mirror of
https://github.com/libretro/virtualjaguar-libretro.git
synced 2026-11-07 12:47:58 -10:00
Joseph MattielloandClaude Sonnet 5.5
d0d9b98b86
app/packaging/local-package.sh [--sign] [--notarize] packages a normal build on a developer machine and signs it with a certificate found locally: - macOS: VJ_SIGN_IDENTITY, else the newest-expiring valid "Developer ID Application" identity (chosen by SHA-1 so renewed duplicates are unambiguous), else "Apple Development", else ad hoc. --notarize uses VJ_NOTARY_PROFILE (notarytool keychain profile) or APPLE_NOTARY_KEY_ID/ISSUER_ID/KEY_PATH, then staples and runs spctl. - Windows (Git Bash): VJ_SIGN_PFX(+_PASSWORD), else VJ_SIGN_CERT_SHA1, else signtool /a, else unsigned; signs exe, dlls and the installer when Inno Setup is present. - Settings come from the environment, then a gitignored repo-root .env (only VJ_*/ APPLE_* keys, nothing evaluated, op:// references resolved with `op` if installed). - -DVJ_APP_SIGN_DEV_BUILD=ON signs the dev executable after each macOS build. codesign.sh's notarize step also accepts a keychain profile or a .p8 path; CI's base64 secret path is unchanged. package.sh gets an env-guarded signing hook. Refs #839 Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
43 lines
2.4 KiB
Plaintext
43 lines
2.4 KiB
Plaintext
# Local signing settings for app/packaging/local-package.sh.
|
|
#
|
|
# cp app/packaging/env.example .env # repo root; .env is gitignored. Edit, keep it private.
|
|
#
|
|
# Format: KEY=value, one per line. Only VJ_* and APPLE_* keys are read; values are literal (no
|
|
# $VAR or `command` expansion; one pair of surrounding quotes is stripped; no inline comments).
|
|
# A variable already set in your shell wins over this file.
|
|
#
|
|
# A value of the form op://vault/item/field is resolved with the 1Password CLI (`op read`) when
|
|
# `op` is installed, so no secret needs to sit in this file.
|
|
#
|
|
# Every key below is optional. With none set, macOS auto-detects the identity in your login
|
|
# keychain and Windows lets signtool pick one.
|
|
|
|
# ---- macOS ----------------------------------------------------------------------------------
|
|
# Signing identity: a name, or a SHA-1 hash (unambiguous when a renewed cert has the same name),
|
|
# or "-" for ad hoc. See yours with: security find-identity -v -p codesigning
|
|
# Default: the newest-expiring "Developer ID Application", else "Apple Development", else ad hoc.
|
|
# VJ_SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID1234)"
|
|
|
|
# Notarization (--notarize). Preferred: a keychain profile created once with
|
|
# xcrun notarytool store-credentials vj-notary --key AuthKey_XXXX.p8 --key-id KEYID --issuer ISSUER-UUID
|
|
# (or with --apple-id/--team-id/--password for an app-specific password). Secrets stay in the keychain.
|
|
# VJ_NOTARY_PROFILE=vj-notary
|
|
|
|
# Alternative: an App Store Connect API key on disk (path to the .p8, or an op:// file reference).
|
|
# APPLE_NOTARY_KEY_ID=ABC123DEFG
|
|
# APPLE_NOTARY_ISSUER_ID=00000000-0000-0000-0000-000000000000
|
|
# APPLE_NOTARY_KEY_PATH=/path/to/AuthKey_ABC123DEFG.p8
|
|
|
|
# ---- Windows (Git Bash / MSYS2) -------------------------------------------------------------
|
|
# A code-signing certificate file ...
|
|
# VJ_SIGN_PFX=C:/path/to/codesign.pfx
|
|
# VJ_SIGN_PFX_PASSWORD=
|
|
# ... or the thumbprint of one in your CurrentUser\My certificate store (certmgr.msc).
|
|
# VJ_SIGN_CERT_SHA1=0123456789ABCDEF0123456789ABCDEF01234567
|
|
# Default if neither is set: signtool's automatic selection (unsigned if no certificate matches).
|
|
|
|
# RFC 3161 timestamp server (default http://timestamp.digicert.com).
|
|
# VJ_SIGN_TIMESTAMP_URL=http://timestamp.digicert.com
|
|
# Path to signtool.exe if it is not in the Windows SDK's default location.
|
|
# VJ_SIGNTOOL=C:/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe
|