also looking at this
fix(release): prevent the standalone macOS CLI sandbox crash
#291
5 files
+120
-31
| @@ -237,14 +237,9 @@ jobs: | ||
| 237 | 237 | |
| 238 | 238 | - name: Sign macOS binary |
| 239 | 239 | if: runner.os == 'macOS' && env.SIGNING_AVAILABLE == 'true' |
| 240 | env: | |
| 241 | # Default to the strict distribution entitlements; CI can opt in to | |
| 242 | # the dev plist (sandbox off, library validation off) by setting | |
| 243 | # CRAFT_ENTITLEMENTS=dev for local debugging — never for release. | |
| 244 | ENTITLEMENTS_VARIANT: ${{ vars.CRAFT_ENTITLEMENTS || 'distribution' }} | |
| 245 | 240 | run: | |
| 246 | 241 | set -euo pipefail |
| 247 | ENTITLEMENTS="scripts/entitlements-${ENTITLEMENTS_VARIANT}.plist" | |
| 242 | ENTITLEMENTS="scripts/entitlements-distribution.plist" | |
| 248 | 243 | if [ ! -f "$ENTITLEMENTS" ]; then |
| 249 | 244 | echo "::error file=$ENTITLEMENTS::missing — required for hardened-runtime signing" |
| 250 | 245 | exit 1 |
| @@ -253,12 +248,21 @@ jobs: | ||
| 253 | 248 | for binary in \ |
| 254 | 249 | packages/zig/zig-out/bin/craft \ |
| 255 | 250 | packages/zig/zig-out/cross/darwin-x64/craft; do |
| 256 | codesign --force --options runtime --sign "$APPLE_SIGNING_IDENTITY" \ | |
| 251 | codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" \ | |
| 257 | 252 | --entitlements "$ENTITLEMENTS" "$binary" |
| 258 | 253 | codesign --verify --deep --strict "$binary" |
| 259 | 254 | done |
| 260 | 255 | echo "macOS ARM64 and x64 binaries signed successfully" |
| 261 | 256 | |
| 257 | - name: Verify standalone macOS launch and signatures | |
| 258 | if: runner.os == 'macOS' | |
| 259 | env: | |
| 260 | VERSION: ${{ steps.version.outputs.version }} | |
| 261 | run: | | |
| 262 | bun test scripts/macos-release.test.ts | |
| 263 | bun scripts/verify-macos-release.ts packages/zig/zig-out/bin/craft "$VERSION" | |
| 264 | bun scripts/verify-macos-release.ts packages/zig/zig-out/cross/darwin-x64/craft "$VERSION" --no-execute | |
| 265 | ||
| 262 | 266 | - name: Notarize macOS binaries |
| 263 | 267 | if: runner.os == 'macOS' && env.SIGNING_AVAILABLE == 'true' |
| 264 | 268 | run: | |
| @@ -399,6 +403,35 @@ jobs: | ||
| 399 | 403 | cat /tmp/index.out || true |
| 400 | 404 | fi |
| 401 | 405 | |
| 406 | verify-macos-downloads: | |
| 407 | name: verify downloaded ${{ matrix.platform.name }} | |
| 408 | needs: [pantry] | |
| 409 | if: ${{ !cancelled() }} | |
| 410 | strategy: | |
| 411 | fail-fast: false | |
| 412 | matrix: | |
| 413 | platform: | |
| 414 | - { os: macos-15, name: darwin-arm64 } | |
| 415 | - { os: macos-15-intel, name: darwin-x64 } | |
| 416 | runs-on: ${{ matrix.platform.os }} | |
| 417 | permissions: | |
| 418 | contents: read | |
| 419 | steps: | |
| 420 | - uses: actions/checkout@v6 | |
| 421 | - name: Setup Pantry | |
| 422 | uses: pantry-pm/pantry/packages/action@235036fa0f48bae99b2293df5a3dc35c809b1777 | |
| 423 | - name: Verify the final downloadable executable | |
| 424 | env: | |
| 425 | GH_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }} | |
| 426 | TAG: ${{ github.ref_name }} | |
| 427 | PLATFORM: ${{ matrix.platform.name }} | |
| 428 | run: | | |
| 429 | set -euo pipefail | |
| 430 | DOWNLOAD_DIR=$(mktemp -d) | |
| 431 | gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "craft-$PLATFORM.zip" --dir "$DOWNLOAD_DIR" | |
| 432 | ditto -x -k "$DOWNLOAD_DIR/craft-$PLATFORM.zip" "$DOWNLOAD_DIR/extracted" | |
| 433 | bun scripts/verify-macos-release.ts "$DOWNLOAD_DIR/extracted/craft" "${TAG#v}" | |
| 434 | ||
| 402 | 435 | npm: |
| 403 | 436 | name: npm |
| 404 | 437 | # Ordered after the binaries, not gated on them. |