mirror of
https://github.com/utmapp/UTM.git
synced 2026-10-12 02:24:01 +00:00
build: signing app groups for macOS
This commit is contained in:
osy
@@ -115,8 +115,10 @@ jobs:
|
||||
run: sudo xcode-select -switch /Applications/Xcode_12.4.app
|
||||
- name: Build UTM
|
||||
run: |
|
||||
./scripts/build_utm.sh -p macos -a "arm64 x86_64" -o UTM
|
||||
./scripts/build_utm.sh -t "$SIGNING_TEAM_ID" -p macos -a "arm64 x86_64" -o UTM
|
||||
tar cf UTM.xcarchive.tgz UTM.xcarchive
|
||||
env:
|
||||
SIGNING_TEAM_ID: ${{ secrets.SIGNING_TEAM_ID }}
|
||||
- name: Upload UTM
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
|
||||
@@ -41,11 +41,13 @@ If you are developing QEMU and wish to pass in a custom path to QEMU, you can us
|
||||
You can build UTM with the script:
|
||||
|
||||
```
|
||||
./scripts/build_utm.sh -p macos -a ARCH -o /path/to/output/directory
|
||||
./scripts/build_utm.sh -t TEAMID -p macos -a ARCH -o /path/to/output/directory
|
||||
```
|
||||
|
||||
`ARCH` can be `x86_64` or `arm64` or `"arm64 x86_64"` (quotes are required) for a universal binary. The built artifact is an unsigned `.xcarchive` which you can use with the package tool (see below).
|
||||
|
||||
`TEAMID` is optional and only used if you are going to sign it.
|
||||
|
||||
### Packaging
|
||||
|
||||
Artifacts built with `build_utm.sh` (includes Github Actions artifacts) must be re-signed before it can be used. To properly use all features, you must be a paid Apple Developer with access to a provisioning profile with the Hypervisor entitlements. However, non-registered developers can build "unsigned" packages which lack certain features (such as USB and network bridging support).
|
||||
@@ -61,17 +63,17 @@ This builds `UTM.dmg` in `/path/to/output` which can be installed to `/Applicati
|
||||
#### Signed packages
|
||||
|
||||
```
|
||||
./scripts/package_mac.sh developer-id /path/to/UTM.xcarchive /path/to/output TEAM_ID PROFILE_UUID HELPER_PROFILE_UUID
|
||||
./scripts/package_mac.sh developer-id /path/to/UTM.xcarchive /path/to/output TEAM_ID PROFILE_UUID HELPER_PROFILE_UUID LAUNCHER_PROFILE_UUID
|
||||
```
|
||||
|
||||
To build a signed package, you need to be a registered Apple Developer. From the developer portal, create a certificate for "Developer ID Application" (and install it into your Keychain). Also create two provisioning profiles with that certificate with Hypervisor entitlements (you need to manually request these entitlements and be approved by Apple) for both UTM and QEMUHelper. `TEAM_ID` should be the same as in the certificate, `PROFILE_UUID` should be the UUID of the profile installed by Xcode (open the profile in Xcode), and `HELPER_PROFILE_UUID` is the UUID of a separate profile for the XPC helper.
|
||||
To build a signed package, you need to be a registered Apple Developer. From the developer portal, create a certificate for "Developer ID Application" (and install it into your Keychain). Also create three provisioning profiles with that certificate with Hypervisor entitlements (you need to manually request these entitlements and be approved by Apple) for UTM, QEMUHelper, and QEMULauncher. `TEAM_ID` should be the same as in the certificate, `PROFILE_UUID` should be the UUID of the profile installed by Xcode (open the profile in Xcode), and `HELPER_PROFILE_UUID` is the UUID of a separate profile for the XPC helper. `LAUNCHER_PROFILE_UUID` is the UUID of a profile for the launcher.
|
||||
|
||||
Once properly signed, you can ask Apple to notarize the DMG.
|
||||
|
||||
#### Mac App Store
|
||||
|
||||
```
|
||||
./scripts/package_mac.sh app-store /path/to/UTM.xcarchive /path/to/output TEAM_ID PROFILE_UUID HELPER_PROFILE_UUID
|
||||
./scripts/package_mac.sh app-store /path/to/UTM.xcarchive /path/to/output TEAM_ID PROFILE_UUID HELPER_PROFILE_UUID LAUNCHER_PROFILE_UUID
|
||||
```
|
||||
|
||||
Similar to the above but builds a `UTM.pkg` for submission to the Mac App Store. You need a certificate for "Apple Distribution" and a certificate for "Mac App Distribution" as well as a provisioning profile with the right entitlements.
|
||||
|
||||
+11
-2
@@ -7,8 +7,9 @@ command -v realpath >/dev/null 2>&1 || realpath() {
|
||||
BASEDIR="$(dirname "$(realpath $0)")"
|
||||
|
||||
usage () {
|
||||
echo "Usage: $(basename $0) [-p platform] [-a architecture] [-t targetversion] [-o output]"
|
||||
echo "Usage: $(basename $0) [-t teamid] [-p platform] [-a architecture] [-t targetversion] [-o output]"
|
||||
echo ""
|
||||
echo " -t teamid Team Identifier for app groups. Optional for iOS. Required for macOS."
|
||||
echo " -p platform Target platform. Default ios. [ios|ios_simulator|ios-tci|ios_simulator-tci|macos]"
|
||||
echo " -a architecture Target architecture. Default arm64. [armv7|armv7s|arm64|i386|x86_64]"
|
||||
echo " -o output Output archive path. Default is current directory."
|
||||
@@ -16,6 +17,7 @@ usage () {
|
||||
exit 1
|
||||
}
|
||||
|
||||
TEAM_IDENTIFIER=
|
||||
ARCH=arm64
|
||||
PLATFORM=ios
|
||||
OUTPUT=$PWD
|
||||
@@ -24,6 +26,10 @@ SCHEME=
|
||||
|
||||
while [ "x$1" != "x" ]; do
|
||||
case $1 in
|
||||
-t )
|
||||
TEAM_IDENTIFIER=$2
|
||||
shift
|
||||
;;
|
||||
-a )
|
||||
ARCH=$2
|
||||
shift
|
||||
@@ -74,5 +80,8 @@ macos )
|
||||
esac
|
||||
|
||||
ARCH_ARGS=$(echo $ARCH | xargs printf -- "-arch %s ")
|
||||
if [ ! -z "$TEAM_IDENTIFIER" ]; then
|
||||
TEAM_IDENTIFIER_PREFIX="TeamIdentifierPrefix=${TEAM_IDENTIFIER}."
|
||||
fi
|
||||
|
||||
xcodebuild archive -archivePath "$OUTPUT" -scheme "$SCHEME" -sdk "$SDK" $ARCH_ARGS -configuration Release CODE_SIGNING_ALLOWED=NO
|
||||
xcodebuild archive -archivePath "$OUTPUT" -scheme "$SCHEME" -sdk "$SDK" $ARCH_ARGS -configuration Release CODE_SIGNING_ALLOWED=NO $TEAM_IDENTIFIER_PREFIX
|
||||
|
||||
+11
-3
@@ -33,6 +33,7 @@ UTM_ENTITLEMENTS="/tmp/utm.entitlements"
|
||||
LAUNCHER_ENTITLEMENTS="/tmp/launcher.entitlements"
|
||||
HELPER_ENTITLEMENTS="/tmp/helper.entitlements"
|
||||
INPUT_COPY="/tmp/UTM.xcarchive"
|
||||
PRODUCT_BUNDLE_PREFIX="com.utmapp"
|
||||
|
||||
cat >"$OPTIONS" <<EOL
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
@@ -47,11 +48,11 @@ cat >"$OPTIONS" <<EOL
|
||||
<string>${MODE}</string>
|
||||
<key>provisioningProfiles</key>
|
||||
<dict>
|
||||
<key>com.utmapp.UTM</key>
|
||||
<key>${PRODUCT_BUNDLE_PREFIX}.UTM</key>
|
||||
<string>${PROFILE_NAME}</string>
|
||||
<key>com.utmapp.QEMUHelper</key>
|
||||
<key>${PRODUCT_BUNDLE_PREFIX}.QEMUHelper</key>
|
||||
<string>${HELPER_PROFILE_NAME}</string>
|
||||
<key>com.utmapp.QEMULauncher</key>
|
||||
<key>${PRODUCT_BUNDLE_PREFIX}.QEMULauncher</key>
|
||||
<string>${LAUNCHER_PROFILE_NAME}</string>
|
||||
</dict>
|
||||
<key>signingStyle</key>
|
||||
@@ -79,6 +80,13 @@ if [ "$MODE" == "unsigned" ]; then
|
||||
/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$HELPER_ENTITLEMENTS"
|
||||
fi
|
||||
|
||||
if [ ! -z "$TEAM_ID" ]; then
|
||||
TEAM_ID_PREFIX="${TEAM_ID}."
|
||||
fi
|
||||
|
||||
/usr/libexec/PlistBuddy -c "Set :com.apple.security.application-groups:0 ${TEAM_ID_PREFIX}${PRODUCT_BUNDLE_PREFIX}" "$UTM_ENTITLEMENTS"
|
||||
/usr/libexec/PlistBuddy -c "Set :com.apple.security.application-groups:0 ${TEAM_ID_PREFIX}${PRODUCT_BUNDLE_PREFIX}" "$HELPER_ENTITLEMENTS"
|
||||
|
||||
# ad-hoc sign with the right entitlements
|
||||
rm -rf "$INPUT_COPY"
|
||||
cp -a "$INPUT" "$INPUT_COPY"
|
||||
|
||||
Reference in New Issue
Block a user