Skip to content

Commit f3a5097

Browse files
akien-mgaakien-mga
authored
Merge pull request #24 from godotengine/macos-mono-codesign
Mono/macOS: Change .app packaging and codesign editor binary
2 parents e0da42a + c371cdd commit f3a5097

File tree

2 files changed

+75
-43
lines changed

2 files changed

+75
-43
lines changed

‎build-macosx/editor_mono.entitlements‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-jit</key>
8+
<true/>
9+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
10+
<true/>
11+
<key>com.apple.security.cs.disable-library-validation</key>
12+
<true/>
13+
<key>com.apple.security.device.audio-input</key>
14+
<true/>
15+
<key>com.apple.security.device.camera</key>
16+
<true/>
17+
</dict>
18+
</plist>

‎build-release.sh‎

Lines changed: 57 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,61 @@ else
1414
echo "Disabling binary signing as config.sh does not define the required data."
1515
fi
1616

17-
function sign {
17+
sign_windows() {
1818
if [ $can_sign == 0 ]; then
1919
return
2020
fi
2121
./osslsigncode -pkcs12 ${SIGN_KEYSTORE} -pass "${SIGN_PASSWORD}" -n "${SIGN_NAME}" -i "${SIGN_URL}" -t http://timestamp.comodoca.com -in $1 -out $1-signed
2222
mv $1-signed $1
2323
}
2424

25+
sign_macos() {
26+
if [ ! -z "${OSX_HOST}" ]; then
27+
osx_tmpdir=$(ssh "${OSX_HOST}" "mktemp -d")
28+
reldir="$1"
29+
binname="$2"
30+
is_mono="$3"
31+
32+
if [[ "${is_mono}" == "1" ]]; then
33+
appname="Godot_mono.app"
34+
entitlements=editor_mono.entitlements
35+
sharpdir="${appname}/Contents/Resources/GodotSharp"
36+
extra_files="${sharpdir}/Mono/lib/*.dylib ${sharpdir}/Tools/aot-compilers/*/*"
37+
else
38+
appname="Godot.app"
39+
entitlements=editor.entitlements
40+
fi
41+
42+
scp "${reldir}/${binname}.zip" "${OSX_HOST}:${osx_tmpdir}"
43+
scp "${basedir}/build-macosx/${entitlements}" "${OSX_HOST}:${osx_tmpdir}"
44+
ssh "${OSX_HOST}" "
45+
cd ${osx_tmpdir} && \
46+
unzip ${binname}.zip && \
47+
codesign --force --timestamp \
48+
--options=runtime --entitlements ${entitlements} \
49+
-s ${OSX_KEY_ID} -v ${extra_files} ${appname} && \
50+
zip -r ${binname}_signed.zip ${appname}"
51+
52+
request_uuid=$(ssh "${OSX_HOST}" "xcrun altool --notarize-app --primary-bundle-id \"${OSX_BUNDLE_ID}\" --username \"${APPLE_ID}\" --password \"${APPLE_ID_PASSWORD}\" --file ${osx_tmpdir}/${binname}_signed.zip")
53+
request_uuid=$(echo ${request_uuid} | sed -e 's/.*RequestUUID = //')
54+
ssh "${OSX_HOST}" "while xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*in\ progress; do echo Waiting on Apple notarization...; sleep 30s; done"
55+
if ! ssh "${OSX_HOST}" "xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*success"; then
56+
echo "Notarization failed."
57+
notarization_log=$(ssh "${OSX_HOST}" "xcrun altool --notarization-info ${request_uuid} -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\"")
58+
echo "${notarization_log}"
59+
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
60+
exit 1
61+
else
62+
ssh "${OSX_HOST}" "
63+
cd ${osx_tmpdir} && \
64+
xcrun stapler staple ${appname} && \
65+
zip -r ${binname}_stapled.zip ${appname}"
66+
scp "${OSX_HOST}:${osx_tmpdir}/${binname}_stapled.zip" ${reldir}/${binname}.zip
67+
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
68+
fi
69+
fi
70+
}
71+
2572
godot_version=""
2673
templates_version=""
2774
build_classical=1
@@ -117,14 +164,14 @@ if [ "${build_classical}" == "1" ]; then
117164
binname="${godot_basename}_win64.exe"
118165
cp out/windows/x64/tools/godot.windows.opt.tools.64.exe ${binname}
119166
strip ${binname}
120-
sign ${binname}
167+
sign_windows ${binname}
121168
zip -q -9 "${reldir}/${binname}.zip" ${binname}
122169
rm ${binname}
123170

124171
binname="${godot_basename}_win32.exe"
125172
cp out/windows/x86/tools/godot.windows.opt.tools.32.exe ${binname}
126173
strip ${binname}
127-
sign ${binname}
174+
sign_windows ${binname}
128175
zip -q -9 "${reldir}/${binname}.zip" ${binname}
129176
rm ${binname}
130177

@@ -147,34 +194,7 @@ if [ "${build_classical}" == "1" ]; then
147194
chmod +x Godot.app/Contents/MacOS/Godot
148195
zip -q -9 -r "${reldir}/${binname}.zip" Godot.app
149196
rm -rf Godot.app
150-
151-
if [ ! -z "${OSX_HOST}" ]; then
152-
osx_tmpdir=$(ssh "${OSX_HOST}" "mktemp -d")
153-
154-
scp "${reldir}/${binname}.zip" "${OSX_HOST}:${osx_tmpdir}"
155-
scp "${basedir}/build-macosx/editor.entitlements" "${OSX_HOST}:${osx_tmpdir}"
156-
ssh "${OSX_HOST}" "
157-
cd ${osx_tmpdir} && \
158-
unzip ${binname}.zip &&\
159-
codesign --timestamp --options=runtime --entitlements editor.entitlements -s ${OSX_KEY_ID} -v Godot.app/Contents/MacOS/Godot && \
160-
zip -r ${binname}_signed.zip Godot.app"
161-
162-
request_uuid=$(ssh "${OSX_HOST}" "xcrun altool --notarize-app --primary-bundle-id \"${OSX_BUNDLE_ID}\" --username \"${APPLE_ID}\" --password \"${APPLE_ID_PASSWORD}\" --file ${osx_tmpdir}/${binname}_signed.zip")
163-
request_uuid=$(echo ${request_uuid} | sed -e 's/.*RequestUUID = //')
164-
ssh "${OSX_HOST}" "while xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*in\ progress; do echo Waiting on Apple signature; sleep 30s; done"
165-
if ! ssh "${OSX_HOST}" "xcrun altool --notarization-history 0 -u \"${APPLE_ID}\" -p \"${APPLE_ID_PASSWORD}\" | grep -q ${request_uuid}.*success"; then
166-
echo "Signing failed?"
167-
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
168-
exit 1
169-
else
170-
ssh "${OSX_HOST}" "
171-
cd ${osx_tmpdir} && \
172-
xcrun stapler staple Godot.app && \
173-
zip -r ${binname}_stapled.zip Godot.app"
174-
scp "${OSX_HOST}:${osx_tmpdir}/${binname}_stapled.zip" ${reldir}/${binname}.zip
175-
ssh "${OSX_HOST}" "rm -rf ${osx_tmpdir}"
176-
fi
177-
fi
197+
sign_macos ${reldir} ${binname} 0
178198

179199
# Templates
180200
rm -rf osx_template.app
@@ -366,28 +386,22 @@ if [ "${build_mono}" == "1" ]; then
366386
binname="${godot_basename}_mono_osx.64"
367387
rm -rf Godot_mono.app
368388
cp -r git/misc/dist/osx_tools.app Godot_mono.app
369-
mkdir -p Godot_mono.app/Contents/MacOS
389+
mkdir -p Godot_mono.app/Contents/{MacOS,Resources}
370390
cp out/macosx/tools-mono/godot.osx.opt.tools.x86_64.mono Godot_mono.app/Contents/MacOS/Godot
371-
mkdir -p Godot_mono.app/Contents/{Frameworks,Resources}
372-
mkdir -p Godot_mono.app/Contents/{Frameworks,Resources}/GodotSharp
373-
mkdir -p Godot_mono.app/Contents/{Frameworks,Resources}/GodotSharp/Mono
374-
cp -rp out/macosx/tools-mono/GodotSharp/Api Godot_mono.app/Contents/Frameworks/GodotSharp
375-
cp -rp out/macosx/tools-mono/GodotSharp/Mono/lib Godot_mono.app/Contents/Frameworks/GodotSharp/Mono
376-
cp -rp out/macosx/tools-mono/GodotSharp/Tools Godot_mono.app/Contents/Frameworks/GodotSharp
377-
cp -rp out/macosx/tools-mono/GodotSharp/Mono/etc Godot_mono.app/Contents/Resources/GodotSharp/Mono
378-
cp -rp out/aot-compilers Godot_mono.app/Contents/Frameworks/GodotSharp/Tools/
391+
cp -rp out/macosx/tools-mono/GodotSharp Godot_mono.app/Contents/Resources/GodotSharp
392+
cp -rp out/aot-compilers Godot_mono.app/Contents/Resources/GodotSharp/Tools/
379393
chmod +x Godot_mono.app/Contents/MacOS/Godot
380394
zip -q -9 -r "${reldir_mono}/${binname}.zip" Godot_mono.app
381395
rm -rf Godot_mono.app
396+
sign_macos ${reldir_mono} ${binname} 1
382397

383398
# Templates
384399
rm -rf osx_template.app
385400
cp -r git/misc/dist/osx_template.app .
386-
mkdir -p osx_template.app/Contents/MacOS
387-
401+
mkdir -p osx_template.app/Contents/{MacOS,Resources}
388402
cp out/macosx/templates-mono/godot.osx.opt.debug.x86_64.mono osx_template.app/Contents/MacOS/godot_osx_debug.64
389403
cp out/macosx/templates-mono/godot.osx.opt.x86_64.mono osx_template.app/Contents/MacOS/godot_osx_release.64
390-
cp -rp out/macosx/templates-mono/data.mono.osx.64.* osx_template.app/Contents/MacOS/
404+
cp -rp out/macosx/templates-mono/data.mono.osx.64.* osx_template.app/Contents/Resources/
391405
chmod +x osx_template.app/Contents/MacOS/godot_osx*
392406
zip -q -9 -r "${templatesdir_mono}/osx.zip" osx_template.app
393407
rm -rf osx_template.app

0 commit comments

Comments
 (0)