Skip to content

Select imported signing certificates by hash #2686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamtheturtle merged 1 commit into from
Oct 14, 2026
Merged

Select imported signing certificates by hash #2686

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,20 +466,23 @@ jobs:
# cleanup step is needed. It is pinned to a commit rather than a tag
# because it handles the certificate and its password.
- name: Import the Developer ID certificate
uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0
id: signing_certificate
uses: Apple-Actions/import-codesign-certs@77ba2a2a8f5cfc8c405ebf3159f767c323e238f9 # v7.1.0
with:
p12-file-base64: ${{ secrets.DEVELOPER_ID_APP_CERT_P12_BASE64 }}
p12-password: ${{ secrets.DEVELOPER_ID_APP_CERT_PASSWORD }}

- name: Sign the macOS binaries
env:
IDENTITIES: ${{ steps.signing_certificate.outputs.identities }}
run: |
# ``--sign`` takes a name prefix, and matches the one Developer ID
# identity in the keychain the previous step added to the search
# list. It fails with "ambiguous" if more than one matches, so
# this needs no lookup. There is deliberately no ``--keychain``:
# that flag silently falls back to the search list when it cannot
# resolve what it is given, so it constrains nothing.
#
signing_identity="$(jq -er '
[.[] | select(.name | startswith("Developer ID Application:"))]
| if length == 1 then .[0].hash
else error("Expected exactly one Developer ID Application identity; found \(length)")
end
' <<< "$IDENTITIES")"

# A secure timestamp and the hardened runtime are both
# prerequisites for notarization. The hardened runtime needs the
# entitlements file to leave a ``--onefile`` binary runnable; see
Expand All @@ -490,7 +493,7 @@ jobs:
--timestamp \
--options runtime \
--entitlements bin/entitlements.plist \
--sign "Developer ID Application" \
--sign "$signing_identity" \
"dist/${binary}"
codesign --verify --strict --verbose=2 "dist/${binary}"
done
Expand Down
Loading