|
| 1 | +#!/bin/zsh |
| 2 | + |
| 3 | +# Utility script to submit an app for notarization by Apple. It will wait for |
| 4 | +# the notarization to succeed, and then staple the results to the target DMG |
| 5 | +# file. |
| 6 | + |
| 7 | +if [[ $# == 0 ]]; then |
| 8 | + echo "Usage: sign-developer-id <MacVim_dmg> <entitlements_file>" |
| 9 | + exit -1 |
| 10 | +fi |
| 11 | + |
| 12 | +set -e |
| 13 | + |
| 14 | +if [[ $ALTOOL_USERNAME == '' || $ALTOOL_PASSWORD == '' ]]; then |
| 15 | + echo 'Need to set ALTOOL_USERNAME and ALTOOL_PASSWORD in environment variables' |
| 16 | + exit -1 |
| 17 | +fi |
| 18 | + |
| 19 | +set -e |
| 20 | + |
| 21 | +macvim_dmg=$1 |
| 22 | + |
| 23 | +# Step 1: Submit app to Apple's servers for notarization |
| 24 | +set -x |
| 25 | +notarize_submit_uuid=$(xcrun altool --notarize-app --primary-bundle-id "org.vim.macvim" --file ${macvim_dmg} --username "${ALTOOL_USERNAME}" --password "${ALTOOL_PASSWORD}" | grep "RequestUUID" | sed -E "s/RequestUUID = (.*)/\1/") |
| 26 | +set +x |
| 27 | + |
| 28 | +if [[ ${notarize_submit_uuid} == "" ]]; then |
| 29 | + echo "Failed to submit for notarization!" |
| 30 | + exit -1 |
| 31 | +fi |
| 32 | +if ! [[ ${notarize_submit_uuid} =~ "^[a-f0-9\-]*$" ]]; then |
| 33 | + echo "Request UUID format error!" |
| 34 | + exit -1 |
| 35 | +fi |
| 36 | + |
| 37 | +# Step 2: Wait for notarization to success or fail by continuously querying |
| 38 | +# Apple's servers for status updates |
| 39 | +echo "Notarization request UUID: ${notarize_submit_uuid}" |
| 40 | +printf "Waiting for notarization results..." |
| 41 | + |
| 42 | +counter=0 |
| 43 | +while sleep 30; do |
| 44 | + notarize_results=$(xcrun altool --notarization-info ${notarize_submit_uuid} --username "${ALTOOL_USERNAME}" --password "${ALTOOL_PASSWORD}") |
| 45 | + notarize_status=$(echo $notarize_results | grep "Status:" | sed -E "s/^.*Status: (.*)/\1/") |
| 46 | + |
| 47 | + if ((++counter > 60)); then |
| 48 | + echo "Notarization timeout!" |
| 49 | + exit -1 |
| 50 | + fi |
| 51 | + |
| 52 | + if [[ $notarize_status == "in progress" ]]; then |
| 53 | + printf "." |
| 54 | + continue |
| 55 | + elif [[ $notarize_status == "success" ]]; then |
| 56 | + printf "\n" |
| 57 | + echo "Notarization Success!\n" |
| 58 | + echo $notarize_results |
| 59 | + break |
| 60 | + else |
| 61 | + printf "\n" |
| 62 | + exit -1 |
| 63 | + fi |
| 64 | +done |
| 65 | + |
| 66 | +# Step 3: Staple the notarization info to the DMG so that an offline user can |
| 67 | +# verify that it is notarized. |
| 68 | +set -x |
| 69 | +xcrun stapler staple ${macvim_dmg} |
| 70 | + |
| 71 | +# Just print out extra info for reference |
| 72 | +echo "--------------------" |
| 73 | +codesign -d --verbose=2 ${macvim_dmg} |
| 74 | +spctl -a -t open --context context:primary-signature -v ${macvim_dmg} |
0 commit comments