Skip to content

Commit 0af3396

Browse files
cveticmcveticm
authored
ci: Setup signing for binaries (#27)
* Initial binary signing implementation * fixes install macos notarization service * fixes windows_notarize.sh * fix window notarization * fixes mac signing * mac fix * fixes post check * Shellcheck fix and disable release on patch
1 parent efe30fc commit 0af3396

File tree

5 files changed

+105
-0
lines changed

5 files changed

+105
-0
lines changed

‎build/ci/release.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,18 @@ functions:
5353
set -Eeou pipefail
5454
5555
curl -sfL ${goreleaser_pro_tar_gz} | tar zx
56+
"install macos notarization service":
57+
- command: shell.exec
58+
type: setup
59+
params:
60+
working_dir: src/github.com/mongodb/atlas-cli-plugin-kubernetes
61+
include_expansions_in_env:
62+
- notary_service_url
63+
script: |
64+
set -Eeou pipefail
65+
curl "${notary_service_url}" --output macos-notary.zip
66+
unzip -u macos-notary.zip
67+
chmod 755 ./linux_amd64/macnotary
5668
"generate notices":
5769
- command: subprocess.exec
5870
type: test
@@ -73,6 +85,7 @@ functions:
7385
ARTIFACTORY_PASSWORD: ${artifactory_password}
7486
GRS_USERNAME: ${garasign_username}
7587
GRS_PASSWORD: ${garasign_password}
88+
AUTHENTICODE_KEY_NAME: ${authenticode_key_name}
7689
GITHUB_TOKEN: ${github_token}
7790
include_expansions_in_env:
7891
- go_base_path
@@ -127,6 +140,7 @@ tasks:
127140
commands:
128141
- func: "generate notices"
129142
- func: "install goreleaser"
143+
- func: "install macos notarization service"
130144
- func: "install gh-token"
131145
- func: "package"
132146
- name: copybara

‎build/package/.goreleaser.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,21 @@ builds:
2323
id: macos
2424
goos: [darwin]
2525
goarch: [amd64,arm64]
26+
hooks:
27+
# This will notarize Apple binaries and replace goreleaser bins with the notarized ones
28+
post:
29+
- cmd: ./build/package/mac_notarize.sh
30+
output: true
2631
- <<: *build_defaults
2732
id: windows
2833
goos: [windows]
2934
goarch: [amd64]
3035
goamd64: [v1]
36+
hooks:
37+
# This will notarize the Windows binary and replace goreleaser bin with the notarized one
38+
post:
39+
- cmd: ./build/package/windows_notarize.sh
40+
output: true
3141
gomod: # https://goreleaser.com/customization/verifiable_builds/
3242
# Proxy a module from proxy.golang.org, making the builds verifiable.
3343
# This will only be effective if running against a tag. Snapshots will ignore

‎build/package/mac_notarize.sh

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2025 MongoDB Inc
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -Eeou pipefail
18+
19+
# mac_notarize generated binaries with Apple and replace the original binary with the notarized one
20+
# This depends on binaries being generated in a goreleaser manner and gon being set up.
21+
# goreleaser should already take care of calling this script as a hook.
22+
23+
if [[ -f "./dist/macos_darwin_amd64_v1/atlas-cli-plugin-kubernetes" && -f "./dist/macos_darwin_arm64/atlas-cli-plugin-kubernetes" && ! -f "./dist/atlas-cli-plugin-kubernetes_macos_signed.zip" ]]; then
24+
echo "notarizing macOs binaries"
25+
zip -r ./dist/atlas-cli-plugin-kubernetes_amd64_arm64_bin.zip ./dist/macos_darwin_amd64_v1/atlas-cli-plugin-kubernetes ./dist/macos_darwin_arm64/atlas-cli-plugin-kubernetes # The Notarization Service takes an archive as input
26+
./linux_amd64/macnotary \
27+
-f ./dist/atlas-cli-plugin-kubernetes_amd64_arm64_bin.zip \
28+
-m notarizeAndSign -u https://dev.macos-notary.build.10gen.cc/api \
29+
-b com.mongodb.atlas-cli-plugin-kubernetes \
30+
-o ./dist/atlas-cli-plugin-kubernetes_macos_signed.zip
31+
32+
echo "replacing original files"
33+
unzip -oj ./dist/atlas-cli-plugin-kubernetes_macos_signed.zip dist/macos_darwin_amd64_v1/atlas-cli-plugin-kubernetes -d ./dist/macos_darwin_amd64_v1/
34+
unzip -oj ./dist/atlas-cli-plugin-kubernetes_macos_signed.zip dist/macos_darwin_arm64/atlas-cli-plugin-kubernetes -d ./dist/macos_darwin_arm64/
35+
fi

‎build/package/package.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,12 @@ make generate-all-manifests
3232

3333
# avoid race conditions on the notarization step by using `-p 1`
3434
./bin/goreleaser release --config "build/package/.goreleaser.yml" --clean -p 1
35+
36+
# check that the notarization service signed the mac binaries
37+
SIGNED_FILE_NAME=atlas-cli-plugin-kubernetes_macos_signed.zip
38+
if [[ -f "dist/$SIGNED_FILE_NAME" ]]; then
39+
echo "$SIGNED_FILE_NAME exists. The Mac notarization service has run."
40+
else
41+
echo "ERROR: $SIGNED_FILE_NAME does not exist. The Mac notarization service has not run."
42+
exit 1 # ERROR
43+
fi

‎build/package/windows_notarize.sh

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2025 MongoDB Inc
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -Eeou pipefail
18+
19+
EXE_FILE="./dist/windows_windows_amd64_v1/atlas-cli-plugin-kubernetes.exe"
20+
21+
if [[ -f "$EXE_FILE" ]]; then
22+
echo "${ARTIFACTORY_PASSWORD}" | podman login --password-stdin --username "${ARTIFACTORY_USERNAME}" artifactory.corp.mongodb.com
23+
24+
echo "GRS_CONFIG_USER1_USERNAME=${GRS_USERNAME}" > .env
25+
echo "GRS_CONFIG_USER1_PASSWORD=${GRS_PASSWORD}" >> .env
26+
27+
echo "signing $EXE_FILE"
28+
podman run \
29+
--env-file=.env \
30+
--rm \
31+
-v "$(pwd):$(pwd)" \
32+
-w "$(pwd)" \
33+
artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-jsign \
34+
/bin/bash -c "jsign --tsaurl http://timestamp.digicert.com -a ${AUTHENTICODE_KEY_NAME} \"$EXE_FILE\""
35+
36+
rm .env
37+
fi

0 commit comments

Comments
 (0)