mirror of
https://github.com/keepassxreboot/keepassxc.git
synced 2025-11-26 09:36:33 -05:00
4e59c1c579
Moves code signing from the release-tool to CMake and unifies the Windows-equivalent code.
102 lines
No EOL
3.9 KiB
CMake
102 lines
No EOL
3.9 KiB
CMake
# Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 2 or (at your option)
|
|
# version 3 of the License.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
# CPACK_PACKAGE_FILES is set only during POST_BUILD
|
|
if(NOT CPACK_PACKAGE_FILES) # PRE_BUILD: Sign binaries
|
|
|
|
set(PROGNAME "@PROGNAME@")
|
|
set(CODESIGN_IDENTITY "@WITH_XC_CODESIGN_IDENTITY@")
|
|
set(ENTITLEMENTS @MACOSX_BUNDLE_APPLE_ENTITLEMENTS@)
|
|
set(APP_DIR "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_IN_ONE/${PROGNAME}.app")
|
|
|
|
if(NOT CODESIGN_IDENTITY)
|
|
message(FATAL_ERROR "No codesign identity specified.")
|
|
endif()
|
|
|
|
message(STATUS "Codesign identity used: ${CODESIGN_IDENTITY}")
|
|
message(STATUS "Signing ${PROGNAME}.app, this may take while...")
|
|
|
|
# Sign all binaries
|
|
execute_process(
|
|
COMMAND xcrun codesign --sign=${CODESIGN_IDENTITY} --force --options=runtime --deep ${APP_DIR}
|
|
RESULT_VARIABLE SIGN_RESULT
|
|
OUTPUT_VARIABLE SIGN_OUTPUT
|
|
ERROR_VARIABLE SIGN_ERROR
|
|
OUTPUT_STRIP_TRAILING_WHITESPACE
|
|
ERROR_STRIP_TRAILING_WHITESPACE
|
|
ECHO_OUTPUT_VARIABLE
|
|
)
|
|
if (NOT SIGN_RESULT EQUAL 0)
|
|
message(FATAL_ERROR "Signing binaries failed: ${SIGN_ERROR}")
|
|
endif()
|
|
|
|
# (Re-)Sign main executable with --entitlements
|
|
execute_process(
|
|
COMMAND xcrun codesign --sign=${CODESIGN_IDENTITY} --force --options=runtime --deep --entitlements=${ENTITLEMENTS} ${APP_DIR}
|
|
RESULT_VARIABLE SIGN_RESULT
|
|
OUTPUT_VARIABLE SIGN_OUTPUT
|
|
ERROR_VARIABLE SIGN_ERROR
|
|
OUTPUT_STRIP_TRAILING_WHITESPACE
|
|
ERROR_STRIP_TRAILING_WHITESPACE
|
|
ECHO_OUTPUT_VARIABLE
|
|
)
|
|
if (NOT SIGN_RESULT EQUAL 0)
|
|
message(FATAL_ERROR "Signing main binary failed: ${SIGN_ERROR}")
|
|
endif()
|
|
|
|
message(STATUS "${PROGNAME}.app signed successfully.")
|
|
|
|
else() # POST_BUILD: Notarize DMG
|
|
set(KEYCHAIN_PROFILE "@WITH_XC_NOTARY_KEYCHAIN_PROFILE@")
|
|
file(GLOB_RECURSE DMG_FILE "${CPACK_PACKAGE_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.dmg")
|
|
|
|
if(NOT KEYCHAIN_PROFILE)
|
|
message(FATAL_ERROR "No notarization credentials keychain profile specified.")
|
|
endif()
|
|
|
|
# Submit for notarization
|
|
message(STATUS "Submitting DMG bundle for notarization, this may take while...")
|
|
execute_process(
|
|
COMMAND xcrun notarytool submit --keychain-profile=${KEYCHAIN_PROFILE} --wait ${DMG_FILE}
|
|
RESULT_VARIABLE NOTARIZE_RESULT
|
|
OUTPUT_VARIABLE NOTARIZE_OUTPUT
|
|
ERROR_VARIABLE NOTARIZE_ERROR
|
|
OUTPUT_STRIP_TRAILING_WHITESPACE
|
|
ERROR_STRIP_TRAILING_WHITESPACE
|
|
ECHO_OUTPUT_VARIABLE
|
|
)
|
|
if (NOT NOTARIZE_RESULT EQUAL 0)
|
|
message(FATAL_ERROR "Notarization failed: ${NOTARIZE_ERROR}")
|
|
endif()
|
|
message(STATUS "DMG bundle notarized successfully.")
|
|
|
|
# Staple tickets
|
|
message(STATUS "Stapling notarization ticket...")
|
|
execute_process(
|
|
COMMAND xcrun stapler staple ${DMG_FILE} && xcrun stapler validate ${DMG_FILE}
|
|
RESULT_VARIABLE STAPLE_RESULT
|
|
OUTPUT_VARIABLE STAPLE_OUTPUT
|
|
ERROR_VARIABLE STAPLE_ERROR
|
|
OUTPUT_STRIP_TRAILING_WHITESPACE
|
|
ERROR_STRIP_TRAILING_WHITESPACE
|
|
ECHO_OUTPUT_VARIABLE
|
|
)
|
|
if (NOT STAPLE_RESULT EQUAL 0)
|
|
message(FATAL_ERROR "Stapling failed: ${STAPLE_ERROR}")
|
|
endif()
|
|
message(STATUS "DMG bundle notarization ticket stapled successfully.")
|
|
|
|
endif() |