sign-macos

Sign a macOS Julia distribution

GitHub Action to sign every Mach-O binary and bundle in an unpacked Julia distribution with rcodesign.

Usage

steps:
  # `build-distribution` is the step that built the distribution.
  - name: "Sign the distribution"
    uses: "JuliaComputing/create-julia-distribution/sign-macos@958799562b82fcabd2f5508f7ee296e1d91de200"
    with:
      distribution-path: "${{ steps.build-distribution.outputs.distribution-path }}"
      rcodesign-config-file: "rcodesign.toml"

distribution-path is the only required input, and the documentation covers where the call sits in a workflow that builds and ships a distribution. The reference covers what else is available.

The distribution is signed in place and there are no outputs.

Signing identity configuration

This action holds no knowledge of where a signing key lives or who holds it. The rcodesign-config-file input takes the path of an rcodesign configuration file, in which every backend it supports is expressible:

[default.sign]
signer.p12 = { path = "key.p12", password_path = "path/to/password" }

Taking a path rather than contents keeps secrets out of the input surface: a backend needing a real secret materializes the file in a preceding step, and rcodesign prefers indirection for those cases anyway. rcodesign's own configuration file documentation is authoritative on the available backends and their keys.

Naming a configuration file suppresses rcodesign's own discovery of the user and working-directory configuration files, so the file named here is the whole of the configuration. Paths inside it, such as a certificate, are resolved by rcodesign against the working directory.

One that does not exist is rejected before signing starts, because figment, through which rcodesign merges configuration, treats a missing file as an empty one and a mistyped path would otherwise select no signer at all.

What gets signed

Every Mach-O binary that can carry a signature, and .framework and .app bundles as bundles rather than as the binaries inside them, which is what keeps the _CodeSignature/CodeResources seal over their contents valid and notarization satisfied.

Skipped are the scripts, .jl files, headers and data a distribution is mostly made of, along with its *.o, *.a and *.dSYM payloads: link-time and debug input that can carry no signature and is never loaded at runtime.

A partial signature never ships

A failure in any single signer fails the action, so a tree that is only partly signed is never handed back to the caller.

Entitlements

entitlements-file defaults to the literal bundled, the entitlements the official Julia distribution signs with, shipped alongside this action and taken from utilities/macos/Entitlements.plist rather than curated. Any other value is a path, relative ones resolving against the working directory, and an empty string passes no entitlements at all.

rcodesign accepts one entitlements file per scope and plist contents never merge, so a variant means copying the whole file rather than adding to this one.

The rcodesign binary

Signing uses a pinned, checksum-verified rcodesign_jll release asset, built by Yggdrasil from the JuliaCI/apple-platform-rs fork, which carries signing backends upstream has not merged.