Merge pull request #1880 from tylerslaton/switch-to-zip

Switch to use a zip instead of a DMG

Author: tylerslaton

.goreleaser.yml

@@ -37,7 +37,7 @@ universal_binaries:
         - cmd: ./tools/notarize "{{ .Path }}" "acorn-v{{ .Version }}-macOS-universal"
           output: true
           env:
-            - NOTARIZE={{ if index .Env "NOTARIZE" }}{{ .Env.NOTARIZE }}{{ end }}
+            - NOTARIZE=0 # Always disable Notarization since it is not currently necessary.
             - AC_IDENTITY={{ if index .Env "AC_IDENTITY" }}{{ .Env.AC_IDENTITY }}{{ end }}
             - AC_PROVIDER={{ if index .Env "AC_PROVIDER" }}{{ .Env.AC_PROVIDER }}{{ end }}
             - AC_USERNAME={{ if index .Env "AC_USERNAME" }}{{ .Env.AC_USERNAME }}{{ end }}

tools/notarize

@@ -10,15 +10,15 @@ cd $(dirname $0)/..
 
 BINARY="$1"
 DIR="releases/mac_darwin_all"
-DMG="releases/$2.dmg"
+ZIP="releases/$2.zip"
 CHECKSUMS="releases/checksums.txt"
 
 if [[ -z "${NOTARIZE}" && "${GITHUB_REF}" =~ "refs/tags/v" ]]; then
   echo "Enabling notarize..."
   NOTARIZE="1"
 fi
 
-echo "NOTARIZE=${NOTARIZE} BUNDLE=${AC_BUNDLE} BINARY=${BINARY} DMG=${DMG}"
+echo "NOTARIZE=${NOTARIZE} BUNDLE=${AC_BUNDLE} BINARY=${BINARY} ZIP=${ZIP}"
 
 sudo apt-get update -y  
 
@@ -43,22 +43,32 @@ rcodesign sign \
   "${BINARY}"
 echo "Signed ${BINARY}!"
 
+# Currently, NOTARIZE is always set to 0. In effect, this means that the
+# binary is signed, but not zipped up, notarized or stapled. Since all of the 
+# official installation processes are through brew or wget, the notarized DMG we were
+# creating was not necessary. Where this does become a problem is if a user 
+# wants to install from a browser. In this situation, there will need to be 
+# a notarization process otherwise MacOS will mark our binary as unsafe and 
+# the user will need to go through hoops to install it. In this instance,
+# setting NOTARIZE to 1 will create a ZIP file (since it was difficult to create
+# a DMG while not on MacOS) and Notarize it.
+#
+# Note - If you want to staple that ZIP, you will need to staple each individual
+#        item in the zip file.
+#
+# References: 
+# https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow
+# https://gregoryszorc.com/docs/apple-codesign/0.17.0/apple_codesign_rcodesign.html
 if [[ "${NOTARIZE}" == "1" ]]; then
-  which mkfs.hfsplus || sudo apt-get install hfsprogs -y
+  which zip || sudo apt-get install zip -y
 
-  # Build the DMG
-  echo "Building ${DMG}..."
+  # Zip everything up
+  echo "Building ${ZIP}..."
   cp LICENSE README.md "${DIR}/"
-  SIZE="$(du -sm "${DIR}" | awk '{print $1 + 30}')" # The size of the directory + 30 megabytes for any overhead
-  dd if=/dev/zero of="${DMG}" bs=1M count="${SIZE}"
-  mkfs.hfsplus -v "Acorn" "${DMG}"
-  mkdir -p /tmp/acorn_mount
-  sudo mount -t hfsplus -o loop "${DMG}" /tmp/acorn_mount
-  sudo cp -R "${DIR}"/* /tmp/acorn_mount
-  sudo umount /tmp/acorn_mount
-  echo "Built ${DMG}!"
-
-  # Notarize and staple the DMG
+  zip -r "${ZIP}" "${DIR}"
+  echo "Built ${ZIP}!"
+
+  # Notarize the ZIP
   echo "Building app-store-connect-api-key..."
   echo "${AC_PRIVATE_KEY}" | base64 --decode > private.p8
   rcodesign encode-app-store-connect-api-key \
@@ -68,16 +78,16 @@ if [[ "${NOTARIZE}" == "1" ]]; then
     private.p8
   echo "Built app-store-connect-api-key!"
 
-  echo "Notarizing and stapling ${DMG}..."
-  rcodesign notary-submit --api-key-path ./key.json "${DMG}" --staple 
-  echo "${DMG} has been notarized and stapled!"
+  echo "Notarizing ${ZIP}..."
+  rcodesign notary-submit --api-key-path ./key.json "${ZIP}"
+  echo "Notarized ${ZIP}!"
 
-  # Add the sha256sum of the DMG to the checksums file
-  echo "Adding ${DMG}'s checksum to the checksums file..."
-  sha256sum "${DMG}" >> "${CHECKSUMS}"
-  echo "Added ${DMG}'s checksums!"
+  # Add the sha256sum of the ZIP to the checksums file
+  echo "Adding ${ZIP}'s checksum to the checksums file..."
+  sha256sum "${ZIP}" >> "${CHECKSUMS}"
+  echo "Added ${ZIP}'s checksums!"
 
 else
-  echo "Skipping notarizing & disk image creation"
+  echo "Skipping zip creation and notarization"
 fi