|
||||||
if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi
|
|
||||||
install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true
|
|
||||||
done || true
|
|
||||||
codesign --force --sign - "$dylib" 2>/dev/null || true
|
|
||||||
done
|
|
||||||
done
|
|
||||||
|
|
||||||
# ---- macOS signing + notarization -----------------------------------------
|
# ---- macOS signing + notarization -----------------------------------------
|
||||||
# Requires a "Developer ID Application" certificate in the login keychain and
|
# Requires a "Developer ID Application" certificate in the login keychain and
|
||||||
# an App Store Connect API key for notarization. See the README's "macOS
|
# an App Store Connect API key for notarization. See the README's "macOS
|
||||||
@@ -173,6 +103,77 @@ else
|
|||||||
echo ">> Notarization: API key ${APPLE_API_KEY} (issuer ${APPLE_API_ISSUER})"
|
echo ">> Notarization: API key ${APPLE_API_KEY} (issuer ${APPLE_API_ISSUER})"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# ---- build bundled DB tools (macOS) ----------------------------------------
|
||||||
|
WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
|
||||||
|
OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools"
|
||||||
|
OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
|
||||||
|
|
||||||
|
echo ">> Building PostgreSQL client tools..."
|
||||||
|
mkdir -p "$OUT_PG"
|
||||||
|
PG_VER="16.4"
|
||||||
|
curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
|
||||||
|
tar -xf /tmp/pg.tar.bz2 -C /tmp
|
||||||
|
cd /tmp/postgresql-${PG_VER}
|
||||||
|
ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
|
||||||
|
sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c
|
||||||
|
make -C src/backend generated-headers
|
||||||
|
make -C src/interfaces/libpq all
|
||||||
|
make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all
|
||||||
|
make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all
|
||||||
|
cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/
|
||||||
|
cp src/bin/psql/psql "$OUT_PG"/
|
||||||
|
cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib
|
||||||
|
for b in pg_dump pg_restore psql; do
|
||||||
|
libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}')
|
||||||
|
install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b"
|
||||||
|
done
|
||||||
|
# install_name_tool invalidates the linker's signature; re-sign with the
|
||||||
|
# Developer ID identity + hardened runtime + secure timestamp so the bundle
|
||||||
|
# passes notarization (Apple rejects ad-hoc-signed nested executables).
|
||||||
|
for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do
|
||||||
|
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$f"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ">> Building MariaDB client tools..."
|
||||||
|
mkdir -p "$OUT_MY"
|
||||||
|
MARIADB_VER="11.4.5"
|
||||||
|
git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
|
||||||
|
cd /tmp/mariadb-server
|
||||||
|
if [ "$(uname -m)" = arm64 ]; then
|
||||||
|
SSL_DIR="/opt/homebrew/opt/openssl"
|
||||||
|
else
|
||||||
|
SSL_DIR="/usr/local/opt/openssl"
|
||||||
|
fi
|
||||||
|
[ -d "$SSL_DIR" ] || brew install openssl
|
||||||
|
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||||
|
-DWITHOUT_SERVER=ON \
|
||||||
|
-DWITHOUT_TOKUDB=1 \
|
||||||
|
-DWITHOUT_ROCKSDB=1 \
|
||||||
|
-DWITHOUT_MROONGA=1 \
|
||||||
|
-DWITHOUT_SPIDER=1 \
|
||||||
|
-DWITHOUT_SEQUENCE=1 \
|
||||||
|
-DWITH_UNIT_TESTS=OFF \
|
||||||
|
-DWITH_SSL="$SSL_DIR" \
|
||||||
|
-DWITH_ZLIB=bundled .
|
||||||
|
make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb
|
||||||
|
for b in mariadb-dump mariadb; do
|
||||||
|
src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
|
||||||
|
test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
|
||||||
|
test -n "$src" || { echo "build produced no $b binary"; exit 1; }
|
||||||
|
cp "$src" "$OUT_MY"/
|
||||||
|
done
|
||||||
|
for pass in 1 2 3 4 5 6; do
|
||||||
|
for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do
|
||||||
|
[ -f "$dylib" ] || continue
|
||||||
|
otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do
|
||||||
|
base=$(basename "$lib")
|
||||||
|
if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi
|
||||||
|
install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true
|
||||||
|
done || true
|
||||||
|
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$dylib"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
# ---- build the app (both arches) ------------------------------------------
|
# ---- build the app (both arches) ------------------------------------------
|
||||||
cd "${WORKSPACE}/desktop"
|
cd "${WORKSPACE}/desktop"
|
||||||
echo ">> Installing frontend dependencies..."
|
echo ">> Installing frontend dependencies..."
|
||||||
|
|||||||
Reference in New Issue
Block a user