macos: the pipeline is the project's, the identity is yours

Makefile.macos was kept out of git because it named a team, a person and
a mac. But almost all of it is mechanism -- build, sign, zip, notarize,
staple, unlock a headless keychain -- and that is the project's, not the
releaser's. Keeping the whole file out to protect four values meant the
one machine that had it was the only place a release could be cut from,
and that nobody could read how signing worked without being handed it.

So the split is inverted. Makefile.macos, the builder doc and the scripts
are tracked; macos-release.mk holds TEAM_ID, SIGNER and BUILDER and is
the only thing gitignored. macos-release.mk.example is the template.

The identity strings are now assembled from SIGNER and TEAM_ID rather
than written out, which means an unconfigured checkout composes
"Developer ID Application:  ()" -- plausible, wrong, and diagnosed only
by codesign a minute into a build. require-identity and require-builder
catch it before anything runs and name the file to create; `help` prints
"(unset)" rather than the empty shape.

macos-remote-build now pushes macos-release.mk instead of Makefile.macos.
That is the better arrangement anyway: the builder gets its pipeline from
git at the commit being released, so a release is signed by the flow
belonging to it and not by whatever the laptop was carrying.

MACOS-BUILDER.md was in the same position -- local, and referenced by a
file that is now tracked -- so it becomes docs/macos-release.md with the
certificate name and notary key id replaced by their shapes.

1 files changed, 12 insertions, 6 deletions

diff --git a/contrib/macos-remote-build b/contrib/macos-remote-build
index ae92760..52aafa0 100755
--- a/contrib/macos-remote-build
+++ b/contrib/macos-remote-build
@@ -69,12 +69,18 @@ ssh "$BUILDER" "test -d '$DIR/.git'" \
     || fail "no checkout at $BUILDER:$DIR -- run contrib/macos-builder-setup $BUILDER"
 say "reachable, checkout present"
 
-# Makefile.macos is not in the repo, so a clean checkout on the builder does not
-# have one and it is pushed from here. Only that file: these scripts are tracked
-# and run on *this* side, so copying them over would do nothing except make a
-# release checkout dirty -- and a dirty release checkout is a failure below.
+# macos-release.mk is not in the repo -- it is the one file that is not -- so a
+# clean checkout on the builder does not have one and it is pushed from here.
+# Only that file: Makefile.macos and these scripts are tracked, so the reset
+# below brings the builder the versions belonging to the commit being released,
+# which is what should sign it. Copying ours over would override that with
+# whatever the laptop happens to have, and make a release checkout dirty --
+# which is a failure below.
 push_signing_flow() {
-    rsync -q "$root/Makefile.macos" "$BUILDER:$DIR/Makefile.macos"
+    [ -f "$root/macos-release.mk" ] \
+        || fail "no macos-release.mk here -- it names the identity and the builder:
+  cp macos-release.mk.example macos-release.mk"
+    rsync -q "$root/macos-release.mk" "$BUILDER:$DIR/macos-release.mk"
 }
 
 if [ -n "$REF" ]; then
@@ -106,7 +112,7 @@ if [ -n "$REF" ]; then
     # zig-out survive and a release build is a recompile, not a re-download.
     ssh "$BUILDER" "cd '$DIR' \
         && git reset -q --hard '$full' \
-        && git clean -qfd -e Makefile.macos -e dist \
+        && git clean -qfd -e macos-release.mk -e dist \
         && make -s clean" || fail "could not put the builder on $full"
     push_signing_flow