blob: 0c9b2074d42dc10295f03f6de322f44d0512b8da (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
#!/bin/bash
#
# USAGE
# notarize-dmg -u <developer id> "/path/to/Wireshark x.y.z arch.dmg"
# https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution
# https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution/customizing_the_notarization_workflow
bundle_id="org.wireshark.dmg.$( printf "%04x" $RANDOM )"
# Parse command line arguments
while getopts u: OPTCHAR
do
case $OPTCHAR in
u)
username="$OPTARG"
shift 2
;;
*)
echo "Invalid command line option"
exit 2 ;;
esac
done
dmg_file="$1"
if [[ "$username" != *?@*? ]] ; then
echo "Username doesn't appear to be a valid Apple developer ID."
exit 1
fi
if [ ! -r "$dmg_file" ] ; then
echo "Can't find file: ${dmg_file:-No file specified}"
exit 1
fi
# XXX Set account to $username instead?
generic_pw_service="WS_DMG_NOTARIZE"
if ! security find-generic-password -a "$username" -s "$generic_pw_service" > /dev/null 2>&1 ; then
echo -e "No keychain credentials found. You can add them by running\\n"
echo -e " security add-generic-password -a $username -s $generic_pw_service -T altool -w\\n"
exit 2
fi
echo -e "Notarizing $dmg_file\\n"
echo -e "SHA256 pre: $(shasum -a 256 "$dmg_file" | awk '{print $1}' )\\n"
if ! altool_out=$( mktemp /tmp/notarize-dmg.out.XXXXX ) ; then
echo "Unable to create temp file"
exit 1
fi
# trap 'rm -f "$altool_out"' EXIT
max_upload_wait=$(( 5 * 60))
start=$SECONDS
while test -n "$( find "$HOME"/Library/Caches/com.apple.amp.itmstransporter/UploadTokens -iname "*.token" -mtime -4h )" ; do
echo -e "Another upload in progress. Waiting 5s\xe2\x80\xa6"
sleep 5
elapsed=$(( SECONDS - start ))
if [[ $elapsed -gt $max_upload_wait ]] ; then
echo "Timed out after ${max_upload_wait}s"
exit 1
fi
done
xcrun altool \
--notarize-app \
--type osx \
--username "$username" \
--password "@keychain:${generic_pw_service}" \
--primary-bundle-id "$bundle_id" \
--file "$dmg_file" \
2>&1 | tee "$altool_out"
request_uuid=$( awk '/^RequestUUID/ { print $3 }' < "$altool_out")
if [[ "$request_uuid" != *-*-*-*-* ]] ; then
echo "Unable to fetch request UUID"
exit 1
fi
eval_info_cmd=(xcrun altool \
--eval-info "$request_uuid" \
--user "$username" \
--password "@keychain:${generic_pw_service}" \
)
max_upload_wait=300
start=$SECONDS
max_status_wait=$(( 20 * 60))
start=$SECONDS
while true ; do
printf "\\nWaiting 15s \xe2\x80\xa6 "
sleep 15
elapsed=$(( SECONDS - start ))
echo "done. Checking status after ${elapsed}s"
"${eval_info_cmd[@]}" 2>&1 | tee "$altool_out"
grep "Status: in progress" "$altool_out" > /dev/null 2>&1 || break
if [[ $elapsed -gt $max_status_wait ]] ; then break ; fi
done
staple_cmd=(xcrun stapler staple "$dmg_file")
if ! grep "Status: success" "$altool_out" > /dev/null 2>&1 ; then
echo "Notarization failed or timed out:"
cat "$altool_out"
echo -e "\\nInfo command:"
echo "${eval_info_cmd[@]}"
echo -e "\\nStaple command:"
echo "${staple_cmd[@]}"
exit 1
fi
echo -e "\\nStapling $dmg_file"
"${staple_cmd[@]}"
echo -e "\\nSHA256 post: $(shasum -a 256 "$dmg_file" | awk '{print $1}' )"
|