Alexey Tsvetkov
3 years ago
committed by
GitHub
18 changed files with 945 additions and 124 deletions
@ -0,0 +1,30 @@
|
||||
package org.jetbrains.compose.desktop.application.dsl |
||||
|
||||
import org.gradle.api.model.ObjectFactory |
||||
import org.gradle.api.provider.Property |
||||
import org.gradle.api.provider.ProviderFactory |
||||
import org.gradle.api.tasks.Input |
||||
import org.gradle.api.tasks.Optional |
||||
import org.jetbrains.compose.desktop.application.internal.ComposeProperties |
||||
import org.jetbrains.compose.desktop.application.internal.nullableProperty |
||||
import javax.inject.Inject |
||||
|
||||
abstract class MacOSNotarizationSettings { |
||||
@get:Inject |
||||
protected abstract val objects: ObjectFactory |
||||
|
||||
@get:Inject |
||||
protected abstract val providers: ProviderFactory |
||||
|
||||
@get:Input |
||||
@get:Optional |
||||
val appleID: Property<String?> = objects.nullableProperty<String>().apply { |
||||
set(ComposeProperties.macNotarizationAppleID(providers)) |
||||
} |
||||
|
||||
@get:Input |
||||
@get:Optional |
||||
val password: Property<String?> = objects.nullableProperty<String>().apply { |
||||
set(ComposeProperties.macNotarizationPassword(providers)) |
||||
} |
||||
} |
||||
@ -0,0 +1,41 @@
|
||||
package org.jetbrains.compose.desktop.application.dsl |
||||
|
||||
import org.gradle.api.model.ObjectFactory |
||||
import org.gradle.api.provider.Property |
||||
import org.gradle.api.provider.ProviderFactory |
||||
import org.gradle.api.tasks.Input |
||||
import org.gradle.api.tasks.Optional |
||||
import org.jetbrains.compose.desktop.application.internal.ComposeProperties |
||||
import org.jetbrains.compose.desktop.application.internal.notNullProperty |
||||
import org.jetbrains.compose.desktop.application.internal.nullableProperty |
||||
import javax.inject.Inject |
||||
|
||||
abstract class MacOSSigningSettings { |
||||
@get:Inject |
||||
protected abstract val objects: ObjectFactory |
||||
@get:Inject |
||||
protected abstract val providers: ProviderFactory |
||||
|
||||
@get:Input |
||||
val sign: Property<Boolean> = objects.notNullProperty<Boolean>().apply { |
||||
set( |
||||
ComposeProperties.macSign(providers) |
||||
.orElse(false) |
||||
) |
||||
} |
||||
@get:Input |
||||
@get:Optional |
||||
val identity: Property<String?> = objects.nullableProperty<String>().apply { |
||||
set(ComposeProperties.macSignIdentity(providers)) |
||||
} |
||||
@get:Input |
||||
@get:Optional |
||||
val keychain: Property<String?> = objects.nullableProperty<String>().apply { |
||||
set(ComposeProperties.macSignKeychain(providers)) |
||||
} |
||||
@get:Input |
||||
@get:Optional |
||||
val prefix: Property<String?> = objects.nullableProperty<String>().apply { |
||||
set(ComposeProperties.macSignPrefix(providers)) |
||||
} |
||||
} |
||||
@ -0,0 +1,7 @@
|
||||
package org.jetbrains.compose.desktop.application.internal |
||||
|
||||
import java.io.File |
||||
|
||||
internal interface FileCopyingProcessor { |
||||
fun copy(source: File, target: File) |
||||
} |
||||
@ -0,0 +1,116 @@
|
||||
package org.jetbrains.compose.desktop.application.internal |
||||
|
||||
import org.gradle.process.ExecOperations |
||||
import org.jetbrains.compose.desktop.application.internal.validation.ValidatedMacOSSigningSettings |
||||
import java.io.* |
||||
import java.util.regex.Pattern |
||||
import java.util.zip.ZipEntry |
||||
import java.util.zip.ZipInputStream |
||||
import java.util.zip.ZipOutputStream |
||||
|
||||
internal class MacJarSignFileCopyingProcessor( |
||||
private val tempDir: File, |
||||
private val execOperations: ExecOperations, |
||||
private val signing: ValidatedMacOSSigningSettings |
||||
) : FileCopyingProcessor { |
||||
private val signKey: String |
||||
|
||||
init { |
||||
val certificates = ByteArrayOutputStream().use { baos -> |
||||
PrintStream(baos).use { ps -> |
||||
execOperations.exec { exec -> |
||||
exec.executable = MacUtils.security.absolutePath |
||||
val args = arrayListOf("find-certificate", "-a", "-c", signing.fullDeveloperID) |
||||
signing.keychain?.let { args.add(it.absolutePath) } |
||||
exec.args(*args.toTypedArray()) |
||||
exec.standardOutput = ps |
||||
} |
||||
} |
||||
baos.toString() |
||||
} |
||||
val regex = Pattern.compile("\"alis\"<blob>=\"([^\"]+)\"") |
||||
val m = regex.matcher(certificates) |
||||
if (!m.find()) { |
||||
val keychainPath = signing.keychain?.absolutePath |
||||
error( |
||||
"Could not find certificate for '${signing.identity}'" + |
||||
" in keychain [${keychainPath.orEmpty()}]" |
||||
) |
||||
} |
||||
|
||||
signKey = m.group(1) |
||||
if (m.find()) error("Multiple matching certificates are found for '${signing.fullDeveloperID}'. " + |
||||
"Please specify keychain containing unique matching certificate.") |
||||
} |
||||
|
||||
override fun copy(source: File, target: File) { |
||||
if (!source.isJarFile) { |
||||
SimpleFileCopyingProcessor.copy(source, target) |
||||
return |
||||
} |
||||
|
||||
if (target.exists()) target.delete() |
||||
|
||||
ZipInputStream(FileInputStream(source).buffered()).use { zin -> |
||||
ZipOutputStream(FileOutputStream(target).buffered()).use { zout -> |
||||
copyAndSignNativeLibs(zin, zout) |
||||
} |
||||
} |
||||
} |
||||
|
||||
private fun copyAndSignNativeLibs(zin: ZipInputStream, zout: ZipOutputStream) { |
||||
for (sourceEntry in generateSequence { zin.nextEntry }) { |
||||
if (!sourceEntry.name.endsWith(".dylib")) { |
||||
zout.putNextEntry(ZipEntry(sourceEntry)) |
||||
zin.copyTo(zout) |
||||
} else { |
||||
|
||||
val unpackedDylibFile = tempDir.resolve(sourceEntry.name.substringAfterLast("/")) |
||||
try { |
||||
unpackedDylibFile.outputStream().buffered().use { |
||||
zin.copyTo(it) |
||||
} |
||||
|
||||
signDylib(unpackedDylibFile) |
||||
val targetEntry = ZipEntry(sourceEntry.name).apply { |
||||
comment = sourceEntry.comment |
||||
extra = sourceEntry.extra |
||||
method = sourceEntry.method |
||||
size = unpackedDylibFile.length() |
||||
} |
||||
zout.putNextEntry(targetEntry) |
||||
|
||||
unpackedDylibFile.inputStream().buffered().use { |
||||
it.copyTo(zout) |
||||
} |
||||
} finally { |
||||
unpackedDylibFile.delete() |
||||
} |
||||
} |
||||
zout.closeEntry() |
||||
} |
||||
} |
||||
|
||||
private fun signDylib(dylibFile: File) { |
||||
val args = arrayListOf( |
||||
"-vvvv", |
||||
"--timestamp", |
||||
"--options", "runtime", |
||||
"--force", |
||||
"--prefix", signing.prefix, |
||||
"--sign", signKey |
||||
) |
||||
|
||||
signing.keychain?.let { |
||||
args.add("--keychain") |
||||
args.add(it.absolutePath) |
||||
} |
||||
|
||||
args.add(dylibFile.absolutePath) |
||||
|
||||
execOperations.exec { exec -> |
||||
exec.executable = MacUtils.codesign.absolutePath |
||||
exec.args(*args.toTypedArray()) |
||||
}.assertNormalExitValue() |
||||
} |
||||
} |
||||
@ -0,0 +1,9 @@
|
||||
package org.jetbrains.compose.desktop.application.internal |
||||
|
||||
import java.io.File |
||||
|
||||
object SimpleFileCopyingProcessor : FileCopyingProcessor { |
||||
override fun copy(source: File, target: File) { |
||||
source.copyTo(target, overwrite = true) |
||||
} |
||||
} |
||||
@ -0,0 +1,40 @@
|
||||
package org.jetbrains.compose.desktop.application.internal.validation |
||||
|
||||
import org.gradle.api.provider.Provider |
||||
import org.jetbrains.compose.desktop.application.dsl.MacOSNotarizationSettings |
||||
import org.jetbrains.compose.desktop.application.internal.ComposeProperties |
||||
|
||||
internal data class ValidatedMacOSNotarizationSettings( |
||||
val bundleID: String, |
||||
val appleID: String, |
||||
val password: String |
||||
) |
||||
|
||||
internal fun MacOSNotarizationSettings.validate( |
||||
bundleIDProvider: Provider<String?> |
||||
): ValidatedMacOSNotarizationSettings { |
||||
val bundleID = validateBundleID(bundleIDProvider) |
||||
check(!appleID.orNull.isNullOrEmpty()) { |
||||
ERR_APPLE_ID_IS_EMPTY |
||||
} |
||||
check(!password.orNull.isNullOrEmpty()) { |
||||
ERR_PASSWORD_IS_EMPTY |
||||
} |
||||
return ValidatedMacOSNotarizationSettings( |
||||
bundleID = bundleID, |
||||
appleID = appleID.orNull!!, |
||||
password = password.orNull!! |
||||
) |
||||
} |
||||
|
||||
private const val ERR_PREFIX = "Notarization settings error:" |
||||
private val ERR_APPLE_ID_IS_EMPTY = |
||||
"""|$ERR_PREFIX appleID is null or empty. To specify: |
||||
| * Use '${ComposeProperties.MAC_NOTARIZATION_APPLE_ID}' Gradle property; |
||||
| * Or use 'nativeDistributions.macOS.notarization.appleID' DSL property; |
||||
""".trimMargin() |
||||
private val ERR_PASSWORD_IS_EMPTY = |
||||
"""|$ERR_PREFIX password is null or empty. To specify: |
||||
| * Use '${ComposeProperties.MAC_NOTARIZATION_PASSWORD}' Gradle property; |
||||
| * Or use 'nativeDistributions.macOS.notarization.password' DSL property; |
||||
""".trimMargin() |
||||
@ -0,0 +1,67 @@
|
||||
package org.jetbrains.compose.desktop.application.internal.validation |
||||
|
||||
import org.gradle.api.provider.Provider |
||||
import org.jetbrains.compose.desktop.application.dsl.MacOSSigningSettings |
||||
import org.jetbrains.compose.desktop.application.internal.ComposeProperties |
||||
import org.jetbrains.compose.desktop.application.internal.OS |
||||
import org.jetbrains.compose.desktop.application.internal.currentOS |
||||
import java.io.File |
||||
|
||||
internal data class ValidatedMacOSSigningSettings( |
||||
val bundleID: String, |
||||
val identity: String, |
||||
val keychain: File?, |
||||
val prefix: String, |
||||
) { |
||||
val fullDeveloperID: String |
||||
get() { |
||||
val developerIdPrefix = "Developer ID Application: " |
||||
val thirdPartyMacDeveloperPrefix = "3rd Party Mac Developer Application: " |
||||
return when { |
||||
identity.startsWith(developerIdPrefix) -> identity |
||||
identity.startsWith(thirdPartyMacDeveloperPrefix) -> identity |
||||
else -> developerIdPrefix + identity |
||||
} |
||||
} |
||||
} |
||||
|
||||
internal fun MacOSSigningSettings.validate( |
||||
bundleIDProvider: Provider<String?> |
||||
): ValidatedMacOSSigningSettings { |
||||
check(currentOS == OS.MacOS) { ERR_WRONG_OS } |
||||
|
||||
val bundleID = validateBundleID(bundleIDProvider) |
||||
val signPrefix = this.prefix.orNull |
||||
?: (bundleID.substringBeforeLast(".") + ".").takeIf { bundleID.contains('.') } |
||||
?: error(ERR_UNKNOWN_PREFIX) |
||||
val signIdentity = this.identity.orNull |
||||
?: error(ERR_UNKNOWN_SIGN_ID) |
||||
val keychainFile = this.keychain.orNull?.let { File(it) } |
||||
if (keychainFile != null) { |
||||
check(keychainFile.exists()) { |
||||
"$ERR_PREFIX keychain is not an existing file: ${keychainFile.absolutePath}" |
||||
} |
||||
} |
||||
|
||||
return ValidatedMacOSSigningSettings( |
||||
bundleID = bundleID, |
||||
identity = signIdentity, |
||||
keychain = keychainFile, |
||||
prefix = signPrefix |
||||
) |
||||
} |
||||
|
||||
private const val ERR_PREFIX = "Signing settings error:" |
||||
private val ERR_WRONG_OS = |
||||
"$ERR_PREFIX macOS was expected, actual OS is $currentOS" |
||||
private val ERR_UNKNOWN_PREFIX = |
||||
"""|$ERR_PREFIX Could not infer signing prefix. To specify: |
||||
| * Set bundleID to reverse DNS notation (e.g. "com.mycompany.myapp"); |
||||
| * Use '${ComposeProperties.MAC_SIGN_PREFIX}' Gradle property; |
||||
| * Use 'nativeExecutables.macOS.signing.prefix' DSL property; |
||||
""".trimMargin() |
||||
private val ERR_UNKNOWN_SIGN_ID = |
||||
"""|$ERR_PREFIX signing identity is null or empty. To specify: |
||||
| * Use '${ComposeProperties.MAC_SIGN_ID}' Gradle property; |
||||
| * Use 'nativeExecutables.macOS.signing.identity' DSL property; |
||||
""".trimMargin() |
||||
@ -0,0 +1,22 @@
|
||||
package org.jetbrains.compose.desktop.application.internal.validation |
||||
|
||||
import org.gradle.api.provider.Provider |
||||
|
||||
internal fun validateBundleID(bundleIDProvider: Provider<String?>): String { |
||||
val bundleID = bundleIDProvider.orNull |
||||
check(!bundleID.isNullOrEmpty()) { ERR_BUNDLE_ID_IS_EMPTY } |
||||
check(bundleID.matches("[A-Za-z0-9\\-\\.]+".toRegex())) { ERR_BUNDLE_ID_WRONG_FORMAT } |
||||
return bundleID |
||||
} |
||||
|
||||
private const val ERR_PREFIX = "macOS settings error:" |
||||
private const val BUNDLE_ID_FORMAT = |
||||
"bundleID may only contain alphanumeric characters (A-Z, a-z, 0-9), hyphen (-) and period (.) characters" |
||||
private val ERR_BUNDLE_ID_IS_EMPTY = |
||||
"""|$ERR_PREFIX bundleID is empty or null. To specify: |
||||
| * Use 'nativeExecutables.macOS.bundleID' DSL property; |
||||
| * $BUNDLE_ID_FORMAT; |
||||
| * Use reverse DNS notation (e.g. "com.mycompany.myapp"); |
||||
|""".trimMargin() |
||||
private val ERR_BUNDLE_ID_WRONG_FORMAT = |
||||
"$ERR_PREFIX $BUNDLE_ID_FORMAT" |
||||
@ -0,0 +1,27 @@
|
||||
package org.jetbrains.compose.desktop.application.tasks |
||||
|
||||
import org.gradle.api.file.RegularFileProperty |
||||
import org.gradle.api.tasks.* |
||||
import org.jetbrains.compose.desktop.application.internal.MacUtils |
||||
import org.jetbrains.compose.desktop.application.internal.ioFile |
||||
|
||||
abstract class AbstractCheckNotarizationStatusTask : AbstractNotarizationTask() { |
||||
@get:InputFile |
||||
val requestIDFile: RegularFileProperty = objects.fileProperty() |
||||
|
||||
@TaskAction |
||||
fun run() { |
||||
val notarization = validateNotarization() |
||||
|
||||
val requestId = requestIDFile.ioFile.readText() |
||||
execOperations.exec { exec -> |
||||
exec.executable = MacUtils.xcrun.absolutePath |
||||
exec.args( |
||||
"altool", |
||||
"--notarization-info", requestId, |
||||
"--username", notarization.appleID, |
||||
"--password", notarization.password |
||||
) |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,31 @@
|
||||
package org.jetbrains.compose.desktop.application.tasks |
||||
|
||||
import org.gradle.api.DefaultTask |
||||
import org.gradle.api.model.ObjectFactory |
||||
import org.gradle.api.provider.Property |
||||
import org.gradle.api.tasks.Input |
||||
import org.gradle.api.tasks.Nested |
||||
import org.gradle.api.tasks.Optional |
||||
import org.gradle.process.ExecOperations |
||||
import org.jetbrains.compose.desktop.application.dsl.MacOSNotarizationSettings |
||||
import org.jetbrains.compose.desktop.application.internal.nullableProperty |
||||
import org.jetbrains.compose.desktop.application.internal.validation.validate |
||||
import javax.inject.Inject |
||||
|
||||
abstract class AbstractNotarizationTask( |
||||
) : DefaultTask() { |
||||
@get:Inject |
||||
protected abstract val objects: ObjectFactory |
||||
@get:Inject |
||||
protected abstract val execOperations: ExecOperations |
||||
|
||||
@get:Input |
||||
@get:Optional |
||||
internal val nonValidatedBundleID: Property<String?> = objects.nullableProperty() |
||||
|
||||
@get:Nested |
||||
internal lateinit var nonValidatedNotarizationSettings: MacOSNotarizationSettings |
||||
|
||||
internal fun validateNotarization() = |
||||
nonValidatedNotarizationSettings.validate(nonValidatedBundleID) |
||||
} |
||||
@ -0,0 +1,68 @@
|
||||
package org.jetbrains.compose.desktop.application.tasks |
||||
|
||||
import org.gradle.api.file.DirectoryProperty |
||||
import org.gradle.api.file.RegularFileProperty |
||||
import org.gradle.api.tasks.* |
||||
import org.jetbrains.compose.desktop.application.dsl.TargetFormat |
||||
import org.jetbrains.compose.desktop.application.internal.* |
||||
import java.io.ByteArrayOutputStream |
||||
import java.io.PrintStream |
||||
import javax.inject.Inject |
||||
|
||||
abstract class AbstractUploadAppForNotarizationTask @Inject constructor( |
||||
@get:Input |
||||
val targetFormat: TargetFormat, |
||||
) : AbstractNotarizationTask() { |
||||
@get:InputDirectory |
||||
val inputDir: DirectoryProperty = objects.directoryProperty() |
||||
|
||||
@get:OutputFile |
||||
val requestIDFile: RegularFileProperty = objects.fileProperty() |
||||
|
||||
init { |
||||
check(targetFormat != TargetFormat.AppImage) { "${TargetFormat.AppImage} cannot be notarized!" } |
||||
} |
||||
|
||||
@TaskAction |
||||
fun run() { |
||||
val notarization = validateNotarization() |
||||
|
||||
val inputFile = findOutputFileOrDir(inputDir.ioFile, targetFormat) |
||||
val file = inputFile.checkExistingFile() |
||||
|
||||
logger.quiet("Uploading '${file.name}' for notarization (package id: '${notarization.bundleID}')") |
||||
val (res, output) = ByteArrayOutputStream().use { baos -> |
||||
PrintStream(baos).use { ps -> |
||||
val res = execOperations.exec { exec -> |
||||
exec.executable = MacUtils.xcrun.absolutePath |
||||
exec.args( |
||||
"altool", |
||||
"--notarize-app", |
||||
"--primary-bundle-id", notarization.bundleID, |
||||
"--username", notarization.appleID, |
||||
"--password", notarization.password, |
||||
"--file", file |
||||
) |
||||
exec.standardOutput = ps |
||||
} |
||||
|
||||
res to baos.toString() |
||||
} |
||||
} |
||||
if (res.exitValue != 0) { |
||||
logger.error("Uploading failed. Stdout: $output") |
||||
res.assertNormalExitValue() |
||||
} |
||||
val m = "RequestUUID = ([A-Za-z0-9\\-]+)".toRegex().find(output) |
||||
?: error("Could not determine RequestUUID from output: $output") |
||||
|
||||
val requestId = m.groupValues[1] |
||||
requestIDFile.ioFile.apply { |
||||
parentFile.mkdirs() |
||||
writeText(requestId) |
||||
} |
||||
|
||||
logger.quiet("Request UUID: $requestId") |
||||
logger.quiet("Request UUID is saved to ${requestIDFile.ioFile.absolutePath}") |
||||
} |
||||
} |
||||
@ -0,0 +1,226 @@
|
||||
# Signing and notarizing distributions for macOS |
||||
|
||||
Apple [requires](https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution) |
||||
all 3rd apps to be signed and notarized (checked by Apple) |
||||
for running on recent versions of macOS. |
||||
|
||||
## What is covered |
||||
|
||||
In this tutorial, we'll show you how to sign and notarize |
||||
native distributions of Compose apps (in `dmg` or `pkg` formats) |
||||
for distribution on macOS. |
||||
|
||||
## Prerequisites |
||||
|
||||
* [Xcode](https://developer.apple.com/xcode/). The tutorial was checked with Xcode 12.3. |
||||
* JDK 15+ (JDK 14 is not guaranteed to work). The tutorial was checked with OpenJDK 15.0.1. |
||||
|
||||
## Preparing a Developer ID certificate |
||||
|
||||
You will need a Developer ID certificate for signing your app. |
||||
|
||||
#### Checking existing Developer ID certificates |
||||
|
||||
Open https://developer.apple.com/account/resources/certificates |
||||
|
||||
#### Creating a new Developer ID certificate |
||||
1. [Create a certificate signing request](https://help.apple.com/developer-account/#/devbfa00fef7): |
||||
* Open `Keychain Access`. |
||||
* Open the menu dialog |
||||
``` |
||||
Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority |
||||
``` |
||||
* Enter your Developer ID email and common name. |
||||
* Check `Save to disk` option. |
||||
2. Create and install a new certificate using your [Apple Developer account](https://developer.apple.com/account/): |
||||
* Open https://developer.apple.com/account/resources/certificates/add |
||||
* Choose the `Developer ID Application` certificate type. |
||||
* Upload your Certificate Signing Request from the previous step. |
||||
* Download and install the certificate (drag & drop the certificate into the `Keychain Access` application). |
||||
|
||||
#### Viewing installed certificates |
||||
|
||||
You can find all installed certificates and their keychains by running the following command: |
||||
``` |
||||
/usr/bin/security find-certificate -c "Developer ID Application" |
||||
``` |
||||
|
||||
If you have multiple `Developer ID Application` certificates installed, |
||||
you will need to specify the path to the keychain, containing |
||||
the certificate intended for signing. |
||||
|
||||
## Preparing an App ID |
||||
|
||||
An App ID represents one or more applications in Apple's ecosystem. |
||||
|
||||
#### Viewing existing App IDs |
||||
|
||||
Open [the page](https://developer.apple.com/account/resources/identifiers/list) on Apple's developer portal. |
||||
|
||||
#### Creating a new App ID |
||||
|
||||
|
||||
1. Open [the page](https://developer.apple.com/account/resources/identifiers/add/bundleId) on Apple's developer portal. |
||||
2. Choose `App ID` option. |
||||
3. Choose `App` type. |
||||
4. Fill the `Bundle ID` field. |
||||
* A [bundle ID](https://developer.apple.com/documentation/bundleresources/information_property_list/cfbundleidentifier) |
||||
uniquely identifies an application in Apple's ecosystem. |
||||
* You can use an explicit bundle ID a wildcard, matching multiple bundle IDs. |
||||
* It is recommended to use the reverse DNS notation (e.g.`com.yoursitename.yourappname`). |
||||
|
||||
## Creating an app-specific password |
||||
|
||||
To be able to upload an app for notarization, |
||||
you will need an app-specific password associated with your Apple ID. |
||||
|
||||
Follow these steps to generate a new password: |
||||
1. Sign in to your [Apple ID](https://appleid.apple.com/account/home) account page. |
||||
2. In the Security section, click Generate Password below App-Specific Passwords. |
||||
|
||||
See [this Apple support page](https://support.apple.com/en-us/HT204397) for more information |
||||
on the app-specific passwords. |
||||
|
||||
## Adding an app-specific password to a keychain |
||||
|
||||
To avoid remembering your one-time password, or writing it in scripts, |
||||
you can add it to the keychain by running: |
||||
``` |
||||
# Any name can be used instead of NOTARIZATION_PASSWORD |
||||
|
||||
xcrun altool --store-password-in-keychain-item "NOTARIZATION_PASSWORD" |
||||
--username <apple_id> |
||||
--password <password> |
||||
``` |
||||
|
||||
Then you'll be able to refer to the password like `@keychain:NOTARIZATION_PASSWORD` |
||||
without the need to write the password itself. |
||||
|
||||
## Configuring Gradle |
||||
|
||||
### Gradle DSL |
||||
|
||||
DSL properties should be specified in `macOS` DSL block of Compose Desktop DSL: |
||||
``` kotlin |
||||
import org.jetbrains.compose.compose |
||||
import org.jetbrains.compose.desktop.application.dsl.TargetFormat |
||||
|
||||
plugins { |
||||
kotlin("jvm") |
||||
id("org.jetbrains.compose") |
||||
} |
||||
|
||||
dependencies { |
||||
implementation(compose.desktop.currentOS) |
||||
} |
||||
|
||||
compose.desktop { |
||||
application { |
||||
mainClass = "example.MainKt" |
||||
|
||||
nativeDistributions { |
||||
targetFormats(TargetFormat.Dmg) |
||||
|
||||
macOS { |
||||
// macOS DSL settings |
||||
} |
||||
} |
||||
} |
||||
} |
||||
``` |
||||
|
||||
### Gradle properties |
||||
|
||||
Some properties can also be specified using |
||||
[Gradle properties](https://docs.gradle.org/current/userguide/build_environment.html#sec:gradle_configuration_properties). |
||||
|
||||
* Default Gradle properties (`compose.desktop.mac.*`) have lower priority, than DSL properties. |
||||
* Gradle properties can be specified (the items are listed in order of ascending priority): |
||||
* In `gradle.properties` file in Gradle home; |
||||
* In `gradle.properties` file in project's root; |
||||
* In command-line |
||||
``` |
||||
./gradlew packageDmg -Pcompose.desktop.mac.sign=true |
||||
``` |
||||
* Note, that `local.properties` is not a standard Gradle file, so it is not supported by default. |
||||
You can load custom properties from it manually in a script, if you want. |
||||
|
||||
### Configuring bundle ID |
||||
|
||||
``` kotlin |
||||
macOS { |
||||
bundleID = "com.example-company.example-app" |
||||
} |
||||
``` |
||||
|
||||
A [bundle ID](https://developer.apple.com/documentation/bundleresources/information_property_list/cfbundleidentifier) |
||||
uniquely identifies an application in Apple's ecosystem. |
||||
* A bundle ID must be specified using the `bundleID` DSL property. |
||||
* Use only alphanumeric characters (`A-Z`, `a-z`, and `0-9`), hyphen (`-`) and period (`.`) characters. |
||||
* Use the reverse DNS notation of your domain (e.g. |
||||
`com.yoursitename.yourappname`). |
||||
* The specified bundle ID must match one of your App IDs. |
||||
|
||||
### Configuring signing settings |
||||
|
||||
``` kotlin |
||||
macOS { |
||||
signing { |
||||
sign.set(true) |
||||
identity.set("John Doe") |
||||
// keychain.set("/path/to/keychain") |
||||
} |
||||
} |
||||
``` |
||||
|
||||
* Set the `sign` DSL property or to `true`. |
||||
* Alternatively, the `compose.desktop.mac.sign` Gradle property can be used. |
||||
* Set the `identity` DSL property to the certificate's name, e.g. `"John Doe"`. |
||||
* Alternatively, the `compose.desktop.mac.signing.identity` Gradle property can be used. |
||||
* Optionally, set the `keychain` DSL property to the path to the specific keychain, containing your certificate. |
||||
* Alternatively, the `compose.desktop.mac.signing.keychain` Gradle property can be used. |
||||
* This step is only necessary, if multiple `Developer ID Application` certificates are installed. |
||||
|
||||
The following Gradle properties can be used instead of DSL properties: |
||||
* `compose.desktop.mac.sign` enables or disables signing. |
||||
Possible values: `true` or `false`. |
||||
* `compose.desktop.mac.signing.identity` overrides the `identity` DSL property. |
||||
* `compose.desktop.mac.signing.keychain` overrides the `keychain` DSL property. |
||||
|
||||
### Configuring notarization settings |
||||
|
||||
``` kotlin |
||||
macOS { |
||||
notarization { |
||||
appleID.set("john.doe@example.com") |
||||
password.set("@keychain:NOTARIZATION_PASSWORD") |
||||
} |
||||
} |
||||
``` |
||||
|
||||
* Set `appleID` to your Apple ID. |
||||
* Alternatively, the `compose.desktop.mac.notarization.appleID` can be used. |
||||
* Set `password` to the app-specific password created previously. |
||||
* Alternatively, the `compose.desktop.mac.notarization.password` can be used. |
||||
* Don't write raw password directly into a build script. |
||||
* If the password was added to the keychain, as described previously, it can be referenced as |
||||
``` |
||||
@keychain:NOTARIZATION_PASSWORD |
||||
``` |
||||
|
||||
## Using Gradle |
||||
|
||||
The following tasks are available: |
||||
* Use `createDistributable` or `package<PACKAGING_FORMAT>` to get a signed application |
||||
(no separate step is required). |
||||
* Use `notarize<PACKAGING_FORMAT>` to upload an application for notarization. |
||||
Once the upload finishes, a `RequestUUID` will be printed. |
||||
The notarization process takes some time. |
||||
Once the notarization process finishes, an email will be sent to you. |
||||
* Use `checkNotarizationStatus<PACKAGING_FORMAT>` to check a status of |
||||
the last notarization request. You can also use a command-line command directly: |
||||
``` |
||||
xcrun altool --notarization-info <RequestUUID> |
||||
--username <Apple_ID> |
||||
--password "@keychain:NOTARIZATION_PASSWORD" |
||||
``` |
||||
Loading…
Reference in new issue