Skip to content

Commit db4eeae

Browse files
nicholasciolinicholascioli
committed
try sign
1 parent 15422c0 commit db4eeae

File tree

2 files changed

+180
-47
lines changed

2 files changed

+180
-47
lines changed

‎.github/workflows/release-bins.yml

+141-2
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,28 @@ jobs:
1313
# Linux compiles itself
1414
- os: ubuntu-24.04
1515
bundle: linux
16+
targets: |
17+
cross-aarch64-unknown-linux-gnu
18+
cross-aarch64-unknown-linux-musl
19+
cross-x86_64-unknown-linux-gnu
20+
cross-x86_64-unknown-linux-musl
1621
1722
# We can compile the windows target from linux
1823
- os: ubuntu-24.04
1924
bundle: windows
25+
targets: |
26+
cross-aarch64-pc-windows-gnullvm
27+
cross-x86_64-pc-windows-gnullvm
2028
2129
# Apple SDK does not allow us to cross compile from non-apple-branded
2230
# machines, so we run that bundle on a macOS runner
23-
- os: macos-latest
31+
# Note: We use macos-13 here since it is the latest version that runs
32+
# on an x86_64-apple-darwin machine
33+
- os: macos-13
2434
bundle: darwin
35+
targets: |
36+
cross-aarch64-apple-darwin
37+
default
2538
runs-on: ${{ matrix.os }}
2639
permissions:
2740
contents: write
@@ -47,7 +60,133 @@ jobs:
4760
gc-max-store-size: 5G
4861

4962
- name: Build binaries
50-
run: nix build .#${{ matrix.bundle }}-release-bundle
63+
run: |
64+
mkdir release
65+
for BUILD_TARGET in "${{ matrix.targets }}"; do
66+
# Hack for x86_64-apple-darwin since it doesn't yet work with cross compilation
67+
if [ "$BUILD_TARGET" == "default" ]; then
68+
TARGET="x86_64-apple-darwin"
69+
else
70+
TARGET=${BUILD_TARGET#"cross-"}
71+
fi
72+
73+
echo "Scaffolding release for $TARGET..."
74+
mkdir -p "release/$TARGET/dist"
75+
cp README.md LICENSE "release/$TARGET/dist"
76+
77+
echo "Building release for $TARGET..."
78+
nix build .#$TARGET
79+
cp result/bin/* "release/$TARGET/dist/"
80+
done
81+
82+
- name: Sign Apple Binary
83+
if: ${{ runner.os == 'macOS' }}
84+
env:
85+
MACOS_CERT_BUNDLE_PASSWORD: ${{ secrets.MACOS_CERT_BUNDLE_PASSWORD }}
86+
MACOS_CERT_BUNDLE_BASE64: ${{ secrets.MACOS_CERT_BUNDLE_BASE64 }}
87+
MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
88+
89+
APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
90+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
91+
APPLE_USERNAME: ${{ secrets.APPLE_USERNAME }}
92+
93+
KEYCHAIN_NAME: "apollo-mcp-server-keychain"
94+
ENTITLEMENTS_PATH: "macos-entitlements.plist"
95+
VERSION: ${{ github.ref }}
96+
run: |
97+
echo "Pre-check: Valid Codesigning Identify"
98+
security find-identity -v -p codesigning
99+
echo "Pre-check: Codesigning Identify"
100+
security find-identity -p codesigning
101+
echo "Pre-check: Any Identify"
102+
security find-identity
103+
104+
echo "|||||||||||||||||||||||||||||||||||||||||||||"
105+
106+
# Create a temporary keychain
107+
EPHEMERAL_KEYCHAIN=`mktemp`
108+
109+
echo "Creating keychain..."
110+
security create-keychain -p "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
111+
echo "Removing relock timeout on keychain..."
112+
security set-keychain-settings $KEYCHAIN_NAME
113+
114+
echo "Decoding certificate bundle..."
115+
echo "${MACOS_CERT_BUNDLE_BASE64}" | base64 --decode > $EPHEMERAL_KEYCHAIN/certificate.p12
116+
117+
echo "Importing codesigning certificate to build keychain..."
118+
security import $EPHEMERAL_KEYCHAIN/certificate.p12 -k $KEYCHAIN_NAME -P "${MACOS_CERT_BUNDLE_PASSWORD}" -T /usr/bin/codesign
119+
120+
echo "Adding the codesign tool to the security partition-list..."
121+
security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
122+
123+
echo "Setting default keychain..."
124+
security default-keychain -d user -s $KEYCHAIN_NAME
125+
126+
echo "Unlocking keychain..."
127+
security unlock-keychain -p "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
128+
129+
echo "Verifying keychain is set up correctly..."
130+
security find-identity -v -p codesigning
131+
132+
echo "|||||||||||||||||||||||||||||||||||||||||||||"
133+
134+
echo "Post-check: Valid Codesigning Identify"
135+
security find-identity -v -p codesigning
136+
echo "Post-check: Codesigning Identify"
137+
security find-identity -p codesigning
138+
echo "Post-check: Any Identify"
139+
security find-identity
140+
141+
echo "|||||||||||||||||||||||||||||||||||||||||||||"
142+
# Sign each binary
143+
for RELEASE in release/*/; do
144+
RELEASE=${RELEASE%/}
145+
RELEASE=${RELEASE#"release/"}
146+
147+
BINARY_PATH="release/$RELEASE/dist/apollo-mcp-server"
148+
echo "Starting code signing for $RELEASE..."
149+
150+
echo "> Signing code (step 1)..."
151+
codesign --sign "$APPLE_TEAM_ID" --options runtime --entitlements $ENTITLEMENTS_PATH --force --timestamp "$BINARY_PATH" -v
152+
153+
echo "> Signing code (step 2)..."
154+
codesign -vvv --deep --strict "$BINARY_PATH"
155+
156+
echo "> Zipping dist..."
157+
TMP_DIST=`mktemp`
158+
mkdir $TMP_DIST/dist
159+
cp "$BINARY_PATH" "$TMP_DIST/dist/"
160+
zip -r "$TMP_DIST/apollo-mcp-server-$VERSION.zip" "$TMP_DIST/dist"
161+
162+
echo "> Beginning notarization process (might take up to 20m)..."
163+
xcrun notarytool submit "$TMP_DIST/apollo-mcp-server-$VERSION.zip" \
164+
--apple-id "$APPLE_USERNAME" \
165+
--password "$APPLE_NOTARIZATION_PASSWORD" \
166+
--team-id "$APPLE_TEAM_ID" \
167+
--wait \
168+
--timeout 20m
169+
170+
echo "> Cleaning up release..."
171+
rm -rf $TMP_DIST
172+
done
173+
174+
echo "Cleaning up ephemeral keychain..."
175+
rm -rf $EPHEMERAL_KEYCHAIN/
176+
177+
- name: Create release bundles
178+
env:
179+
VERSION: ${{ github.ref }}
180+
run: |
181+
mkdir artifacts
182+
for RELEASE in release/*/; do
183+
# Remove trailing slash and leading parent
184+
RELEASE=${RELEASE%/}
185+
RELEASE=${RELEASE#"release/"}
186+
187+
echo "Creating an artifact for $RELEASE"
188+
tar -C release/$RELEASE -cf - dist/ | gzip -9 > artifacts/apollo-mcp-server-$VERSION-$RELEASE.tar.gz
189+
done
51190
52191
- name: Upload release artifacts
53192
uses: softprops/action-gh-release@v2

‎flake.nix

+39-45
Original file line numberDiff line numberDiff line change
@@ -46,28 +46,6 @@
4646
inherit crane;
4747
toolchain = nativeToolchain;
4848
};
49-
mkReleaseBundle = platform: targets: let
50-
bundleToolchain = p:
51-
p.rust-bin.stable.latest.minimal.override {
52-
inherit targets;
53-
};
54-
apollo-mcp-cross = unstable-pkgs.callPackage ./nix/apollo-mcp.nix {
55-
inherit crane;
56-
toolchain = bundleToolchain;
57-
};
58-
in
59-
unstable-pkgs.symlinkJoin {
60-
name = "${platform}-release-bundle";
61-
paths = builtins.map (target: let
62-
bins = apollo-mcp-cross.packages.builder target;
63-
in
64-
pkgs.runCommandLocal "${target}-bins" {} ''
65-
mkdir -p $out
66-
cd ${bins}/bin
67-
${pkgs.gnutar}/bin/tar -cf - ./* | ${pkgs.gzip}/bin/gzip -9 > $out/apollo-mcp-v${bins.version}-${target}.tar.gz
68-
'')
69-
targets;
70-
};
7149

7250
# Supporting tools
7351
mcphost = pkgs.callPackage ./nix/mcphost.nix {};
@@ -114,29 +92,45 @@
11492
}
11593
// apollo-mcp-builder.checks;
11694

117-
packages = rec {
118-
inherit (garbageCollector) saveFromGC;
119-
120-
default = apollo-mcp;
121-
apollo-mcp = apollo-mcp-builder.packages.apollo-mcp;
122-
123-
# Release bundles for each supported platform
124-
# TODO: x86_64-apple-darwin causes a zig issue and needs an upstream fix
125-
darwin-release-bundle = mkReleaseBundle "darwin" [
126-
"aarch64-apple-darwin"
127-
# "x86_64-apple-darwin"
128-
];
129-
linux-release-bundle = mkReleaseBundle "linux" [
130-
"aarch64-unknown-linux-gnu"
131-
"aarch64-unknown-linux-musl"
132-
"x86_64-unknown-linux-gnu"
133-
"x86_64-unknown-linux-musl"
134-
];
135-
windows-release-bundle = mkReleaseBundle "windows" [
136-
"aarch64-pc-windows-gnullvm"
137-
"x86_64-pc-windows-gnullvm"
138-
];
139-
};
95+
packages = let
96+
# Cross targets for supported architectures
97+
cross = let
98+
# Note: x86_64-apple-darwin doesn't yet work with zig due to an upstream bug
99+
supportedTargets = [
100+
"aarch64-apple-darwin"
101+
"aarch64-pc-windows-gnullvm"
102+
"aarch64-unknown-linux-gnu"
103+
"aarch64-unknown-linux-musl"
104+
"x86_64-pc-windows-gnullvm"
105+
"x86_64-unknown-linux-gnu"
106+
"x86_64-unknown-linux-musl"
107+
];
108+
109+
crossBuild = target: let
110+
crossToolchain = p:
111+
p.rust-bin.stable.latest.minimal.override {
112+
targets = [target];
113+
};
114+
apollo-mcp-cross = unstable-pkgs.callPackage ./nix/apollo-mcp.nix {
115+
inherit crane;
116+
toolchain = crossToolchain;
117+
};
118+
in
119+
apollo-mcp-cross.packages.builder target;
120+
in
121+
builtins.listToAttrs (builtins.map (target: {
122+
name = "cross-${target}";
123+
value = crossBuild target;
124+
})
125+
supportedTargets);
126+
in
127+
rec {
128+
inherit (garbageCollector) saveFromGC;
129+
130+
default = apollo-mcp;
131+
apollo-mcp = apollo-mcp-builder.packages.apollo-mcp;
132+
}
133+
// cross;
140134

141135
# TODO: This does not work on macOS without cross compiling, so maybe
142136
# we need to disable flake-utils and manually specify the supported

0 commit comments

Comments
 (0)