#!/usr/bin/env bashset -euo pipefail binary=${1:-}require_signing=${GITCRAWL_REQUIRE_CODESIGN:-0}identifier=org.openclaw.gitcrawlexpected_team_id=FWJYW4S8P8expected_authority="Developer ID Application: OpenClaw Foundation ($expected_team_id)"requirement="identifier \"$identifier\" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = \"$expected_team_id\"" if [[ -z "$binary" ]]; then echo "usage: $0 <path-to-binary>" >&2 exit 2fiif [[ ! -f "$binary" ]]; then echo "codesign: binary not found: $binary" >&2 exit 2fi if [[ "$require_signing" != 1 ]]; then exit 0fi [[ "$(uname -s)" == Darwin ]] || { echo "codesign: official macOS release signing requires a macOS runner" >&2 exit 1} identity=${CODESIGN_IDENTITY:-}[[ "$identity" == "$expected_authority" ]] || { echo "codesign: official macOS releases require $expected_authority" >&2 exit 1}[[ -n "${NOTARYTOOL_KEYCHAIN_PROFILE:-}" ]] || { echo "codesign: NOTARYTOOL_KEYCHAIN_PROFILE is required at runtime" >&2 exit 1} for tool in codesign ditto mktemp mv plutil xcrun; do command -v "$tool" >/dev/null 2>&1 || { echo "codesign: missing required command: $tool" >&2 exit 1 }done binary_dir=$(cd "$(dirname "$binary")" && pwd)binary_name=$(basename "$binary")work_dir=$(mktemp -d "$binary_dir/.gitcrawl-notary.XXXXXX")candidate="$work_dir/$binary_name"submission="$work_dir/$binary_name.zip"trap 'rm -rf "$work_dir"' EXIT # Keep the GoReleaser output unchanged unless the complete signing and# notarization contract succeeds.cp -p "$binary" "$candidate"codesign --force \ --options runtime \ --timestamp \ --identifier "$identifier" \ --sign "$identity" \ "$candidate"codesign --verify --strict -R="$requirement" --verbose=2 "$candidate" signature=$(codesign -dvvv "$candidate" 2>&1)grep -Fx "Identifier=$identifier" <<<"$signature" >/dev/nullgrep -Fx "TeamIdentifier=$expected_team_id" <<<"$signature" >/dev/nullgrep -Fx "Authority=$expected_authority" <<<"$signature" >/dev/null ditto -c -k --sequesterRsrc --keepParent "$candidate" "$submission"notary_result=$(xcrun notarytool submit "$submission" \ --keychain-profile "$NOTARYTOOL_KEYCHAIN_PROFILE" \ --no-s3-acceleration \ --wait \ --output-format json)notary_status=$(plutil -extract status raw -o - - <<<"$notary_result")notary_id=$(plutil -extract id raw -o - - <<<"$notary_result")[[ "$notary_status" == Accepted ]] || { echo "codesign: notarization status is ${notary_status:-missing}, expected Accepted" >&2 exit 1}[[ "$notary_id" =~ ^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$ ]] || { echo "codesign: notarization response has an invalid submission id" >&2 exit 1} codesign --verify --strict --check-notarization -R=notarized "$candidate"mv -f "$candidate" "$binary"
#!/usr/bin/env bash
set -euo pipefail
binary=${1:-}
require_signing=${GITCRAWL_REQUIRE_CODESIGN:-0}
identifier=org.openclaw.gitcrawl
expected_team_id=FWJYW4S8P8
expected_authority="Developer ID Application: OpenClaw Foundation ($expected_team_id)"
requirement="identifier \"$identifier\" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = \"$expected_team_id\""
if [[ -z "$binary" ]]; then
echo "usage: $0 <path-to-binary>" >&2
exit 2
fi
if [[ ! -f "$binary" ]]; then
echo "codesign: binary not found: $binary" >&2
exit 2
fi
if [[ "$require_signing" != 1 ]]; then
exit 0
fi
[[ "$(uname -s)" == Darwin ]] || {
echo "codesign: official macOS release signing requires a macOS runner" >&2
exit 1
}
identity=${CODESIGN_IDENTITY:-}
[[ "$identity" == "$expected_authority" ]] || {
echo "codesign: official macOS releases require $expected_authority" >&2
exit 1
}
[[ -n "${NOTARYTOOL_KEYCHAIN_PROFILE:-}" ]] || {
echo "codesign: NOTARYTOOL_KEYCHAIN_PROFILE is required at runtime" >&2
exit 1
}
for tool in codesign ditto mktemp mv plutil xcrun; do
command -v "$tool" >/dev/null 2>&1 || {
echo "codesign: missing required command: $tool" >&2
exit 1
}
done
binary_dir=$(cd "$(dirname "$binary")" && pwd)
binary_name=$(basename "$binary")
work_dir=$(mktemp -d "$binary_dir/.gitcrawl-notary.XXXXXX")
candidate="$work_dir/$binary_name"
submission="$work_dir/$binary_name.zip"
trap 'rm -rf "$work_dir"' EXIT
# Keep the GoReleaser output unchanged unless the complete signing and
# notarization contract succeeds.
cp -p "$binary" "$candidate"
codesign --force \
--options runtime \
--timestamp \
--identifier "$identifier" \
--sign "$identity" \
"$candidate"
codesign --verify --strict -R="$requirement" --verbose=2 "$candidate"
signature=$(codesign -dvvv "$candidate" 2>&1)
grep -Fx "Identifier=$identifier" <<<"$signature" >/dev/null
grep -Fx "TeamIdentifier=$expected_team_id" <<<"$signature" >/dev/null
grep -Fx "Authority=$expected_authority" <<<"$signature" >/dev/null
ditto -c -k --sequesterRsrc --keepParent "$candidate" "$submission"
notary_result=$(xcrun notarytool submit "$submission" \
--keychain-profile "$NOTARYTOOL_KEYCHAIN_PROFILE" \
--no-s3-acceleration \
--wait \
--output-format json)
notary_status=$(plutil -extract status raw -o - - <<<"$notary_result")
notary_id=$(plutil -extract id raw -o - - <<<"$notary_result")
[[ "$notary_status" == Accepted ]] || {
echo "codesign: notarization status is ${notary_status:-missing}, expected Accepted" >&2
exit 1
}
[[ "$notary_id" =~ ^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$ ]] || {
echo "codesign: notarization response has an invalid submission id" >&2
exit 1
}
codesign --verify --strict --check-notarization -R=notarized "$candidate"
mv -f "$candidate" "$binary"