ci(release): Developer ID署名とnotarizationでGatekeeper警告をなくす - #102
Merged
Conversation
Replace ad-hoc signing in the release workflow with real Developer ID Application signing, Apple notarization, and stapling so downloaded builds no longer trigger the 'unidentified developer' Gatekeeper warning. - Import the Developer ID certificate from a base64 secret into a throwaway keychain and derive the signing identity automatically. Fall back to ad-hoc signing when the secret is absent (e.g. forks). - Sign inside-out (helper binary, then app bundle) with hardened runtime, entitlements, and a secure timestamp. - Notarize and staple the .app itself, not just the DMG, so Gatekeeper approves it on first launch even with Wi-Fi off (Wisp is offline-first). - Notarize and staple the DMG as well. Requires new repository secrets: MACOS_CERTIFICATE_P12_BASE64, MACOS_CERTIFICATE_PASSWORD, APPLE_NOTARY_KEY_ID, APPLE_NOTARY_ISSUER_ID, APPLE_NOTARY_KEY_P8_BASE64.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
リリースワークフローのアドホック署名を、Developer ID Application署名 + Appleの公証（notarization）+ stapling に置き換えます。GitHub ReleasesからダウンロードしたWisp.app / DMGを、Gatekeeperが正規の配布物として検証できるようにします。
Important
Apple Developer Programへの加入、Developer ID証明書の発行、App Store Connect Team Keyの発行、GitHub Secretsの登録は完了済みです。現在は初回のapp公証が
In Progressのため、end-to-end確認が終わるまでdraftを維持します。非同期notarization
Appleの初回公証が長時間
In Progressになる場合でもmacOSランナーを占有しないよう、提出と後続処理を分離しました。.github/workflows/release.yaml）.appをZIPにしてnotarytool submit（--waitなし）.github/workflows/notary-monitor.yaml）notarytool historyとnotarytool infoで状態確認In Progress: 即終了して次回cronへAccepted（app）: appへticketをstapleし、DMGを作成・非同期提出Accepted（DMG）: DMGへticketをstapleし、test ArtifactまたはGitHub Releaseを公開Invalid/Rejected: notary logをdiagnostic Artifactへ保存して失敗wisp-notary-app-*→wisp-notary-dmg-*→wisp-notary-done-*のimmutable Actions Artifactで状態遷移releaseのmonitor_only: trueから手動実行可能appとDMGを別々に公証するため、DMGだけでなく内包するWisp.appにもticketをstapleでき、オフライン初回起動にも対応します。
GitHub Secrets
以下は登録済みです。
MACOS_CERTIFICATE_P12_BASE64MACOS_CERTIFICATE_PASSWORDAPPLE_NOTARY_KEY_IDAPPLE_NOTARY_ISSUER_IDAPPLE_NOTARY_KEY_P8_BASE64公証用の鍵は、Individual Keyではなく
notarytool対応のApp Store Connect Team Keyです。検証
actionlint+ ShellCheck: 成功In ProgressAppleがappを
Acceptedにした後、app stapling → DMG提出 → DMG stapling → 最終Artifact生成まで確認します。