Skip to content

sign-macos.md

Latest commit

 

History

History
49 lines (38 loc) · 3.06 KB

sign-macos.md

File metadata and controls

49 lines (38 loc) · 3.06 KB
Raw

create-julia-distribution/sign-macos

Signs every Mach-O binary and bundle in an unpacked macOS Julia distribution with rcodesign. Runs on an Apple Silicon macOS runner.

- name: "Sign the distribution"
  uses: "JuliaComputing/create-julia-distribution/sign-macos@958799562b82fcabd2f5508f7ee296e1d91de200"
  with:
    distribution-path: "${{ steps.build-distribution.outputs.distribution-path }}"
    rcodesign-config-file: "rcodesign.toml"

The action's own README covers how the signing identity is expressed, what is and is not signed, and the entitlements applied. What follows is the input and output surface, and where the call belongs in a workflow is the signing example.

Inputs

Input Required Default Description
code-signature-flags no runtime Whitespace-separated code signature flags, each passed as its own --code-signature-flags. The default is the hardened runtime Apple requires of notarized software — not because a distribution needs notarizing, but so that it can be included in a macOS application that does. Empty passes none, leaving the flags to the configuration file.
concurrency no 8 How many binaries to sign at a time. Signing a tree the size of a distribution is dominated by the signer's latency, so concurrency is what makes it tractable; the bound keeps the fan-out onto a remote backend reasonable.
distribution-path yes — The unpacked distribution to sign. Every signable entity beneath it is signed in place, preserving file modes.
entitlements-file no bundled The entitlements plist to apply. The default selects the one shipped alongside the action, which mirrors the entitlements the official Julia distribution signs with; any other value is a path, relative ones resolving against the working directory; empty passes no entitlements at all.
rcodesign-config-file no — Path of the rcodesign configuration file selecting the signer, relative ones resolving against the working directory. If empty, rcodesign falls back to its own configuration file discovery.
rcodesign-profile no — The profile to select within that configuration file. If empty, rcodesign loads the implicit default profile.

Nothing here takes file contents, so no secret crosses an input. A backend needing one materializes the file it reads in a preceding step.

Outputs

None. The distribution is signed in place, so the path handed in is still the path to pack.

What it does not do

Signing anything for a runner other than a macOS one, and notarizing or stapling the result.

Note

A distribution does not itself need notarizing for most purposes, distribution through juliaup among them. Notarization becomes a concern when the distribution is included in something that does need it — a macOS application shipped as a DMG, for instance — which is why the default entitlements are the ones that make that possible.