118 lines
3.3 KiB
Bash
Executable File
118 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
DEV_ID="Developer ID Application: STATUS HOLDINGS PTE. LTD. (DTX7Z4U3YA)"
|
|
|
|
OBJECT="$1"
|
|
GPG_ENCRYPTED_KEYCHAIN="$2"
|
|
|
|
if [ `uname` != 'Darwin' ]; then
|
|
echo "This only works on macOS."
|
|
exit 1
|
|
elif [ $# -ne 2 ]; then
|
|
echo "sign-macos-bundle.sh <path to .app bundle or .dmg image> <path to encrypted keychain>"
|
|
exit 1
|
|
elif [ ! -e "$OBJECT" ]; then
|
|
echo "Object does not exist."
|
|
exit 1
|
|
elif [ ! -f "$GPG_ENCRYPTED_KEYCHAIN" ]; then
|
|
echo "Encrypted keychain file does not exist."
|
|
exit 1
|
|
fi
|
|
|
|
# Required env variables:
|
|
|
|
export GPG_PASS_OUTER
|
|
export GPG_PASS_INNER
|
|
export KEYCHAIN_PASS
|
|
|
|
[ -z "$GPG_PASS_OUTER" ] && echo 'Missing env var: GPG_PASS_OUTER' && exit 1
|
|
[ -z "$GPG_PASS_INNER" ] && echo 'Missing env var: GPG_PASS_INNER' && exit 1
|
|
[ -z "$KEYCHAIN_PASS" ] && echo 'Missing env var: KEYCHAIN_PASS' && exit 1
|
|
|
|
# If GPG hasn't been run on this host before, we run it once
|
|
# quietly to make sure it creates the directories it needs first
|
|
# and doesn't trip when trying to do the decryption further down
|
|
script -q /dev/null gpg < /dev/null > /dev/null
|
|
|
|
set -e
|
|
|
|
echo -e "\n### Storing original keychain search list..."
|
|
ORIG_KEYCHAIN_LIST="$(security list-keychains \
|
|
| grep -v "/Library/Keychains/System.keychain" \
|
|
| grep -v "/private/var/folders" \
|
|
| xargs)"
|
|
|
|
echo -e "\n### Creating ramdisk..."
|
|
RAMDISK="$(hdiutil attach -nomount ram://20480 | tr -d '[:blank:]')"
|
|
MOUNTPOINT="$(mktemp -d)"
|
|
KEYCHAIN="${MOUNTPOINT}/macos-developer-id.keychain-db"
|
|
|
|
function clean_up {
|
|
local STATUS=$?
|
|
|
|
set +e
|
|
|
|
if [ $STATUS -eq 0 ]; then
|
|
echo -e "\n###### DONE."
|
|
else
|
|
echo -e "\n###### ERROR. See above for details."
|
|
fi
|
|
|
|
echo -e "\n###### Cleaning up..."
|
|
|
|
echo -e "\n### Locking keychain..."
|
|
security lock-keychain "$KEYCHAIN"
|
|
|
|
echo -e "\n### Restoring original keychain search list..."
|
|
security list-keychains -s $ORIG_KEYCHAIN_LIST
|
|
security list-keychains
|
|
|
|
echo -e "\n### Delete keychain file..."
|
|
security delete-keychain "$KEYCHAIN"
|
|
|
|
echo -e "\n### Destroying ramdisk..."
|
|
diskutil umount force "$RAMDISK"
|
|
diskutil eject "$RAMDISK"
|
|
|
|
exit $STATUS
|
|
}
|
|
|
|
trap clean_up ERR EXIT
|
|
|
|
echo -e "\n### Formatting and mounting ramdisk..."
|
|
newfs_hfs "$RAMDISK"
|
|
mount -t hfs "$RAMDISK" "$MOUNTPOINT"
|
|
|
|
echo -e "\n### Decrypting keychain to $KEYCHAIN ..."
|
|
gpg --batch --passphrase "$GPG_PASS_OUTER" --pinentry-mode loopback \
|
|
--decrypt "$GPG_ENCRYPTED_KEYCHAIN" \
|
|
| gpg --batch --passphrase "$GPG_PASS_INNER" --pinentry-mode loopback \
|
|
--decrypt > "$KEYCHAIN"
|
|
|
|
echo -e "\n### Adding code-signing keychain to search list..."
|
|
security list-keychains -s $ORIG_KEYCHAIN_LIST "$KEYCHAIN"
|
|
security list-keychains
|
|
|
|
echo -e "\n### Unlocking keychain..."
|
|
security unlock-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN"
|
|
|
|
echo -e "\n### Signing object..."
|
|
|
|
# If `OBJECT` is a directory, we assume it's an app
|
|
# bundle, otherwise we consider it to be a dmg.
|
|
if [ -d "$OBJECT" ]; then
|
|
codesign --sign "$DEV_ID" --keychain "$KEYCHAIN" --deep --force --verbose=4 "$OBJECT"
|
|
else
|
|
codesign --sign "$DEV_ID" --keychain "$KEYCHAIN" --force --verbose=4 "$OBJECT"
|
|
fi
|
|
|
|
echo -e "\n### Verifying signature..."
|
|
codesign --verify --strict=all --deep --verbose=4 "$OBJECT"
|
|
|
|
echo -e "\n### Assessing Gatekeeper validation..."
|
|
if [ -d "$OBJECT" ]; then
|
|
spctl --assess --type execute --verbose=2 "$OBJECT"
|
|
else
|
|
spctl --assess --type open --context context:primary-signature --verbose=2 "$OBJECT"
|
|
fi
|