Code sign macOS build on buildbot #66998

New Issue

Brecht Van Lommel · 2019-07-15T17:06:31+02:00

Brecht Van Lommel commented

2019-07-15 17:06:31 +02:00

We want to sign builds on the buildbot so users can easily run them, and to catch potential bugs in bundling and code signing earlier.

Figure out: do issues in the daily builds risk affecting the release build? Do we use a separate certificate?
Configure buildbot virtual machine to have certificate, and check security implications of that.
Update buildbot scripts to include bundling step and to support .dmg files.
Customize daily build bundle to indicate it's not a release build. Custom background image?
Notarization can take up to 30-60min, not much we can do about this most likely.

We want to sign builds on the buildbot so users can easily run them, and to catch potential bugs in bundling and code signing earlier. * Figure out: do issues in the daily builds risk affecting the release build? Do we use a separate certificate? * Configure buildbot virtual machine to have certificate, and check security implications of that. * Update buildbot scripts to include bundling step and to support .dmg files. * Customize daily build bundle to indicate it's not a release build. Custom background image? * Notarization can take up to 30-60min, not much we can do about this most likely.

Brecht Van Lommel commented

2019-07-15 17:06:31 +02:00

Added subscriber: @brecht

Arto Kitula commented

2019-07-29 19:10:03 +02:00

Added subscriber: @ArtoKitula

Arto Kitula commented

2019-07-29 19:30:00 +02:00

Figure out: do issues in the daily builds risk affecting the release build? Do we use a separate certificate?

This is just political thing usually.

Configure buildbot virtual machine to have certificate, and check security implications of that.

There shouldn't be any security issues when using macOS keychain as stated on bundling docs. Stapling returns JSON, so that might be good to suppress from logs that buildbot returns to web.

Customize daily build bundle to indicate it's not a release build. Custom background image?

This would be the best thing. If user downloads file that is blender-(ver)-(hash)-macOS.dmg and background image states it being daily build before copying .app, it should be enough.

>Figure out: do issues in the daily builds risk affecting the release build? Do we use a separate certificate? This is just political thing usually. >Configure buildbot virtual machine to have certificate, and check security implications of that. There shouldn't be any security issues when using macOS keychain as stated on bundling docs. Stapling returns JSON, so that might be good to suppress from logs that buildbot returns to web. >Customize daily build bundle to indicate it's not a release build. Custom background image? This would be the best thing. If user downloads file that is blender-(ver)-(hash)-macOS.dmg and background image states it being daily build before copying .app, it should be enough.

Andrew Pouliot commented

2019-07-29 20:45:38 +02:00

Added subscriber: @darknoon