BUILD: GoReleaser add macOS code signing and notarization#4073
Conversation
cafferata
force-pushed
the
build/goreleaser-macos-code-signing
branch
from
8d31e8f to
4318805
Compare
|
Wow! I've always wondered how code signing was done! how fun! I've added 4 of those secrets. The last one (the p8 file) wasn't visible in 1password. Clarification: I need the contents of MACOS_NOTARY_KEY. You can also send it to me via https://transfer.secretoverflow.com/u/tlimoncelli ) CC: @cafferata |
cafferata
force-pushed
the
build/goreleaser-macos-code-signing
branch
from
4318805 to
13afdfc
Compare
Oeps! 🙇🏼♂️
Done! ✍🏻 cc: @tlimoncelli |
Now with more info in the DNSControl documentation! 📚 |
tlimoncelli
left a comment
tlimoncelli
left a comment
There was a problem hiding this comment.
All secrets set up. Let me know when to merge!
cafferata
force-pushed
the
build/goreleaser-macos-code-signing
branch
from
13afdfc to
869e20e
Compare
|
Ready for merge! Note the extra commit with DNSControl developer documentation for the GoReleaser Homebrew Tap: https://docs.dnscontrol.org/~/revisions/wiZRFHXE4cZbqgyLBPQB/developer-info/goreleaser 📚 |
2 participants
Problem
After
brew install StackExchange/tap/dnscontrol, macOS Gatekeeper shows the following error:The binary is not code-signed and not notarized with Apple.
Set up GitHub Actions Secrets
To enable macOS code signing and notarization, the following 5 secrets need to be created.
Go to repo → Settings → Secrets and variables → Actions:
MACOS_SIGN_P12.p12fileMACOS_SIGN_PASSWORD.p12certificateMACOS_NOTARY_ISSUER_IDMACOS_NOTARY_KEY_IDMACOS_NOTARY_KEY.p8fileAll files and values are available in this 1Password share (valid for 14 days, email verification required):
https://share.1password.com/s#3H_ZmXX5_2CHMNGIJS4ybCmJUzolV4qsCJLrC4ZEsOE
MACOS_SIGN_P12 encoding
The
.p12file from 1Password needs to be base64-encoded:base64 -i DeveloperIDApplication.p12 | pbcopyMACOS_NOTARY_KEY
Paste the full contents of the
.p8file, including the-----BEGIN PRIVATE KEY-----and-----END PRIVATE KEY-----lines.The
enabledcondition in.goreleaser.ymlensures that builds without these secrets continue normally without signing.