Test Signing #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Signing | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Run weekly to catch certificate expiration early | |
| - cron: "0 9 * * 1" | |
| jobs: | |
| verify-signing: | |
| name: Verify Certificate & Signing | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: crates | |
| - name: Build test binary | |
| working-directory: crates | |
| run: cargo build --release -p vz-cli | |
| - name: Import signing certificate | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| run: | | |
| CERTIFICATE_PATH="$RUNNER_TEMP/certificate.p12" | |
| KEYCHAIN_PATH="$RUNNER_TEMP/test-signing.keychain-db" | |
| KEYCHAIN_PASSWORD="$(openssl rand -hex 32)" | |
| echo -n "$APPLE_CERTIFICATE" | base64 --decode -o "$CERTIFICATE_PATH" | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH" | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| security import "$CERTIFICATE_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \ | |
| -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH" | |
| security set-key-partition-list -S apple-tool:,apple: \ | |
| -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain | |
| echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV" | |
| echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> "$GITHUB_ENV" | |
| - name: Sign with Developer ID | |
| run: | | |
| codesign --sign "Developer ID Application: Conduit Ventures, Inc (QSL4ZJ5R3J)" \ | |
| --keychain "$KEYCHAIN_PATH" \ | |
| --entitlements entitlements/vz-cli.entitlements.plist \ | |
| --options runtime \ | |
| --timestamp \ | |
| --force \ | |
| crates/target/release/vz | |
| - name: Verify signature | |
| run: | | |
| echo "=== Signature verification ===" | |
| codesign --verify --verbose=4 crates/target/release/vz | |
| echo "" | |
| echo "=== Entitlements ===" | |
| codesign --display --entitlements - crates/target/release/vz | |
| echo "" | |
| echo "=== Certificate chain ===" | |
| codesign --display --verbose=4 crates/target/release/vz 2>&1 | grep -E "Authority|TeamIdentifier|Signature" | |
| - name: Check certificate expiration | |
| run: | | |
| # Extract certificate info to check expiration | |
| security find-certificate -a -p "$KEYCHAIN_PATH" | \ | |
| openssl x509 -noout -dates -subject 2>/dev/null || true | |
| - name: Cleanup keychain | |
| if: always() | |
| run: | | |
| if [[ -n "${KEYCHAIN_PATH:-}" ]]; then | |
| security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true | |
| fi |