mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
9fa2749e6b
Updating the Apple identity for the new certificate to sign `pkg`s. Run: https://github.com/fleetdm/fleet/actions/runs/23159085327
121 lines
4.6 KiB
YAML
121 lines
4.6 KiB
YAML
# This workflow can be used to build a fleetd-base.pkg package
|
|
# that can be hosted on a local server to test ADE workflows.
|
|
#
|
|
# Output is the fleetd-base.pkg itself and the corresponding fleetd-base-manifest.plist.
|
|
name: Build and codesign fleetd-base.pkg
|
|
|
|
on:
|
|
workflow_dispatch: # allow manual action
|
|
inputs:
|
|
orbit-channel:
|
|
description: "TUF channel for the orbit component"
|
|
required: false
|
|
default: "stable"
|
|
type: string
|
|
osqueryd-channel:
|
|
description: "TUF channel for the osqueryd component"
|
|
required: false
|
|
default: "stable"
|
|
type: string
|
|
desktop-channel:
|
|
description: "TUF channel for the Fleet Desktop component"
|
|
required: false
|
|
default: "stable"
|
|
type: string
|
|
base-url:
|
|
description: "URL that will host the generated fleetd-base.pkg"
|
|
required: true
|
|
type: string
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: macos-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Import package signing keys
|
|
env:
|
|
APPLE_INSTALLER_CERTIFICATE: ${{ secrets.APPLE_INSTALLER_CERTIFICATE }}
|
|
APPLE_INSTALLER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
echo "$APPLE_INSTALLER_CERTIFICATE" | base64 --decode > certificate.p12
|
|
security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain
|
|
security import certificate.p12 -k build.keychain -P $APPLE_INSTALLER_CERTIFICATE_PASSWORD -T /usr/bin/productsign
|
|
security set-key-partition-list -S apple-tool:,apple:,productsign: -s -k $KEYCHAIN_PASSWORD build.keychain
|
|
security find-identity -vv
|
|
rm certificate.p12
|
|
|
|
- name: Install fleetctl
|
|
run: npm install -g fleetctl
|
|
|
|
- name: Build PKG, sign, and notarize
|
|
id: build-sign-notarize
|
|
env:
|
|
AC_USERNAME: ${{ secrets.APPLE_USERNAME }}
|
|
AC_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
AC_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
PACKAGE_SIGNING_IDENTITY_SHA1: 4608F71FB42E1845C7FC9B2D2B6A7A8D11BBD940
|
|
run: |
|
|
fleetctl package --type pkg --fleet-desktop \
|
|
--use-system-configuration --sign-identity $PACKAGE_SIGNING_IDENTITY_SHA1 --notarize \
|
|
--orbit-channel ${{ github.event.inputs.orbit-channel }} \
|
|
--osqueryd-channel ${{ github.event.inputs.osqueryd-channel }} \
|
|
--desktop-channel ${{ github.event.inputs.desktop-channel }}
|
|
mv fleet-osquery*.pkg fleetd-base.pkg
|
|
: # Calculate the SHA256 checksum of the package
|
|
echo "fleetd_base_pkg_sha256=$(shasum -a 256 fleetd-base.pkg | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Create plist
|
|
run: |
|
|
echo '<plist version="1.0">
|
|
<dict>
|
|
<key>items</key>
|
|
<array>
|
|
<dict>
|
|
<key>assets</key>
|
|
<array>
|
|
<dict>
|
|
<key>kind</key>
|
|
<string>software-package</string>
|
|
<key>sha256-size</key>
|
|
<integer>32</integer>
|
|
<key>sha256s</key>
|
|
<array>
|
|
<string>${{ steps.build-sign-notarize.outputs.fleetd_base_pkg_sha256 }}</string>
|
|
</array>
|
|
<key>url</key>
|
|
<string>${{ github.event.inputs.base-url }}/fleetd-base.pkg</string>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</plist>' > fleetd-base-manifest.plist
|
|
|
|
- name: Upload fleetd-base.pkg
|
|
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
|
|
with:
|
|
name: fleetd-base.pkg
|
|
path: |
|
|
fleetd-base.pkg
|
|
|
|
- name: Upload fleetd-base-manifest.plist
|
|
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
|
|
with:
|
|
name: fleetd-base-manifest.plist
|
|
path: |
|
|
fleetd-base-manifest.plist
|