Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

MacOSX notarization goodies #9538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cmaglie merged 9 commits into arduino:master from cmaglie:notarization
Jan 8, 2020
Merged

MacOSX notarization goodies #9538

cmaglie merged 9 commits into arduino:master from cmaglie:notarization
Jan 8, 2020

Conversation

Copy link
Member

@cmaglie cmaglie commented Dec 18, 2019

Here a prebuild binary to test: https://downloads.arduino.cc/arduino-1.8.11-prerelease1-macosx-signed.zip

Changelog:

To successfully notarize the Arduino.app the JRE bundled in the app (using the ant flag -DMACOSX_BUNDLED_JVM=...) must be signed and built using a recent mac SDK (>10.9).

The commands used to produce the notarized zip are:

cd /Code/arduino/build
ant -DMACOSX_BUNDLED_JVM=/Library/Java/JavaVirtualMachines/jdk1.8.0_99.jdk/Contents/Home clean dist
rm -fr macosx/work/Arduino.app
unzip macosx/arduino-1.8.11-macosx.zip -d macosx/work/
security unlock-keychain -p XXX /Certs/XXX.keychain
codesign -s "ARDUINO SA" -fv --keychain /Certs/XXX.keychain --options runtime --timestamp --entitlements macosx/jre2.entitlements macosx/work/Arduino.app/Contents/PlugIns/jdk1.8.0_99.jdk
codesign -s "ARDUINO SA" -fv --keychain /Certs/XXX.keychain --options runtime --timestamp --entitlements macosx/jre2.entitlements macosx/work/Arduino.app
cd macosx/work/
zip -q -r ../arduino-1.8.11-macosx-signed.zip .
cd ..
xcrun altool --notarize-app --username user@email --password xxxx-xxxx-xxxx-xxxx --file arduino-1.8.11-macosx-signed.zip --primary-bundle-id "cc.arduino.Arduino"

To check for notarization status:

xcrun altool --notarization-info UUID --username user@email --password xxxx-xxxx-xxxx-xxxx

If everything is ok, the app can be stapled, and the final zip generated again:

xcrun stapler staple macosx/work/Arduino.app
cd macosx/work/
zip -q -r ../arduino-1.8.11-macosx-signed.zip .
cd ..

tlk reacted with hooray emoji
@arduino arduino deleted a comment from ArduinoBot Dec 18, 2019
@arduino arduino deleted a comment from ArduinoBot Dec 18, 2019
@cmaglie cmaglie added OS: OSX Specific to the Mac OS X (macOS) version of the Arduino IDE security Security fixes / bugs / improvements Type: Improvement This proposal is considered to be especially beneficial labels Dec 20, 2019
@cmaglie cmaglie self-assigned this Dec 20, 2019
@cmaglie cmaglie merged commit b029b2a into arduino:master Jan 8, 2020
@cmaglie cmaglie deleted the notarization branch January 8, 2020 10:41
@cmaglie cmaglie added this to the Release 1.8.11 milestone Jan 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Labels
OS: OSX Specific to the Mac OS X (macOS) version of the Arduino IDE security Security fixes / bugs / improvements Type: Improvement This proposal is considered to be especially beneficial
Projects
None yet
Development

Successfully merging this pull request may close these issues.
1 participant

AltStyle によって変換されたページ (->オリジナル) /