status-mobile/scripts/sign-macos-pkg.sh

118 lines
3.3 KiB
Bash
Executable File

#!/usr/bin/env bash
DEV_ID="Developer ID Application: STATUS HOLDINGS PTE. LTD. (DTX7Z4U3YA)"
OBJECT="$1"
GPG_ENCRYPTED_KEYCHAIN="$2"
if [ `uname` != 'Darwin' ]; then
echo "This only works on macOS."
exit 1
elif [ $# -ne 2 ]; then
echo "sign-macos-bundle.sh <path to .app bundle or .dmg image> <path to encrypted keychain>"
exit 1
elif [ ! -e "$OBJECT" ]; then
echo "Object does not exist."
exit 1
elif [ ! -f "$GPG_ENCRYPTED_KEYCHAIN" ]; then
echo "Encrypted keychain file does not exist."
exit 1
fi
# Required env variables:
export GPG_PASS_OUTER
export GPG_PASS_INNER
export KEYCHAIN_PASS
[ -z "$GPG_PASS_OUTER" ] && echo 'Missing env var: GPG_PASS_OUTER' && exit 1
[ -z "$GPG_PASS_INNER" ] && echo 'Missing env var: GPG_PASS_INNER' && exit 1
[ -z "$KEYCHAIN_PASS" ] && echo 'Missing env var: KEYCHAIN_PASS' && exit 1
# If GPG hasn't been run on this host before, we run it once
# quietly to make sure it creates the directories it needs first
# and doesn't trip when trying to do the decryption further down
script -q /dev/null gpg < /dev/null > /dev/null
set -e
echo -e "\n### Storing original keychain search list..."
ORIG_KEYCHAIN_LIST="$(security list-keychains \
| grep -v "/Library/Keychains/System.keychain" \
| grep -v "/private/var/folders" \
| xargs)"
echo -e "\n### Creating ramdisk..."
RAMDISK="$(hdiutil attach -nomount ram://20480 | tr -d '[:blank:]')"
MOUNTPOINT="$(mktemp -d)"
KEYCHAIN="${MOUNTPOINT}/macos-developer-id.keychain-db"
function clean_up {
local STATUS=$?
set +e
if [ $STATUS -eq 0 ]; then
echo -e "\n###### DONE."
else
echo -e "\n###### ERROR. See above for details."
fi
echo -e "\n###### Cleaning up..."
echo -e "\n### Locking keychain..."
security lock-keychain "$KEYCHAIN"
echo -e "\n### Restoring original keychain search list..."
security list-keychains -s $ORIG_KEYCHAIN_LIST
security list-keychains
echo -e "\n### Delete keychain file..."
security delete-keychain "$KEYCHAIN"
echo -e "\n### Destroying ramdisk..."
diskutil umount force "$RAMDISK"
diskutil eject "$RAMDISK"
exit $STATUS
}
trap clean_up ERR EXIT
echo -e "\n### Formatting and mounting ramdisk..."
newfs_hfs "$RAMDISK"
mount -t hfs "$RAMDISK" "$MOUNTPOINT"
echo -e "\n### Decrypting keychain to $KEYCHAIN ..."
gpg --batch --passphrase "$GPG_PASS_OUTER" --pinentry-mode loopback \
--decrypt "$GPG_ENCRYPTED_KEYCHAIN" \
| gpg --batch --passphrase "$GPG_PASS_INNER" --pinentry-mode loopback \
--decrypt > "$KEYCHAIN"
echo -e "\n### Adding code-signing keychain to search list..."
security list-keychains -s $ORIG_KEYCHAIN_LIST "$KEYCHAIN"
security list-keychains
echo -e "\n### Unlocking keychain..."
security unlock-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN"
echo -e "\n### Signing object..."
# If `OBJECT` is a directory, we assume it's an app
# bundle, otherwise we consider it to be a dmg.
if [ -d "$OBJECT" ]; then
codesign --sign "$DEV_ID" --keychain "$KEYCHAIN" --deep --force --verbose=4 "$OBJECT"
else
codesign --sign "$DEV_ID" --keychain "$KEYCHAIN" --force --verbose=4 "$OBJECT"
fi
echo -e "\n### Verifying signature..."
codesign --verify --strict=all --deep --verbose=4 "$OBJECT"
echo -e "\n### Assessing Gatekeeper validation..."
if [ -d "$OBJECT" ]; then
spctl --assess --type execute --verbose=2 "$OBJECT"
else
spctl --assess --type open --context context:primary-signature --verbose=2 "$OBJECT"
fi