macOS Codesigning

Signed-off-by: Raul Metsma <raul@metsma.ee>

Author: metsma

.github/add_signing_key.sh

@@ -21,13 +21,10 @@ curl -L https://developer.apple.com/certificationauthority/AppleWWDRCA.cer > App
 security import AppleWWDRCA.cer \
     -k ~/Library/Keychains/$KEY_CHAIN \
     -T /usr/bin/codesign -T /usr/bin/productsign
-security import DeveloperIDApplication.cer \
-    -k ~/Library/Keychains/$KEY_CHAIN \
-    -T /usr/bin/codesign -T /usr/bin/productsign
-security import DeveloperIDInstaller.cer \
-    -k ~/Library/Keychains/$KEY_CHAIN \
+security import DeveloperIDApplication.p12 \
+    -k ~/Library/Keychains/$KEY_CHAIN -P $KEY_PASSWORD \
     -T /usr/bin/codesign -T /usr/bin/productsign
-security import key.p12 \
+security import DeveloperIDInstaller.p12 \
     -k ~/Library/Keychains/$KEY_CHAIN -P $KEY_PASSWORD \
     -T /usr/bin/codesign -T /usr/bin/productsign
 security unlock-keychain -p travis $KEY_CHAIN

.github/cleanup-macos.sh

@@ -2,6 +2,6 @@
 
 set -ex -o xtrace
 
-if [ -n "$PASS_SECRETS_TAR_ENC" ]; then
+if [ -n "$KEY_PASSWORD" ]; then
     .github/remove_signing_key.sh
 fi

.github/secrets.tar.gpg

@@ -11,8 +11,9 @@ fi
 export PATH="/usr/local/opt/ccache/libexec:$PATH"
 git clone https://github.com/frankmorgner/OpenSCToken.git
 
-if [ -n "$PASS_SECRETS_TAR_ENC" ]; then
-    gpg --quiet --batch --yes --decrypt --passphrase="$PASS_SECRETS_TAR_ENC" --output .github/secrets.tar .github/secrets.tar.gpg
+if [ -n "$KEY_PASSWORD" ]; then
+    echo $DEV_ID_APPLICATION | base64 --decode > .github/DeveloperIDApplication.p12
+    echo $DEV_ID_INSTALLER | base64 --decode > .github/DeveloperIDInstaller.p12
     .github/add_signing_key.sh;
 else
     unset CODE_SIGN_IDENTITY INSTALLER_SIGN_IDENTITY;

.github/setup-macos.sh

@@ -26,8 +26,9 @@ jobs:
       - uses: actions/checkout@v5
       - run: .github/setup-macos.sh
         env:
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-          PASS_SECRETS_TAR_ENC: ${{ secrets.PASS_SECRETS_TAR_ENC }}
+          KEY_PASSWORD: ${{ secrets.DEV_ID_PASSWORD }}
+          DEV_ID_INSTALLER: ${{ secrets.DEV_ID_INSTALLER }}
+          DEV_ID_APPLICATION: ${{ secrets.DEV_ID_APPLICATION }}
       - name: Checkout OpenSSL sources
         uses: actions/checkout@v5
         with:
@@ -50,17 +51,16 @@ jobs:
           DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
           INSTALLER_SIGN_IDENTITY: ${{ secrets.INSTALLER_SIGN_IDENTITY }}
       - name: Cache build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: opensc-build-${{ matrix.os }}
           path:
             OpenSC*.dmg
       - run: .github/cleanup-macos.sh
         env:
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-          PASS_SECRETS_TAR_ENC: ${{ secrets.PASS_SECRETS_TAR_ENC }}
+          KEY_PASSWORD: ${{ secrets.DEV_ID_PASSWORD }}
       - name: Upload test logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: ${{ matrix.os }}-logs