Ecosystem/feather
Ecosystem/feather
1
0
Fork 0
mirror of https://github.com/feather-wallet/feather.git synced 2025-04-24 05:08:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

codesign

Browse source
This commit is contained in:
tobtoht 2025-03-25 04:38:57 +01:00
parent 7be2e6c810
commit 96a77671db
No known key found for this signature in database
GPG key ID: E45B10DD027D2472
2 changed files with 78 additions and 20 deletions
.github/workflows
guix.yml
contrib/guix/libexec
build.sh

54
.github/workflows/guix.yml vendored
View file

@ -37,6 +37,9 @@ jobs:
- target: "x86_64-apple-darwin"
- target: "arm64-apple-darwin"
outputs:
WIN_INSTALLER_ARTIFACT_ID: ${{ steps.win-installer.outputs.WIN_INSTALLER_ARTIFACT_ID }}
WIN_EXECUTABLE_ARTIFACT_ID: ${{ steps.win-executable.outputs.WIN_EXECUTABLE_ARTIFACT_ID }}
name: ${{ matrix.toolchain.target }}
steps:
- uses: actions/checkout@v4
@ -55,7 +58,7 @@ jobs:
path: contrib/depends/sources
key: sources-${{ hashFiles('contrib/depends/packages/*') }}
- name: install dependencies
run: sudo apt update; sudo apt -y install guix git ca-certificates apparmor-utils
run: sudo apt update; sudo apt -y install guix git ca-certificates apparmor-utils osslsigncode
- name: apparmor workaround
# https://bugs.launchpad.net/ubuntu/+source/guix/+bug/2064115
run: |
@ -82,11 +85,18 @@ jobs:
files: |
guix/guix-build-*/build/distsrc-*/build/bin/feather.exe
- uses: actions/upload-artifact@v4
id: upload-artifact
with:
name: ${{ matrix.toolchain.target }}
path: |
guix/guix-build-*/output/${{ matrix.toolchain.target }}/*
guix/guix-build-*/logs/${{ matrix.toolchain.target }}/*
- if: ${{ matrix.toolchain.target == 'x86_64-w64-mingw32.installer' }}
id: win-installer
run: echo "WIN_INSTALLER_ARTIFACT_ID=${{ steps.upload-artifact.outputs.artifact-id }}" >> "$GITHUB_OUTPUT"
- if: ${{ matrix.toolchain.target == 'x86_64-w64-mingw32' }}
id: win-executable
run: echo "WIN_EXECUTABLE_ARTIFACT_ID=${{ steps.upload-artifact.outputs.artifact-id }}" >> "$GITHUB_OUTPUT"
bundle-logs:
runs-on: ubuntu-24.04
@ -110,3 +120,45 @@ jobs:
artifacts: "**/*.AppImage,**/*-linux-arm.zip,**/*-linux-arm64.zip,**/*-linux-riscv64.zip,**/*-linux.zip,**/*-mac-arm64.zip,**/*-mac.zip,**/*-win.zip,**/FeatherWalletSetup-*.exe,**/feather-${{github.ref_name}}.tar.gz"
draft: true
name: v${{github.ref_name}}
codesigning:
runs-on: ubuntu-24.04
needs: [build-guix, bundle-logs]
if: startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-rc')
strategy:
fail-fast: false
matrix:
toolchain:
- target: "x86_64-w64-mingw32"
- target: "x86_64-w64-mingw32.installer"
steps:
- name: install dependencies
run: sudo apt update; sudo apt -y install osslsigncode
- name: "set artifact id"
run: |
if [ "${{ matrix.toolchain.target }}" == "x86_64-w64-mingw32" ]; then
echo "ARTIFACT_ID=${{ needs.build-guix.outputs.WIN_EXECUTABLE_ARTIFACT_ID }}" >> $GITHUB_ENV
echo "ARTIFACT_SLUG=executable" >> $GITHUB_ENV
elif [ "${{ matrix.toolchain.target }}" == "x86_64-w64-mingw32.installer" ]; then
echo "ARTIFACT_ID=${{ needs.build-guix.outputs.WIN_INSTALLER_ARTIFACT_ID }}" >> $GITHUB_ENV
echo "ARTIFACT_SLUG=installer" >> $GITHUB_ENV
fi
- uses: signpath/github-action-submit-signing-request@v1
name: "request signature"
with:
api-token: '${{ secrets.SIGNPATH_API_KEY }}'
organization-id: 'd3e94749-9c69-44e9-82de-c65cb3832869'
project-slug: 'feather'
signing-policy-slug: 'test-signing'
artifact-configuration-slug: ${{ env.ARTIFACT_SLUG }}
github-artifact-id: ${{ env.ARTIFACT_ID }}
wait-for-completion: true
output-artifact-directory: codesigning/
- name: "extract signature"
run: osslsigncode extract-signature -in codesigning/guix-build-*/output/${{ matrix.toolchain.target }}/*.exe -out codesigning/${{ matrix.toolchain.target }}-${{github.ref_name}}.pem
- uses: actions/upload-artifact@v4
name: "upload signature"
with:
name: ${{ matrix.toolchain.target }}.pem
path: |
codesigning/${{ matrix.toolchain.target }}-${{github.ref_name}}.pem

44
contrib/guix/libexec/build.sh
View file

@ -431,25 +431,31 @@ export PATH="${BASEPREFIX}/${HOST}/native/bin:${PATH}"
# for release
case "$HOST" in
*mingw*)
case "$OPTIONS" in
installer)
find . -print0 \
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
find . \
| sort \
| zip -X@ "${OUTDIR}/${DISTNAME}-win-installer.zip" \
|| ( rm -f "${OUTDIR}/${DISTNAME}-win-installer.zip" && exit 1 )
;;
"")
mv feather.exe ${DISTNAME}.exe && \
find . -print0 \
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
find . \
| sort \
| zip -X@ "${OUTDIR}/${DISTNAME}-win.zip" \
|| ( rm -f "${OUTDIR}/${DISTNAME}-win.zip" && exit 1 )
;;
esac
if [[ "${TAG}" == *"-rc"* ]]; then
if [ -z "$OPTIONS" ]; then
mv feather.exe "${OUTDIR}/${DISTNAME}.exe"
fi
else
case "$OPTIONS" in
installer)
find . -print0 \
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
find . \
| sort \
| zip -X@ "${OUTDIR}/${DISTNAME}-win-installer.zip" \
|| ( rm -f "${OUTDIR}/${DISTNAME}-win-installer.zip" && exit 1 )
;;
"")
mv feather.exe ${DISTNAME}.exe && \
find . -print0 \
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
find . \
| sort \
| zip -X@ "${OUTDIR}/${DISTNAME}-win.zip" \
|| ( rm -f "${OUTDIR}/${DISTNAME}-win.zip" && exit 1 )
;;
esac
fi
;;
*linux*)
if [ "$OPTIONS" != "pack" ]; then