Sign and Notarize Mac Binaries (#464)

For details of the method, please refer to https://github.com/mondoohq/mac-signer Signed-off-by: Ben Rockwood <[email protected]>
mondoohq · Mar 21, 2023 · 3663ba2 · 3663ba2
1 parent e8fba48
commit 3663ba2
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
@@ -24,41 +24,53 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
+
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
           go-version: 1.19
+
       - name: 'Authenticate to Google Cloud'
         uses: 'google-github-actions/auth@v1'
         with:
           workload_identity_provider: ${{ secrets.GCP_WIP }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+
       - id: 'gcp_secrets'
         uses: 'google-github-actions/get-secretmanager-secrets@v1'
         with:
           secrets: |-
             code_sign_cert_b64:mondoo-base-infra/mondoo_code_sign_certificate_pfx_b64
             code_sign_cert_challenge:mondoo-base-infra/mondoo_code_sign_challenge
+
       - name: "Write RPM Signing Cert"
         run: |
           gpgkey="$(mktemp -t gpgkey.XXX)"
           base64 -d <<<"$GPG_KEY" > "$gpgkey"
           echo "GPG_KEY_PATH=$gpgkey" >> $GITHUB_ENV
         env:
           GPG_KEY: '${{ secrets.GPG_KEY}}'
+
       - name: "Write Windows Signing Cert"
         run: |
           cert="$(mktemp -t cert.XXX)"
           base64 -d <<<"$CERT_CONTENTS" > "$cert"
           echo "CERT_FILE=$cert" >> $GITHUB_ENV
         env:
           CERT_CONTENTS: '${{ steps.gcp_secrets.outputs.code_sign_cert_b64 }}'
+
+      - name: Install Quill for Mac Signing and Notarization 
+        run: |
+            curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /tmp v0.2.0
+            /tmp/quill help
+
       - name: Log in to the Container registry
         uses: docker/login-action@v2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:
@@ -69,9 +81,16 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NFPM_DEFAULT_RPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           CERT_PASSWORD: ${{ steps.gcp_secrets.outputs.code_sign_cert_challenge }}
+          QUILL_SIGN_PASSWORD: ''
+          QUILL_SIGN_P12: ${{ secrets.APPLE_SIGN_P12 }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+
       - name: Check RPMs 
         run: |
           rpm -qpi dist/*.rpm
+
       - name: Publish Release to releases.mondoo.com
         uses: peter-evans/repository-dispatch@v2
         with:

diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -38,6 +38,11 @@ builds:
       # clang + macos does not support static: - -extldflags "-static"
       - -s -w -X go.mondoo.com/cnspec.Version={{.Version}} -X go.mondoo.com/cnspec.Build={{.ShortCommit}} -X go.mondoo.com/cnspec.Date={{.Date}}
       - -X go.mondoo.com/cnquery.Version={{.Version}} -X go.mondoo.com/cnquery.Build={{.ShortCommit}} -X go.mondoo.com/cnquery.Date={{.Date}}
+    hooks:
+      post:
+        - cmd: /tmp/quill sign-and-notarize "{{ .Path }}" -vv
+          env:
+            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log          
   - id: windows
     main: ./apps/cnspec/cnspec.go
     binary: cnspec