diff options
| author | Peter Geissler <peter@haxx.in> | 2026-08-27 00:08:52 +0200 |
|---|---|---|
| committer | Peter Geissler <peter@haxx.in> | 2026-08-27 00:08:52 +0200 |
| commit | aa2ec9b65dbee07886556b0d8ae353cb462964b9 (patch) | |
| tree | d06e2e2f99e41f550c47054a1ac96ae223a57df6 /Makefile | |
| parent | brew-release: cut a release from the Linux box it is cut from (diff) | |
| download | slosh-aa2ec9b65dbee07886556b0d8ae353cb462964b9.tar.gz slosh-aa2ec9b65dbee07886556b0d8ae353cb462964b9.tar.xz slosh-aa2ec9b65dbee07886556b0d8ae353cb462964b9.zip | |
macos: the pipeline is the project's, the identity is yours
Makefile.macos was kept out of git because it named a team, a person and
a mac. But almost all of it is mechanism -- build, sign, zip, notarize,
staple, unlock a headless keychain -- and that is the project's, not the
releaser's. Keeping the whole file out to protect four values meant the
one machine that had it was the only place a release could be cut from,
and that nobody could read how signing worked without being handed it.
So the split is inverted. Makefile.macos, the builder doc and the scripts
are tracked; macos-release.mk holds TEAM_ID, SIGNER and BUILDER and is
the only thing gitignored. macos-release.mk.example is the template.
The identity strings are now assembled from SIGNER and TEAM_ID rather
than written out, which means an unconfigured checkout composes
"Developer ID Application: ()" -- plausible, wrong, and diagnosed only
by codesign a minute into a build. require-identity and require-builder
catch it before anything runs and name the file to create; `help` prints
"(unset)" rather than the empty shape.
macos-remote-build now pushes macos-release.mk instead of Makefile.macos.
That is the better arrangement anyway: the builder gets its pipeline from
git at the commit being released, so a release is signed by the flow
belonging to it and not by whatever the laptop was carrying.
MACOS-BUILDER.md was in the same position -- local, and referenced by a
file that is now tracked -- so it becomes docs/macos-release.md with the
certificate name and notary key id replaced by their shapes.
Diffstat (limited to 'Makefile')
| -rw-r--r-- | Makefile | 19 |
1 files changed, 10 insertions, 9 deletions
@@ -327,16 +327,17 @@ hooks: ## install the pre-commit hook (formats staged C) # builder over ssh and brings back a signed, notarized zip. Works from Linux; # all it needs here is ssh, rsync and something that can hash a file. # -# Everything specific to *you* -- which mac, which identity, which Apple team -- -# lives in Makefile.macos, which is not in the repo. The mechanism is: -# contrib/macos-builder-setup sets a builder up, contrib/macos-remote-build -# drives it. REF=<tag> builds a ref origin already has, which is what a release -# is; without it you get this working tree, dirty and honestly labelled. +# The pipeline is Makefile.macos and contrib/macos-{builder-setup,remote-build}, +# all in the repo. Everything specific to *you* -- which mac, whose certificate, +# which Apple team -- is the handful of lines in macos-release.mk, which is not. +# REF=<tag> builds a ref origin already has, which is what a release is; +# without it you get this working tree, dirty and honestly labelled. macos-dist: ## signed, notarized macOS build on the builder mac (REF=<tag> for a release) - @test -f Makefile.macos || { \ - echo "no Makefile.macos here -- it names your signing identity and your"; \ - echo "builder mac, so it is kept out of the repo. To set one up, see:"; \ - echo " contrib/macos-builder-setup --help"; exit 1; } + @test -f macos-release.mk || { \ + echo "no macos-release.mk here -- it names your signing identity and your"; \ + echo "builder mac, so it is the one file kept out of the repo:"; \ + echo " cp macos-release.mk.example macos-release.mk # then fill it in"; \ + echo "To provision a builder mac: contrib/macos-builder-setup --help"; exit 1; } $(Q)$(MAKE) -f Makefile.macos remote-dist REF=$(REF) # ── installation ──────────────────────────────────────────────────────────── |