From ef78d8e62869b6ce13c9e9b6a76cd6e8524424fd Mon Sep 17 00:00:00 2001 From: Charlie Fenton Date: Tue, 30 Oct 2018 03:29:09 -0700 Subject: [PATCH] Mac: changes to allow submission to Apple for "notarizing" --- mac_installer/release_boinc.sh | 108 ++++++++++++++++++++++++--------- 1 file changed, 78 insertions(+), 30 deletions(-) diff --git a/mac_installer/release_boinc.sh b/mac_installer/release_boinc.sh index 1293940ef0..556a9b5752 100644 --- a/mac_installer/release_boinc.sh +++ b/mac_installer/release_boinc.sh @@ -47,6 +47,7 @@ ## updated 6/4/17 by Charlie Fenton for compatibility with Xcode versions > 5.0.2 ## updated 10/19/17 by Charlie Fenton for different path to boinc_logo_black.jpg ## updated 11/11/17 by Charlie Fenton make all user-writable to help auto-attach +## updated 10/30/18 by Charlie Fenton to code sign for Apple "notarization" ## ## NOTE: This script requires Mac OS 10.6 or later, and uses XCode developer ## tools. So you must have installed XCode Developer Tools on the Mac @@ -104,6 +105,26 @@ ## For example, if the version is 3.2.1: ## source [path_to_this_script] 3 2 1 -dev +## As of OS 10.14 Mojave, Apple has introduced a new level of security which +## Apple calls "notarization". Under OS 10.14, the only difference is that +## Gatekeeper adds the sentence "Apple checked it for malicious software and +## found none." However, Apple has warned: "In an upcoming release of macOS, +## Gatekeeper will require Developer ID–signed software to be notarized by +## Apple." +## +## To notarize the installer and uninstaller: +## - Use the command line tools in Xcode 10 or later +## - Provide valid application & installer code signing identities as above +## - In Terminal": +## $ xcrun altool --notarize-app -t osx -f {path to ...macOSX_x86_64.zip} +## $ xcrun stapler staple {path to "...macOSX_x86_64/BOINC Installer.app"} +## $ xcrun stapler staple {path to "...macOSX_x86_64/extras/Uninstall BOINC.app"} +## - delete or rename the original ...macOSX_x86_64.zip} +## - Run this ditto command again to create a new ...macOSX_x86_64.zip containing +## the updated (notarized) BOINC Installer.app and Uninstall BOINC.app: +## $ ditto -ck --sequesterRsrc --keepParent boinc_$1.$2.$3_macOSX_$arch boinc_$1.$2.$3_macOSX_$arch.zip +## + if [ $# -lt 3 ]; then echo "Usage:" echo " cd [path]/boinc" @@ -229,7 +250,7 @@ cp -fpRL "${BUILDPATH}/BOINCManager.app" ../BOINC_Installer/Pkg_Root/Application ## was the last version of Xcode which supported building with Garbage Collection, so we ## have saved the screensaver executable with GC as a binary. Add it to the screen saver ## passed to the BOINC installer. At install time, he BOINC installer will select the -## correct binary for the version of OS X and delete the other one. This scripy assumes +## correct binary for the version of OS X and delete the other one. This script assumes ## that $BUILDPATH/BOINCSaver.saver was built to use Automatic Reference Counting (ARC) ## and not built to use GC. cp -fpRL "${BUILDPATH}/BOINCSaver.saver" ../BOINC_Installer/Pkg_Root/Library/Screen\ Savers/ @@ -256,31 +277,6 @@ sudo chown -R root:admin ../BOINC_Installer/Installer\ Scripts/* sudo chmod -R u+rw,g+r-w,o+r-w ../BOINC_Installer/Installer\ Resources/* sudo chmod -R u+rw,g+r-w,o+r-w ../BOINC_Installer/Installer\ Scripts/* - -## If you wish to code sign the client, manager, installer and uninstaller, -## create a file ~/BOINCCodeSignIdentities.txt whose first line is the -## application code signing identity and whose second line is the installer -## code signing identity. -## If you wish to also code sign the installer package, add a second line -## to ~/BOINCCodeSignIdentities.txt with the installer code signing identity. -## -## Code signing using a registered Apple Developer ID is necessary for GateKeeper -## with default settings to allow running downloaded applications under OS 10.8 -## Although code signing the installer application is sufficient to satisfy -## GateKeeper, OS X's software firewall can interfere with RPCs between the -## client and manager. Signing them may make this less likely to be a problem. -if [ -e "${HOME}/BOINCCodeSignIdentities.txt" ]; then - exec 8<"${HOME}/BOINCCodeSignIdentities.txt" - read APPSIGNINGIDENTITY <&8 - read INSTALLERSIGNINGIDENTITY <&8 - - # Code Sign the BOINC client if we have a signing identity - sudo codesign -f -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Applications/BOINCManager.app/Contents/Resources/boinc" - - # Code Sign the BOINC Manager if we have a signing identity - sudo codesign -f -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Applications/BOINCManager.app" -fi - sudo rm -dfR ../BOINC_Installer/New_Release_$1_$2_$3/ mkdir -p ../BOINC_Installer/New_Release_$1_$2_$3/ @@ -321,6 +317,61 @@ cp -fpRL "${BUILDPATH}/BOINC Installer.app" ../BOINC_Installer/New_Release_$1_$2 cp -fpR "${BUILDPATH}/PostInstall.app" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/BOINC Installer.app/Contents/Resources" + +## If you wish to code sign the client, manager, installer and uninstaller, +## create a file ~/BOINCCodeSignIdentities.txt whose first line is the +## application code signing identity and whose second line is the installer +## code signing identity. +## If you wish to also code sign the installer package, add a second line +## to ~/BOINCCodeSignIdentities.txt with the installer code signing identity. +## +## Code signing using a registered Apple Developer ID is necessary for GateKeeper +## with default settings to allow running downloaded applications under OS 10.8 +## Although code signing the installer application is sufficient to satisfy +## GateKeeper, OS X's software firewall can interfere with RPCs between the +## client and manager. Signing them may make this less likely to be a problem. +if [ -e "${HOME}/BOINCCodeSignIdentities.txt" ]; then + exec 8<"${HOME}/BOINCCodeSignIdentities.txt" + read APPSIGNINGIDENTITY <&8 + read INSTALLERSIGNINGIDENTITY <&8 + + # Code Sign the switcher utility if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Application Support/BOINC Data/switcher/switcher" + + # Code Sign the setprojectgrp utility if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Application Support/BOINC Data/switcher/setprojectgrp" + + # Code Sign the boincscr graphics app if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Application Support/BOINC Data/boincscr" + + # Code Sign the BOINC screensaver code for OS 10.6 and OS 10.7 if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Screen Savers/BOINCSaver.saver/Contents/MacOS/BOINCSaver_MacOS10_6_7" + + # Code Sign the gfx_switcher utility embedded in BOINC screensaver if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Screen Savers/BOINCSaver.saver/Contents/Resources/gfx_switcher" + + # Code Sign the BOINC screensaver code for OS 10.8 and later if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Library/Screen Savers/BOINCSaver.saver" + + # Code Sign the BOINC client embedded in the Manager if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Applications/BOINCManager.app/Contents/Resources/boinc" + + # Code Sign the BOINC Manager if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/Pkg_Root/Applications/BOINCManager.app" + + # Code Sign boinc_finish_install app emebdded in the PostInstall app if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/BOINC Installer.app/Contents/Resources/PostInstall.app/Contents/Resources/boinc_finish_install" + + # Code Sign the PostInstall app embedded in the BOINC installer app if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/BOINC Installer.app/Contents/Resources/PostInstall.app" + + # Code Sign boinc_finish_install app emebdded in BOINC uninstaller app if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/extras/Uninstall BOINC.app/Contents/Resources/boinc_finish_install" + + # Code Sign the BOINC uninstaller app if we have a signing identity + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/extras/Uninstall BOINC.app" +fi + # Prepare to build the BOINC+VirtualBox installer if VirtualBox.pkg exists VirtualBoxPackageName="VirtualBox.pkg" if [ -f "../VirtualBox Installer/${VirtualBoxPackageName}" ]; then @@ -421,10 +472,7 @@ cp -fpRL "${BUILDPATH}/SymbolTables/" ../BOINC_Installer/New_Release_$1_$2_$3/bo ## with default settings to allow running downloaded applications under OS 10.8 if [ -n "${APPSIGNINGIDENTITY}" ]; then # Code Sign the BOINC installer application if we have a signing identity - sudo codesign -f -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/BOINC Installer.app" - - # Code Sign the BOINC uninstaller application if we have a signing identity - sudo codesign -f -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/extras/Uninstall BOINC.app" + sudo codesign -f -o runtime -s "${APPSIGNINGIDENTITY}" "../BOINC_Installer/New_Release_$1_$2_$3/boinc_$1.$2.$3_macOSX_$arch/BOINC Installer.app" fi cd ../BOINC_Installer/New_Release_$1_$2_$3