diff --git a/tools/osx-notarize.sh b/tools/osx-notarize.sh index 31c92c2ca426f3..beea7041793cdf 100755 --- a/tools/osx-notarize.sh +++ b/tools/osx-notarize.sh @@ -1,34 +1,87 @@ #!/bin/sh -# Uses gon, from https://github.com/mitchellh/gon, to notarize a generated node-.pkg file -# with Apple for installation on macOS Catalina and later as validated by Gatekeeper. +# Notarize a generated node-.pkg file as an Apple requirement for installation on macOS Catalina and later, as validated by Gatekeeper. +# Uses gon (Xcode version < 13.0) or notarytool (Xcode >= 13.0). -set -e - -gon_version="0.2.2" -gon_exe="${HOME}/.gon/gon_${gon_version}" +version() { + echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }' || echo "0" +} +xcode_version=$(xcodebuild -version | awk '/Xcode/ {print $2}') +xcode_version_result=$(version "$xcode_version") +xcode_version_threshold=$(version "13.0") pkgid="$1" -[ -z "$pkgid" ] && \ - echo "Usage: $0 " \ +if [ -z "$pkgid" ]; then + echo "Usage: $0 " exit 1 +fi # shellcheck disable=SC2154 -[ -z "$NOTARIZATION_ID" ] && \ - echo "No NOTARIZATION_ID environment var. Skipping notarization." \ +if [ -z "$NOTARIZATION_ID" ]; then + echo "No NOTARIZATION_ID environment variable. Skipping notarization." exit 0 +fi -set -x - -mkdir -p "${HOME}/.gon/" +if [ -z "$NOTARIZATION_PASSWORD" ]; then + echo "No NOTARIZATION_PASSWORD environment variable. Skipping notarization." + exit 0 +fi -if [ ! -f "${gon_exe}" ]; then - curl -sL "https://github.com/mitchellh/gon/releases/download/v${gon_version}/gon_${gon_version}_macos.zip" -o "${gon_exe}.zip" - (cd "${HOME}/.gon/" && rm -f gon && unzip "${gon_exe}.zip" && mv gon "${gon_exe}") +if [ -z "$NOTARIZATION_TEAM_ID" ]; then + echo "No NOTARIZATION_TEAM_ID environment variable. Skipping notarization." + exit 0 fi -sed -e "s/{{appleid}}/${NOTARIZATION_ID}/" -e "s/{{pkgid}}/${pkgid}/" tools/osx-gon-config.json.tmpl \ - > gon-config.json +# TODO(@ulisesGascon): remove support for gon +# when https://github.com/nodejs/build/issues/3385#issuecomment-1729281269 is ready +if [ "$xcode_version_result" -lt "$xcode_version_threshold" ]; then + echo "Notarization process is done with gon." + set -x + + gon_version="0.2.2" + gon_exe="${HOME}/.gon/gon_${gon_version}" -"${gon_exe}" -log-level=info gon-config.json + mkdir -p "${HOME}/.gon/" + + if [ ! -f "${gon_exe}" ]; then + curl -sL "https://github.com/mitchellh/gon/releases/download/v${gon_version}/gon_${gon_version}_macos.zip" -o "${gon_exe}.zip" + (cd "${HOME}/.gon/" && rm -f gon && unzip "${gon_exe}.zip" && mv gon "${gon_exe}") + fi + + sed -e "s/{{appleid}}/${NOTARIZATION_ID}/" -e "s/{{pkgid}}/${pkgid}/" tools/osx-gon-config.json.tmpl \ + > gon-config.json + + "${gon_exe}" -log-level=info gon-config.json + +else + echo "Notarization process is done with Notarytool." + + if ! command -v xcrun notarytool > /dev/null + then + echo "Notarytool is not present in the system. Notarization has failed." + exit 1 + fi + + # Submit the package for notarization + # TODO(@ulisesGascon): refactor to use --keychain-profile + # when https://github.com/nodejs/build/issues/3385#issuecomment-1729281269 is ready + notarization_output=$( + xcrun notarytool submit \ + --apple-id "$NOTARIZATION_ID" \ + --password "$NOTARIZATION_PASSWORD" \ + --team-id "$NOTARIZATION_TEAM_ID" \ + --wait \ + "node-$pkgid.pkg" 2>&1 + ) + + if [ $? -eq 0 ]; then + # Extract the operation ID from the output + operation_id=$(echo "$notarization_output" | awk '/RequestUUID/ {print $NF}') + echo "Notarization submitted. Operation ID: $operation_id" + exit 0 + else + echo "Notarization failed. Error: $notarization_output" + exit 1 + fi +fi