mirror of
https://github.com/mborgerson/xemu.git
synced 2026-02-04 10:25:30 +00:00
111 lines
2.6 KiB
Bash
Executable File
111 lines
2.6 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Sign and notarize xemu macOS releases.
|
|
|
|
Usage:
|
|
sign-macos-release.sh [OPTIONS]
|
|
|
|
Options:
|
|
--p12-file <PATH>
|
|
Path to signing certificate
|
|
|
|
--p12-password-file <PATH>
|
|
Path to certificate password
|
|
|
|
--api-key-path <PATH>
|
|
Path to App Store Connect API key
|
|
|
|
--tag latest|<TAG>
|
|
GitHub release tag with .zip asset to sign and notarize
|
|
|
|
--file <PATH>
|
|
Local release .zip asset to sign and notarize
|
|
EOF
|
|
}
|
|
|
|
REPO=xemu-project/xemu
|
|
ENTITLEMENTS="$PWD/xemu.entitlements"
|
|
|
|
P12_FILE=""
|
|
P12_PASSWORD_FILE=""
|
|
API_KEY_PATH=""
|
|
INPUT_FILE_PATH=""
|
|
TAG=""
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--p12-file) P12_FILE="$(realpath "$2")"; shift 2 ;;
|
|
--p12-password-file) P12_PASSWORD_FILE="$(realpath "$2")"; shift 2 ;;
|
|
--api-key-path) API_KEY_PATH="$(realpath "$2")"; shift 2 ;;
|
|
--file) INPUT_FILE_PATH="$(realpath "$2")"; shift 2 ;;
|
|
--tag) TAG="$2"; shift 2 ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
*) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "$P12_FILE" || -z "$P12_PASSWORD_FILE" || -z "$API_KEY_PATH" ]]; then
|
|
echo "Missing required args." >&2
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
if [[ -z "$INPUT_FILE_PATH" && -z "$TAG" ]]; then
|
|
echo "Specify --file or --tag" >&2
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
echo ">> Tool versions"
|
|
rcodesign --version
|
|
gh --version
|
|
|
|
if [[ "$TAG" == "latest" ]]; then
|
|
echo "[*] Getting latest tag..."
|
|
TAG="$(gh release view --repo "$REPO" --json tagName -q .tagName)"
|
|
echo " -> $TAG"
|
|
fi
|
|
|
|
if [[ "$INPUT_FILE_PATH" ]]; then
|
|
UNSIGNED_ZIP_PATH="$INPUT_FILE_PATH"
|
|
SIGNED_ZIP_PATH="$INPUT_FILE_PATH"
|
|
elif [[ "$TAG" ]]; then
|
|
echo "[*] Downloading unsigned release archive for tag $TAG..."
|
|
VERSION=${TAG#v}
|
|
UNSIGNED_ZIP_PATH="$PWD/xemu-${VERSION}-macos-universal-unsigned.zip"
|
|
SIGNED_ZIP_PATH="$PWD/xemu-${VERSION}-macos-universal.zip"
|
|
gh release download "$TAG" -R "$REPO" -p "$(basename "$UNSIGNED_ZIP_PATH")"
|
|
fi
|
|
|
|
TMPDIR=codesign-tmp-dir
|
|
rm -rf $TMPDIR
|
|
mkdir $TMPDIR
|
|
pushd $TMPDIR
|
|
|
|
echo "[*] Extracting release"
|
|
unzip "$UNSIGNED_ZIP_PATH"
|
|
|
|
echo "[*] Signing xemu.app"
|
|
rcodesign sign \
|
|
--p12-file "$P12_FILE" \
|
|
--p12-password-file "$P12_PASSWORD_FILE" \
|
|
--entitlements-xml-file "$ENTITLEMENTS" \
|
|
--for-notarization \
|
|
./xemu.app
|
|
|
|
echo "[*] Notarizing..."
|
|
rcodesign notary-submit --api-key-path "$API_KEY_PATH" --staple ./xemu.app
|
|
|
|
echo "[*] Creating new release archive..."
|
|
zip -r "$SIGNED_ZIP_PATH" *
|
|
|
|
popd
|
|
|
|
if [[ "$TAG" ]]; then
|
|
echo "[*] Uploading signed release archive..."
|
|
gh release upload "$TAG" -R "$REPO" "$SIGNED_ZIP_PATH" --clobber
|
|
fi
|