From c5029d2eea9ae5d782d1d8094ee2a646ffc2bdf4 Mon Sep 17 00:00:00 2001 From: Anjan Nath Date: Thu, 28 Jul 2022 18:49:39 +0530 Subject: pkginstaller: sign qemu-system-* binary for the pkg add file hvf.entitlements which has the com.apple.security.hypervisor entitlement needed for qemu [NO NEW TESTS NEEDED] Signed-off-by: Anjan Nath --- contrib/pkginstaller/Makefile | 1 + contrib/pkginstaller/hvf.entitlements | 8 ++++++++ contrib/pkginstaller/package.sh | 34 +++++++++++++++++++++++++++++++--- 3 files changed, 40 insertions(+), 3 deletions(-) create mode 100644 contrib/pkginstaller/hvf.entitlements (limited to 'contrib') diff --git a/contrib/pkginstaller/Makefile b/contrib/pkginstaller/Makefile index 19c9b51aa..984365ccb 100644 --- a/contrib/pkginstaller/Makefile +++ b/contrib/pkginstaller/Makefile @@ -32,6 +32,7 @@ packagedir: package_root Distribution welcome.html echo -n $(PODMAN_VERSION) > $(PACKAGE_DIR)/VERSION echo -n $(ARCH) > $(PACKAGE_DIR)/ARCH cp ../../LICENSE $(PACKAGE_DIR)/Resources/LICENSE.txt + cp hvf.entitlements $(PACKAGE_DIR)/ package_root: get_gvproxy get_qemu mkdir -p $(PACKAGE_ROOT)/podman/bin $(PACKAGE_ROOT)/podman/qemu diff --git a/contrib/pkginstaller/hvf.entitlements b/contrib/pkginstaller/hvf.entitlements new file mode 100644 index 000000000..154f3308e --- /dev/null +++ b/contrib/pkginstaller/hvf.entitlements @@ -0,0 +1,8 @@ + + + + + com.apple.security.hypervisor + + + diff --git a/contrib/pkginstaller/package.sh b/contrib/pkginstaller/package.sh index b7b33954d..ca8d54f7f 100755 --- a/contrib/pkginstaller/package.sh +++ b/contrib/pkginstaller/package.sh @@ -10,6 +10,10 @@ NO_CODESIGN=${NO_CODESIGN:-0} HELPER_BINARIES_DIR="/opt/podman/qemu/bin" binDir="${BASEDIR}/root/podman/bin" +qemuBinDir="${BASEDIR}/root/podman/qemu/bin" + +version=$(cat "${BASEDIR}/VERSION") +arch=$(cat "${BASEDIR}/ARCH") function build_podman() { pushd "$1" @@ -29,16 +33,40 @@ function sign() { if [ -f "${entitlements}" ]; then opts="--entitlements ${entitlements}" fi - codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --force --timestamp "${opts}" "$1" + codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force ${opts} "$1" } -version=$(cat "${BASEDIR}/VERSION") -arch=$(cat "${BASEDIR}/ARCH") +function signQemu() { + if [ "${NO_CODESIGN}" -eq "1" ]; then + return + fi + + local qemuArch="${arch}" + if [ "${qemuArch}" = amd64 ]; then + qemuArch=x86_64 + fi + + # sign the files inside /opt/podman/qemu/lib + libs=$(find "${BASEDIR}"/root/podman/qemu/lib -depth -name "*.dylib" -or -type f -perm +111) + echo "${libs}" | xargs -t -I % codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force % || true + + # sign the files inside /opt/podman/qemu/bin except qemu-system-* + bins=$(find "${BASEDIR}"/root/podman/qemu/bin -depth -type f -perm +111 ! -name "qemu-system-${qemuArch}") + echo "${bins}" | xargs -t -I % codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force % || true + + # sign the qemu-system-* binary + # need to remove any extended attributes, otherwise codesign complains: + # qemu-system-aarch64: resource fork, Finder information, or similar detritus not allowed + xattr -cr "${qemuBinDir}/qemu-system-${qemuArch}" + codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force \ + --entitlements "${BASEDIR}/hvf.entitlements" "${qemuBinDir}/qemu-system-${qemuArch}" +} build_podman "../../../../" sign "${binDir}/podman" sign "${binDir}/gvproxy" sign "${binDir}/podman-mac-helper" +signQemu pkgbuild --identifier com.redhat.podman --version "${version}" \ --scripts "${BASEDIR}/scripts" \ -- cgit v1.2.3-54-g00ecf From e6670cd29716c61fc96118a94c2edadf3e375a3b Mon Sep 17 00:00:00 2001 From: Anjan Nath Date: Thu, 28 Jul 2022 18:55:44 +0530 Subject: pkginstaller: add makefile target to notarize the built pkg [NO NEW TESTS NEEDED] Signed-off-by: Anjan Nath --- contrib/pkginstaller/Makefile | 7 +++++++ contrib/pkginstaller/README.md | 3 +++ 2 files changed, 10 insertions(+) (limited to 'contrib') diff --git a/contrib/pkginstaller/Makefile b/contrib/pkginstaller/Makefile index 984365ccb..7863a237b 100644 --- a/contrib/pkginstaller/Makefile +++ b/contrib/pkginstaller/Makefile @@ -9,6 +9,7 @@ QEMU_RELEASE_URL ?= https://github.com/containers/podman-machine-qemu/releases/d PACKAGE_DIR ?= out/packaging TMP_DOWNLOAD ?= tmp-download PACKAGE_ROOT ?= root +PKG_NAME := podman-installer-macos-$(ARCH).pkg default: pkginstaller @@ -46,6 +47,12 @@ package_root: get_gvproxy get_qemu pkginstaller: packagedir cd $(PACKAGE_DIR) && ./package.sh .. +_notarize: pkginstaller + xcrun notarytool submit --apple-id $(NOTARIZE_USERNAME) --password $(NOTARIZE_PASSWORD) --team-id=$(NOTARIZE_TEAM) -f json --wait out/$(PKG_NAME) + +notarize: _notarize + xcrun stapler staple out/$(PKG_NAME) + .PHONY: clean clean: rm -rf $(TMP_DOWNLOAD) $(PACKAGE_ROOT) $(PACKAGE_DIR) Distribution welcome.html diff --git a/contrib/pkginstaller/README.md b/contrib/pkginstaller/README.md index 37c59ce04..1951d4eab 100644 --- a/contrib/pkginstaller/README.md +++ b/contrib/pkginstaller/README.md @@ -5,6 +5,9 @@ $ make ARCH= NO_CODESIGN=1 pkginstaller # or to create signed pkg $ make ARCH= CODESIGN_IDENTITY= PRODUCTSIGN_IDENTITY= pkginstaller + +# or to prepare a signed and notarized pkg for release +$ make ARCH= CODESIGN_IDENTITY= PRODUCTSIGN_IDENTITY= NOTARIZE_USERNAME= NOTARIZE_PASSWORD= NOTARIZE_TEAM= notarize ``` The generated pkg will be written to `out/podman-macos-installer-*.pkg`. -- cgit v1.2.3-54-g00ecf From 44212b90bbe3c66f31dc00299de334131048f047 Mon Sep 17 00:00:00 2001 From: Anjan Nath Date: Tue, 2 Aug 2022 10:29:32 +0530 Subject: pkginstaller: makefile improvements to avoid redownloading this updates downloading of gvproxy and qemu using a standard makefile rule which will avoid downloading them again if its already downloaded [NO NEW TESTS NEEDED] Signed-off-by: Anjan Nath --- contrib/pkginstaller/Makefile | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'contrib') diff --git a/contrib/pkginstaller/Makefile b/contrib/pkginstaller/Makefile index 7863a237b..c84a08482 100644 --- a/contrib/pkginstaller/Makefile +++ b/contrib/pkginstaller/Makefile @@ -13,11 +13,11 @@ PKG_NAME := podman-installer-macos-$(ARCH).pkg default: pkginstaller -get_gvproxy: +$(TMP_DOWNLOAD)/gvproxy: mkdir -p $(TMP_DOWNLOAD) cd $(TMP_DOWNLOAD) && curl -sLo gvproxy $(GVPROXY_RELEASE_URL) -get_qemu: +$(TMP_DOWNLOAD)/podman-machine-qemu-$(ARCH)-$(QEMU_VERSION).tar.xz: mkdir -p $(TMP_DOWNLOAD) cd $(TMP_DOWNLOAD) && curl -sLO $(QEMU_RELEASE_URL) @@ -35,7 +35,7 @@ packagedir: package_root Distribution welcome.html cp ../../LICENSE $(PACKAGE_DIR)/Resources/LICENSE.txt cp hvf.entitlements $(PACKAGE_DIR)/ -package_root: get_gvproxy get_qemu +package_root: clean-pkgroot $(TMP_DOWNLOAD)/podman-machine-qemu-$(ARCH)-$(QEMU_VERSION).tar.xz $(TMP_DOWNLOAD)/gvproxy mkdir -p $(PACKAGE_ROOT)/podman/bin $(PACKAGE_ROOT)/podman/qemu tar -C $(PACKAGE_ROOT)/podman/qemu -xf $(TMP_DOWNLOAD)/podman-machine-qemu-$(ARCH)-$(QEMU_VERSION).tar.xz cp $(TMP_DOWNLOAD)/gvproxy $(PACKAGE_ROOT)/podman/bin/ @@ -53,6 +53,9 @@ _notarize: pkginstaller notarize: _notarize xcrun stapler staple out/$(PKG_NAME) -.PHONY: clean +.PHONY: clean clean-pkgroot clean: rm -rf $(TMP_DOWNLOAD) $(PACKAGE_ROOT) $(PACKAGE_DIR) Distribution welcome.html + +clean-pkgroot: + rm -rf $(PACKAGE_ROOT) $(PACKAGE_DIR) Distribution welcome.html -- cgit v1.2.3-54-g00ecf