From dcfebbcb9efed7b93b544f846b5df348cc893305 Mon Sep 17 00:00:00 2001 From: Anton Iakimov Date: Tue, 8 Aug 2023 14:06:06 +0200 Subject: [PATCH] ci: switch altool to notarytool --- Makefile | 3 +- ci/Jenkinsfile.combined | 1 + ci/Jenkinsfile.linux | 1 + ci/Jenkinsfile.macos | 1 + ci/Jenkinsfile.tests-e2e | 1 + ci/Jenkinsfile.tests-imports | 1 + ci/Jenkinsfile.tests-nim | 1 + ci/Jenkinsfile.windows | 1 + ci/cpp/Jenkinsfile.linux | 1 + ci/cpp/Jenkinsfile.macos | 1 + ci/cpp/Jenkinsfile.windows | 1 + scripts/notarize-macos-pkg.sh | 52 ++++++++++++----------------------- 12 files changed, 29 insertions(+), 36 deletions(-) diff --git a/Makefile b/Makefile index 8941c8cc17..0127e2fcc9 100644 --- a/Makefile +++ b/Makefile @@ -663,8 +663,7 @@ ifdef MACOS_CODESIGN_IDENT scripts/sign-macos-pkg.sh $(STATUS_CLIENT_DMG) $(MACOS_CODESIGN_IDENT) endif -notarize-macos: export CHECK_INTERVAL_SEC ?= 30 -notarize-macos: export CHECK_RETRY_LIMIT ?= 40 +notarize-macos: export CHECK_TIMEOUT ?= 10m notarize-macos: export MACOS_BUNDLE_ID ?= im.status.ethereum.desktop notarize-macos: scripts/notarize-macos-pkg.sh $(STATUS_CLIENT_DMG) diff --git a/ci/Jenkinsfile.combined b/ci/Jenkinsfile.combined index c9b48a4441..604b200142 100644 --- a/ci/Jenkinsfile.combined +++ b/ci/Jenkinsfile.combined @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' pipeline { diff --git a/ci/Jenkinsfile.linux b/ci/Jenkinsfile.linux index 2eb4ac7e5b..2359d980e3 100644 --- a/ci/Jenkinsfile.linux +++ b/ci/Jenkinsfile.linux @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/Jenkinsfile.macos b/ci/Jenkinsfile.macos index 6cd9ba8ee6..255750ebfc 100644 --- a/ci/Jenkinsfile.macos +++ b/ci/Jenkinsfile.macos @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/Jenkinsfile.tests-e2e b/ci/Jenkinsfile.tests-e2e index 3fda13630f..8aa83e4a62 100644 --- a/ci/Jenkinsfile.tests-e2e +++ b/ci/Jenkinsfile.tests-e2e @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/Jenkinsfile.tests-imports b/ci/Jenkinsfile.tests-imports index 50dbf44d6c..2e3fd6e8b8 100644 --- a/ci/Jenkinsfile.tests-imports +++ b/ci/Jenkinsfile.tests-imports @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/Jenkinsfile.tests-nim b/ci/Jenkinsfile.tests-nim index 2a21e3ff52..bdb5583f90 100644 --- a/ci/Jenkinsfile.tests-nim +++ b/ci/Jenkinsfile.tests-nim @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/Jenkinsfile.windows b/ci/Jenkinsfile.windows index 9f9b0b1ad4..f4e1065b2d 100644 --- a/ci/Jenkinsfile.windows +++ b/ci/Jenkinsfile.windows @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/cpp/Jenkinsfile.linux b/ci/cpp/Jenkinsfile.linux index 38dc443de6..8de4fca078 100644 --- a/ci/cpp/Jenkinsfile.linux +++ b/ci/cpp/Jenkinsfile.linux @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/cpp/Jenkinsfile.macos b/ci/cpp/Jenkinsfile.macos index 5aaf08c5fb..fb1556ba57 100644 --- a/ci/cpp/Jenkinsfile.macos +++ b/ci/cpp/Jenkinsfile.macos @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/ci/cpp/Jenkinsfile.windows b/ci/cpp/Jenkinsfile.windows index f8303592cb..bc5ec1c483 100644 --- a/ci/cpp/Jenkinsfile.windows +++ b/ci/cpp/Jenkinsfile.windows @@ -1,3 +1,4 @@ +#!/usr/bin/env groovy library 'status-jenkins-lib@v1.7.11' /* Options section can't access functions in objects. */ diff --git a/scripts/notarize-macos-pkg.sh b/scripts/notarize-macos-pkg.sh index 8efb804fba..24b7bda8d2 100755 --- a/scripts/notarize-macos-pkg.sh +++ b/scripts/notarize-macos-pkg.sh @@ -11,29 +11,26 @@ set -eof pipefail # Path to MacOS bundle created by XCode. BUNDLE_PATH="${1}" -# Notarization request check intervals/retries. -CHECK_INTERVAL_SEC="${CHECK_INTERVAL_SEC:-30}" -CHECK_RETRY_LIMIT="${CHECK_RETRY_LIMIT:-40}" -# Unique ID of MacOS application. -MACOS_BUNDLE_ID="${MACOS_BUNDLE_ID:-im.status.ethereum.desktop}" -# Xcode altool log file paths +# Notarization request check timeout. +CHECK_TIMEOUT="${CHECK_TIMEOUT:-10m}" +# Xcode notarization log file paths NOTARIZATION_ERR_LOG="${NOTARIZATION_ERR_LOG:-${PWD}/notarization.out.log}" NOTARIZATION_OUT_LOG="${NOTARIZATION_OUT_LOG:-${PWD}/notarization.err.log}" -function show_xcrun_altool_logs() { +function show_notarization_logs() { echo "FAILURE!" echo "STDERR:" cat "${NOTARIZATION_ERR_LOG}" echo "STDOUT:" cat "${NOTARIZATION_OUT_LOG}" } -trap show_xcrun_altool_logs ERR +trap show_notarization_logs ERR -function xcrun_altool() { +function xcrun_notarytool() { # STDERR goes to /dev/null so we can capture just the JSON. - xcrun altool "${@}" \ + xcrun notarytool "${@}" \ --team-id "${MACOS_NOTARIZE_TEAM_ID}" \ - --username "${MACOS_NOTARIZE_USERNAME}" \ + --apple-id "${MACOS_NOTARIZE_USERNAME}" \ --password "${MACOS_NOTARIZE_PASSWORD}" \ --output-format "json" \ > >(tee -a "${NOTARIZATION_OUT_LOG}") \ @@ -42,9 +39,9 @@ function xcrun_altool() { # Submit app for notarization. Should take 5-10 minutes. echo -e "\n### Creating Notarization Request..." -OUT=$(xcrun_altool --notarize-app -f "${BUNDLE_PATH}" --primary-bundle-id "${MACOS_BUNDLE_ID}") +OUT=$(xcrun_notarytool submit --wait --timeout "${CHECK_TIMEOUT}" "${BUNDLE_PATH}") # Necessary to track notarization request progress. -REQUEST_UUID=$(echo "${OUT}" | jq -r '."notarization-upload".RequestUUID') +REQUEST_UUID=$(echo "${OUT}" | jq -r '.id') if [[ -z "${REQUEST_UUID}" ]] || [[ "${REQUEST_UUID}" == "null" ]]; then echo "\n!!! FAILURE: No notarization request UUID found." >&1 @@ -54,28 +51,15 @@ if [[ -z "${REQUEST_UUID}" ]] || [[ "${REQUEST_UUID}" == "null" ]]; then fi echo -e "\n### Request ID: ${REQUEST_UUID}" -# Check notarization ticket status periodically. +# Check notarization ticket status. echo -e "\n### Checking Notarization Status..." -while sleep "${CHECK_INTERVAL_SEC}"; do - OUT=$(xcrun_altool --notarization-info "${REQUEST_UUID}") - - # Once notarization is complete, run stapler and exit. - if $(echo "${OUT}" | jq -er '."notarization-info".Status == "in progress"'); then - ((CHECK_RETRY_LIMIT-=1)) - if [[ "${CHECK_RETRY_LIMIT}" -eq 0 ]]; then - echo -e "\n!!! FAILURE: Notarization timed out." - exit 1 - fi - echo "In progress, sleeping ${CHECK_INTERVAL_SEC}s..." - elif $(echo "${OUT}" | jq -er '."notarization-info".Status == "success"'); then - echo -e "\n### Successful Notarization" - break - else - echo -e "\n!!! Notariztion Error" - echo "${OUT}" >&2 - exit 1 - fi -done +if $(echo "${OUT}" | jq -er '.status == "Accepted"'); then + echo -e "\n### Successful Notarization" +else + echo -e "\n!!! Notariztion Error" + echo "${OUT}" >&2 + exit 1 +fi # Optional but preferrable to attach the ticket to the bundle. echo -e "\n### Stapling Notarization Ticket..."