jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-18 06:50:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

DARWIN: Add --with-macos-* packaging options

Browse Source 
To create the OpenAFS client for macOS, the current process involves
building the code, signing the binaries, creating the package, and
notarizing it. Each step is typically performed separately and requires
distinct parameters and credentials, making this process cumbersome and
difficult to follow.

To simplify this process, introduce the following '--with' options:

--with-macos-app-key
--with-macos-inst-key
--with-macos-keychain-profile

These options allow users to specify the credentials needed for signing
and notarizing the package upfront.

With these enhancements, users will be able to perform the entire
workflow - building, signing, creating, and notarizing the package -
with a single 'make packages' command, significantly simplifying this
process.

Change-Id: Ibf114f4f5bbe9bc72f37adc487c046e5243f5a97
Reviewed-on: https://gerrit.openafs.org/15977
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Andrew Deason <adeason@sinenomine.net>
This commit is contained in:
Marcio Barbosa 2024-12-16 06:42:04 -08:00 committed by Andrew Deason
parent 519a170da3
commit e316a38ba9
9 changed files with 57 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Makefile.in
View File

@ -878,8 +878,11 @@ distclean: clean
src/pam/Makefile \
src/platform/Makefile \
src/platform/${MKAFS_OSTYPE}/Makefile \
src/platform/DARWIN/growlagent/Makefile \
src/platform/DARWIN/AFSPreference/Info.plist \
src/platform/DARWIN/PrivilegedHelper/Makefile \
src/platform/DARWIN/PrivilegedHelper/privhelper-info.plist \
src/platform/DARWIN/PrivilegedHelper/privhelper.c \
src/platform/DARWIN/growlagent/Makefile \
src/procmgmt/Makefile \
src/procmgmt/test/Makefile \
src/ptserver/Makefile \

5
configure.ac
View File

@ -110,8 +110,11 @@ AC_CONFIG_FILES([
src/pam/Makefile
src/platform/Makefile
src/platform/${MKAFS_OSTYPE}/Makefile
src/platform/DARWIN/growlagent/Makefile
src/platform/DARWIN/AFSPreference/Info.plist
src/platform/DARWIN/PrivilegedHelper/Makefile
src/platform/DARWIN/PrivilegedHelper/privhelper-info.plist
src/platform/DARWIN/PrivilegedHelper/privhelper.c
src/platform/DARWIN/growlagent/Makefile
src/procmgmt/Makefile
src/procmgmt/test/Makefile
src/ptserver/Makefile

41
src/cf/options.m4
View File

@ -263,6 +263,21 @@ AC_ARG_WITH([dot],
[use graphviz dot to generate dependency graphs with doxygen (defaults to autodetect)]),
[], [with_dot="maybe"])
AC_ARG_WITH([macos-app-key],
AS_HELP_STRING([--with-macos-app-key=key],
[macOS: use the given app key to sign the code (optional, defaults to no key)]),
[AC_SUBST([MACOS_APP_KEY], [$withval])])
AC_ARG_WITH([macos-inst-key],
AS_HELP_STRING([--with-macos-inst-key=key],
[macOS: use the given inst key to sign the installer (optional, defaults to no key)]),
[AC_SUBST([MACOS_INST_KEY], [$withval])])
AC_ARG_WITH([macos-keychain-profile],
AS_HELP_STRING([--with-macos-keychain-profile=profile],
[macOS: use the given keychain profile to notarize the package (optional, defaults to no profile)]),
[AC_SUBST([MACOS_KEYCHAIN_PROFILE], [$withval])])
enable_login="no"
])
@ -312,6 +327,32 @@ else
VFSCK="vfsck"
fi
fi
AS_IF([test "x$with_macos_app_key" != "x"], [
# Retrieve the Team ID (OU field) associated with a certificate. MACOS_TEAM_ID is extracted from the
# certificate subject using openssl and awk.
#
# Example subject string:
# subject=UID=SKMME9E2Y8, CN=Developer ID Application: Org (SKMME9E2Y8), OU=SKMME9E2Y8, O=org, C=US
macos_app_key="$with_macos_app_key"
AC_MSG_CHECKING([for macOS team ID])
macos_cert=$(security find-certificate -c "$macos_app_key" -p 2>/dev/null)
AS_IF([test x"$macos_cert" = x],
[AC_MSG_ERROR([Failed to retrieve the certificate for app key: $macos_app_key])])
macos_subject=$(echo "$macos_cert" | openssl x509 -noout -subject 2>/dev/null)
AS_IF([test x"$macos_subject" = x],
[AC_MSG_ERROR([Failed to process the certificate using openssl])])
MACOS_TEAM_ID=$(echo "$macos_subject" | awk 'BEGIN { FS="OU=" } {print $[]2}' | awk 'BEGIN { FS="," } {print$[]1}')
AS_IF([test x"$MACOS_TEAM_ID" = x],
[AC_MSG_ERROR([Failed to extract the macOS Team ID])])
AC_MSG_RESULT([$MACOS_TEAM_ID])
AC_SUBST([MACOS_TEAM_ID])
])
])
AC_DEFUN([OPENAFS_MORE_OPTION_TESTS],[

6
src/packaging/MacOS/pkgbuild.sh.in
View File

@ -29,11 +29,11 @@ anypass=0
PASS1=
PASS2=
APP_KEY=
INST_KEY=
APP_KEY="@MACOS_APP_KEY@"
INST_KEY="@MACOS_INST_KEY@"
DEST_DIR=
CSDB=
KEYCHAIN_PROFILE=
KEYCHAIN_PROFILE="@MACOS_KEYCHAIN_PROFILE@"
CODESIGN_OPTS=

1
src/platform/DARWIN/AFSPreference/.gitignore vendored
View File

@ -5,3 +5,4 @@ build/*
*.mode2v3
*.perspectivev3
config
Info.plist

5
src/platform/DARWIN/AFSPreference/Info.plist → src/platform/DARWIN/AFSPreference/Info.plist.in
View File

@ -30,13 +30,10 @@
<string>OpenAFS</string>
<key>NSPrincipalClass</key>
<string>AFSCommanderPref</string>
<!-- Uncomment the following block and add your signature (XXXXXXXXXX) -->
<!--
<key>SMPrivilegedExecutables</key>
<dict>
<key>org.openafs.privhelper</key>
<string>identifier "org.openafs.privhelper" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = XXXXXXXXXX</string>
<string>identifier "org.openafs.privhelper" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = @MACOS_TEAM_ID@</string>
</dict>
-->
</dict>
</plist>

2
src/platform/DARWIN/PrivilegedHelper/.gitignore vendored
View File

@ -3,3 +3,5 @@
# to check that you haven't inadvertently ignored any tracked files.
/org.openafs.privhelper
/privhelper-info.plist
/privhelper.c

5
src/platform/DARWIN/PrivilegedHelper/privhelper-info.plist → src/platform/DARWIN/PrivilegedHelper/privhelper-info.plist.in
View File

@ -10,12 +10,9 @@
<string>privhelper</string>
<key>CFBundleVersion</key>
<string>1.0</string>
<!-- Uncomment the following block and add your signature (XXXXXXXXXX) -->
<!--
<key>SMAuthorizedClients</key>
<array>
<string>identifier "it.infn.lnf.network.openafs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = XXXXXXXXXX</string>
<string>identifier "it.infn.lnf.network.openafs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = @MACOS_TEAM_ID@</string>
</array>
-->
</dict>
</plist>

3
src/platform/DARWIN/PrivilegedHelper/privhelper.c → src/platform/DARWIN/PrivilegedHelper/privhelper.c.in
View File

@ -69,9 +69,6 @@
*
* "certificate leaf[subject.OU] = @MACOS_TEAM_ID@" means the code was signed
* by us.
*
* Replace @MACOS_TEAM_ID@ by your team ID. For example:
* "certificate leaf[subject.OU] = SKMME9E2Y8"
*/
#define CLI_SIGNATURES "((identifier \"com.apple.systempreferences.legacyLoader.x86_64\" and anchor apple) or " \
"(identifier \"com.apple.systempreferences.legacyLoader.arm64\" and anchor apple) or " \