Added codesign test

.github/workflows/test.yml

@@ -48,3 +48,5 @@ jobs:
         mix local.rebar --force
         mix deps.get
         mix desktop.create_keychain
+        export MACOS_KEYCHAIN=$HOME/Library/Keychains/macos-build.keychain
+        mix test test/codesign_test.exs

lib/mix/tasks/create_keychain.ex

@@ -19,22 +19,24 @@ defmodule Mix.Tasks.Desktop.CreateKeychain do
     security(["create-keychain", "-p", pass, name])
     System.put_env("MACOS_KEYCHAIN", full_path)
 
+    security(["list-keychains", "-s", name])
+    # security(["default-keychain", "-s", name])
+    security(["unlock-keychain", "-p", pass, name])
+    security(["set-keychain-settings", "-t", "3600", "-u", name])
+
     security([
       "import",
       "#{mac_tools}/Apple Worldwide Developer Relations Certification Authority.pem",
       "-k",
-      "macos-build.keychain"
+      "macos-build.keychain",
+      "-A"
     ])
 
     file = "tmp.pem"
     File.write!(file, pem)
     uids = locate_uid(file) || raise "Could not locate UID in PEM"
     maybe_import_pem(file, uids)
 
-    security(["list-keychains", "-s", name])
-    # security(["default-keychain", "-s", "macos-build.keychain"])
-    security(["unlock-keychain", "-p", pass, name])
-    security(["set-keychain-settings", "-t", "3600", "-u", name])
 
     # https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
     # https://github.com/lando/code-sign-action/blob/main/action.yml

lib/package/macos.ex

@@ -87,7 +87,7 @@ defmodule Desktop.Deployment.Package.MacOS do
     developer_id = Package.MacOS.find_developer_id()
 
     if developer_id != nil do
-      codesign(developer_id, root)
+      codesign(root)
     end
 
     dmg = make_dmg(pkg)
@@ -369,7 +369,7 @@ defmodule Desktop.Deployment.Package.MacOS do
 
   def maybe_import_pem(file, uids) do
     with nil <- do_find_developer_id(uids) do
-      cmd("security", ["import", file, "-k", keychain()])
+      cmd("security", ["import", file, "-k", keychain(), "-A"])
 
       with nil <- do_find_developer_id(uids) do
         raise "Failed to import PEM for uid #{inspect(uids)}"
@@ -484,7 +484,7 @@ defmodule Desktop.Deployment.Package.MacOS do
     |> Enum.uniq()
   end
 
-  def codesign(developer_id, root) do
+  def codesign(root) do
     # Codesign all executable code in the package with timestamp and
     # hardened runtime. This is a prerequisite for notarization.
     to_sign = find_binaries(root)
@@ -505,40 +505,38 @@ defmodule Desktop.Deployment.Package.MacOS do
     # Signing binaries in app directory
     Enum.chunk_every(to_sign, 10)
     |> Enum.each(fn chunk ->
-      IO.puts("Signing #{inspect(chunk)}")
-
-      cmd!(
-        "codesign",
-        [
-          "--keychain",
-          keychain(),
-          "-f",
-          "-s",
-          developer_id,
-          "--timestamp",
-          "--options=runtime",
-          "--entitlements",
-          entitlements | chunk
-        ]
-      )
+      codesign_executable(chunk, entitlements: entitlements)
     end)
 
     # Signing app directory itself
-    cmd!(
-      "codesign",
+    codesign_executable(root, entitlements: entitlements)
+  end
+
+  def codesign_executable(objects, opts \\ []) do
+    args =
       [
         "--keychain",
         keychain(),
         "-f",
         "-s",
-        developer_id,
+        find_developer_id(),
         "--timestamp",
-        "--options=runtime",
-        "--entitlements",
-        entitlements,
-        root
-      ]
-    )
+        "--options=runtime"
+      ] ++ add_codesign_args(opts) ++ List.wrap(objects)
+
+    cmd!("codesign", args)
+  end
+
+  defp add_codesign_args([{:entitlements, entitlements} | opts]) do
+    ["--entitlements", entitlements] ++ add_codesign_args(opts)
+  end
+
+  defp add_codesign_args([]) do
+    []
+  end
+
+  defp add_codesign_args(other) do
+    raise "Unknown codesign args #{inspect(other)}"
   end
 
   # openssl genrsa -out mock.key 2048

test/codesign_test.exs

@@ -0,0 +1,9 @@
+defmodule CodesignTest do
+  use ExUnit.Case
+
+  test "codesign a new binary" do
+    {_, 0} = System.cmd("gcc", ["test/priv/main.c", "-o", "unsigned_main"])
+    Desktop.Deployment.Package.MacOS.codesign_executable("unsigned_main")
+    File.rm("unsigned_main")
+  end
+end

test/priv/main.c

@@ -0,0 +1,4 @@
+
+int main() {
+    return 0;
+}

test/test_helper.exs

@@ -0,0 +1 @@
+ExUnit.start()