signMacosExecutable function

Future<void> signMacosExecutable({
  1. required String inputPath,
  2. required String entitlementsPath,
  3. required bool skipNotarize,
  4. Map<String, String>? environment,
})

Implementation

Future<void> signMacosExecutable({
  required String inputPath,
  required String entitlementsPath,
  required bool skipNotarize,
  Map<String, String>? environment,
}) async {
  final env = environment ?? currentShipworldEnvironment;
  final resolvedExecutablePath = inputPath;

  stdout.writeln('Removing existing signature if any...');
  await _tryRun('codesign', ['--remove-signature', resolvedExecutablePath]);

  stdout.writeln('Removing extended attributes if any...');
  await _tryRun('xattr', ['-cr', resolvedExecutablePath]);

  final identity = await _installSigningIdentity(env);
  try {
    if (identity == '-') {
      await runChecked('codesign', ['--sign', '-', resolvedExecutablePath]);
      return;
    }

    stdout.writeln('Signing macOS binary...');
    await runChecked('codesign', [
      '--force',
      '--options',
      'runtime',
      '--entitlements',
      entitlementsPath,
      '--sign',
      identity,
      resolvedExecutablePath,
    ]);

    final zipPath = '$resolvedExecutablePath.zip';
    if (env['APPLE_NOTARY_KEY_P8_BASE64']?.isNotEmpty ?? false) {
      await runChecked('zip', ['-j', zipPath, resolvedExecutablePath]);
    }
    await _notarize(archivePath: zipPath, env: env, skipNotarize: skipNotarize);
  } finally {
    await _disposeSigningIdentity();
  }
}