blob: bb91fe01f93d0b179cd9809320dfdf032d018821 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
#!/bin/bash
set -euxo pipefail
BASEDIR=$(dirname "$0")
OUTPUT=$1
CODESIGN_IDENTITY=${CODESIGN_IDENTITY:-mock}
PRODUCTSIGN_IDENTITY=${PRODUCTSIGN_IDENTITY:-mock}
NO_CODESIGN=${NO_CODESIGN:-0}
HELPER_BINARIES_DIR="/opt/podman/qemu/bin"
binDir="${BASEDIR}/root/podman/bin"
qemuBinDir="${BASEDIR}/root/podman/qemu/bin"
version=$(cat "${BASEDIR}/VERSION")
arch=$(cat "${BASEDIR}/ARCH")
function build_podman() {
pushd "$1"
make GOARCH="${arch}" podman-remote HELPER_BINARIES_DIR="${HELPER_BINARIES_DIR}"
make GOARCH="${arch}" podman-mac-helper
cp bin/darwin/podman "contrib/pkginstaller/out/packaging/${binDir}/podman"
cp bin/darwin/podman-mac-helper "contrib/pkginstaller/out/packaging/${binDir}/podman-mac-helper"
popd
}
function sign() {
if [ "${NO_CODESIGN}" -eq "1" ]; then
return
fi
local opts=""
entitlements="${BASEDIR}/$(basename "$1").entitlements"
if [ -f "${entitlements}" ]; then
opts="--entitlements ${entitlements}"
fi
codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force ${opts} "$1"
}
function signQemu() {
if [ "${NO_CODESIGN}" -eq "1" ]; then
return
fi
local qemuArch="${arch}"
if [ "${qemuArch}" = amd64 ]; then
qemuArch=x86_64
fi
# sign the files inside /opt/podman/qemu/lib
libs=$(find "${BASEDIR}"/root/podman/qemu/lib -depth -name "*.dylib" -or -type f -perm +111)
echo "${libs}" | xargs -t -I % codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force % || true
# sign the files inside /opt/podman/qemu/bin except qemu-system-*
bins=$(find "${BASEDIR}"/root/podman/qemu/bin -depth -type f -perm +111 ! -name "qemu-system-${qemuArch}")
echo "${bins}" | xargs -t -I % codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force % || true
# sign the qemu-system-* binary
# need to remove any extended attributes, otherwise codesign complains:
# qemu-system-aarch64: resource fork, Finder information, or similar detritus not allowed
xattr -cr "${qemuBinDir}/qemu-system-${qemuArch}"
codesign --deep --sign "${CODESIGN_IDENTITY}" --options runtime --timestamp --force \
--entitlements "${BASEDIR}/hvf.entitlements" "${qemuBinDir}/qemu-system-${qemuArch}"
}
build_podman "../../../../"
sign "${binDir}/podman"
sign "${binDir}/gvproxy"
sign "${binDir}/podman-mac-helper"
signQemu
pkgbuild --identifier com.redhat.podman --version "${version}" \
--scripts "${BASEDIR}/scripts" \
--root "${BASEDIR}/root" \
--install-location /opt \
--component-plist "${BASEDIR}/component.plist" \
"${OUTPUT}/podman.pkg"
productbuild --distribution "${BASEDIR}/Distribution" \
--resources "${BASEDIR}/Resources" \
--package-path "${OUTPUT}" \
"${OUTPUT}/podman-unsigned.pkg"
rm "${OUTPUT}/podman.pkg"
if [ ! "${NO_CODESIGN}" -eq "1" ]; then
productsign --timestamp --sign "${PRODUCTSIGN_IDENTITY}" "${OUTPUT}/podman-unsigned.pkg" "${OUTPUT}/podman-installer-macos-${arch}.pkg"
else
mv "${OUTPUT}/podman-unsigned.pkg" "${OUTPUT}/podman-installer-macos-${arch}.pkg"
fi
|
