|
| 1 | +name: macos-code-sign |
| 2 | +description: Sign and notarize macOS PyInstaller binaries |
| 3 | + |
| 4 | +inputs: |
| 5 | + binary-path: |
| 6 | + description: Path to the binary to sign |
| 7 | + required: true |
| 8 | + apple-certificate-p12: |
| 9 | + description: Base64-encoded Apple signing certificate (P12) |
| 10 | + required: true |
| 11 | + apple-certificate-password: |
| 12 | + description: Password for the signing certificate |
| 13 | + required: true |
| 14 | + apple-notarization-key-p8: |
| 15 | + description: Base64-encoded Apple notarization key (P8) |
| 16 | + required: true |
| 17 | + apple-notarization-key-id: |
| 18 | + description: Apple notarization key ID |
| 19 | + required: true |
| 20 | + apple-notarization-issuer-id: |
| 21 | + description: Apple notarization issuer ID |
| 22 | + required: true |
| 23 | + |
| 24 | +runs: |
| 25 | + using: composite |
| 26 | + steps: |
| 27 | + - name: Import signing certificate |
| 28 | + shell: bash |
| 29 | + env: |
| 30 | + APPLE_CERTIFICATE_P12: ${{ inputs.apple-certificate-p12 }} |
| 31 | + APPLE_CERTIFICATE_PASSWORD: ${{ inputs.apple-certificate-password }} |
| 32 | + KEYCHAIN_PASSWORD: actions |
| 33 | + run: | |
| 34 | + set -euo pipefail |
| 35 | +
|
| 36 | + # Decode certificate |
| 37 | + cert_path="${RUNNER_TEMP}/certificate.p12" |
| 38 | + echo "$APPLE_CERTIFICATE_P12" | base64 -d > "$cert_path" |
| 39 | +
|
| 40 | + # Create temporary keychain |
| 41 | + keychain_path="${RUNNER_TEMP}/signing.keychain-db" |
| 42 | + security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path" |
| 43 | + security set-keychain-settings -lut 21600 "$keychain_path" |
| 44 | + security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path" |
| 45 | +
|
| 46 | + # Add to keychain search list |
| 47 | + security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"') |
| 48 | + security default-keychain -s "$keychain_path" |
| 49 | +
|
| 50 | + # Import certificate |
| 51 | + security import "$cert_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security |
| 52 | + security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path" > /dev/null |
| 53 | +
|
| 54 | + # Find signing identity |
| 55 | + IDENTITY=$(security find-identity -v -p codesigning "$keychain_path" | grep "Developer ID Application" | head -1 | sed -n 's/.*"\(Developer ID Application[^"]*\)".*/\1/p') |
| 56 | + |
| 57 | + if [[ -z "$IDENTITY" ]]; then |
| 58 | + echo "❌ No Developer ID Application identity found" |
| 59 | + security find-identity -v -p codesigning "$keychain_path" |
| 60 | + exit 1 |
| 61 | + fi |
| 62 | +
|
| 63 | + echo "✅ Found signing identity: $IDENTITY" |
| 64 | + echo "APPLE_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV" |
| 65 | + echo "APPLE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV" |
| 66 | +
|
| 67 | + rm -f "$cert_path" |
| 68 | +
|
| 69 | + - name: Sign PyInstaller binary and embedded libraries |
| 70 | + shell: bash |
| 71 | + env: |
| 72 | + BINARY_PATH: ${{ inputs.binary-path }} |
| 73 | + run: | |
| 74 | + set -euo pipefail |
| 75 | +
|
| 76 | + echo "Signing PyInstaller binary: $BINARY_PATH" |
| 77 | +
|
| 78 | + # PyInstaller onefile binaries embed libraries that get extracted at runtime. |
| 79 | + # We need to unpack, sign everything, and repack. |
| 80 | + |
| 81 | + # First, try signing the binary directly with --deep |
| 82 | + # For single-file PyInstaller executables, this should work |
| 83 | + codesign --deep --force --options runtime --timestamp \ |
| 84 | + --sign "$APPLE_SIGNING_IDENTITY" \ |
| 85 | + --keychain "$APPLE_KEYCHAIN_PATH" \ |
| 86 | + "$BINARY_PATH" |
| 87 | +
|
| 88 | + echo "✅ Binary signed" |
| 89 | + codesign -dv --verbose=2 "$BINARY_PATH" |
| 90 | +
|
| 91 | + - name: Notarize binary |
| 92 | + shell: bash |
| 93 | + env: |
| 94 | + BINARY_PATH: ${{ inputs.binary-path }} |
| 95 | + APPLE_NOTARIZATION_KEY_P8: ${{ inputs.apple-notarization-key-p8 }} |
| 96 | + APPLE_NOTARIZATION_KEY_ID: ${{ inputs.apple-notarization-key-id }} |
| 97 | + APPLE_NOTARIZATION_ISSUER_ID: ${{ inputs.apple-notarization-issuer-id }} |
| 98 | + run: | |
| 99 | + set -euo pipefail |
| 100 | +
|
| 101 | + # Save API key |
| 102 | + key_path="${RUNNER_TEMP}/AuthKey.p8" |
| 103 | + echo "$APPLE_NOTARIZATION_KEY_P8" | base64 -d > "$key_path" |
| 104 | +
|
| 105 | + # Create zip for notarization |
| 106 | + binary_name=$(basename "$BINARY_PATH") |
| 107 | + zip_path="${RUNNER_TEMP}/${binary_name}.zip" |
| 108 | + ditto -c -k --keepParent "$BINARY_PATH" "$zip_path" |
| 109 | +
|
| 110 | + echo "Submitting for notarization..." |
| 111 | + |
| 112 | + # Submit and wait |
| 113 | + result=$(xcrun notarytool submit "$zip_path" \ |
| 114 | + --key "$key_path" \ |
| 115 | + --key-id "$APPLE_NOTARIZATION_KEY_ID" \ |
| 116 | + --issuer "$APPLE_NOTARIZATION_ISSUER_ID" \ |
| 117 | + --wait \ |
| 118 | + --timeout 10m \ |
| 119 | + --output-format json 2>&1) || true |
| 120 | +
|
| 121 | + echo "$result" |
| 122 | + |
| 123 | + status=$(echo "$result" | grep -o '"status":"[^"]*"' | cut -d'"' -f4 || echo "unknown") |
| 124 | + |
| 125 | + if [[ "$status" == "Accepted" ]]; then |
| 126 | + echo "✅ Notarization successful" |
| 127 | + else |
| 128 | + echo "⚠️ Notarization status: $status" |
| 129 | + # Get detailed log |
| 130 | + submission_id=$(echo "$result" | grep -o '"id":"[^"]*"' | cut -d'"' -f4 || echo "") |
| 131 | + if [[ -n "$submission_id" ]]; then |
| 132 | + echo "Fetching notarization log..." |
| 133 | + xcrun notarytool log "$submission_id" \ |
| 134 | + --key "$key_path" \ |
| 135 | + --key-id "$APPLE_NOTARIZATION_KEY_ID" \ |
| 136 | + --issuer "$APPLE_NOTARIZATION_ISSUER_ID" || true |
| 137 | + fi |
| 138 | + exit 1 |
| 139 | + fi |
| 140 | +
|
| 141 | + # Cleanup |
| 142 | + rm -f "$key_path" "$zip_path" |
| 143 | +
|
| 144 | + - name: Verify signature |
| 145 | + shell: bash |
| 146 | + env: |
| 147 | + BINARY_PATH: ${{ inputs.binary-path }} |
| 148 | + run: | |
| 149 | + set -euo pipefail |
| 150 | + |
| 151 | + echo "Verifying signature and notarization..." |
| 152 | + codesign -dv --verbose=2 "$BINARY_PATH" |
| 153 | + echo "" |
| 154 | + echo "Gatekeeper check:" |
| 155 | + spctl -a -vv "$BINARY_PATH" 2>&1 || true |
| 156 | +
|
| 157 | + - name: Cleanup keychain |
| 158 | + if: always() |
| 159 | + shell: bash |
| 160 | + run: | |
| 161 | + if [[ -n "${APPLE_KEYCHAIN_PATH:-}" && -f "${APPLE_KEYCHAIN_PATH}" ]]; then |
| 162 | + security delete-keychain "$APPLE_KEYCHAIN_PATH" || true |
| 163 | + fi |
0 commit comments