native-packages 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +4 -2
- data/docs/apple-notarization.md +6 -2
- data/docs/native-recipes.md +1 -1
- data/docs/releasing.md +1 -1
- data/examples/native-packages-all-formats.yaml +1 -1
- data/examples/native-packages.yaml +1 -1
- data/lib/native_packages/macos_signing.rb +23 -2
- data/lib/native_packages/support.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: cfd604f6beae10d9254c34bb9f9f438532320bca67086e6847e2961c37f761ac
|
|
4
|
+
data.tar.gz: 31a755fe957f5d9005dfeecb6cb35178511e62475b344cda9b2bbf23b8189231
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 3806ff4be71bb784ffada047da5a082dafd401ab47bdb9e71b99f4deae6160969bd0bd67ce67d20dbfed67a95cd69df0f404e5600e8252bb6dfc937e71446a6d
|
|
7
|
+
data.tar.gz: '09ee792159279f6a10f1bfc3f0685bfb773e912e56ff59b6aa983bb283e4efa9fca14ce3f596f9243262c14a1a55e5a2a417f62b65f5aa939f1b6a79abbe0048'
|
data/README.md
CHANGED
|
@@ -107,7 +107,7 @@ packaging:
|
|
|
107
107
|
needs: release
|
|
108
108
|
permissions:
|
|
109
109
|
contents: write
|
|
110
|
-
uses: crmne/native-packages/.github/workflows/package.yml@v0.5.
|
|
110
|
+
uses: crmne/native-packages/.github/workflows/package.yml@v0.5.1
|
|
111
111
|
with:
|
|
112
112
|
version: ${{ github.ref_name }}
|
|
113
113
|
publish: true
|
|
@@ -116,6 +116,8 @@ packaging:
|
|
|
116
116
|
|
|
117
117
|
Pin the corresponding commit SHA for an immutable workflow reference. With no version, the workflow validates configuration only. With a version, it installs the configured gem and nFPM, builds packages and uploads an Actions artifact. `publish: true` attaches packages to the existing release.
|
|
118
118
|
|
|
119
|
+
Separate configurations have independent concurrency groups. A workflow can validate its stable, alpha and macOS configurations without one queued call cancelling another. The released `v0.5.0` workflow predates this fix; serialize multiple calls with `needs` when using that tag or its commit.
|
|
120
|
+
|
|
119
121
|
To consume an Actions artifact instead, set `source-artifact` and, if necessary, `source-directory` (default `dist`). Its files must match the local input paths in the configuration. This workflow packages on Linux, including MSIX creation from Windows binaries; native application builds and platform-specific signing jobs can use the CLI separately.
|
|
120
122
|
|
|
121
123
|
AUR publication additionally requires `PUBLISH_AUR=true`, `AUR_SSH_KEY` and `AUR_KNOWN_HOSTS`. Homebrew publication requires `PUBLISH_HOMEBREW=true` and `HOMEBREW_TAP_GITHUB_TOKEN`. Keep existing GoReleaser publishers for destinations they already own.
|
|
@@ -133,7 +135,7 @@ Migration combines `packaging/project.yml`, its nFPM definition and repository r
|
|
|
133
135
|
bundle install
|
|
134
136
|
bundle exec ruby -Ilib -e 'Dir["test/*_test.rb"].sort.each { |path| require_relative path }'
|
|
135
137
|
gem build native-packages.gemspec
|
|
136
|
-
ruby test/gem_install.rb native-packages-0.5.
|
|
138
|
+
ruby test/gem_install.rb native-packages-0.5.1.gem
|
|
137
139
|
```
|
|
138
140
|
|
|
139
141
|
Tests build real packages, inspect their payloads and exercise repository publication against local Git fixtures. CI additionally runs disposable Linux install/upgrade/remove checks, SRPM rebuilds and Windows MSIX acceptance. Runtime build manifests report installation as `not-tested`: CI fixture coverage is not a substitute for testing each application's packages.
|
data/docs/apple-notarization.md
CHANGED
|
@@ -31,8 +31,12 @@ native-packages --config native-packages.macos.yaml build \
|
|
|
31
31
|
```
|
|
32
32
|
|
|
33
33
|
The gem imports the certificate and notary credentials into a fresh, temporary
|
|
34
|
-
keychain.
|
|
35
|
-
|
|
34
|
+
keychain. Since 0.5.1, it adds that keychain to the user's search list when needed
|
|
35
|
+
on a clean runner, retaining existing entries and leaving the default keychain
|
|
36
|
+
unchanged. Signing calls under the same OS user share a lock, so parallel native
|
|
37
|
+
packaging hooks wait for the active signing call instead of racing search-list
|
|
38
|
+
updates. It deletes only its own keychain and search-list entry after success or
|
|
39
|
+
failure, preserving keychains added by other processes. Credential values are excluded from
|
|
36
40
|
manifests and redacted from tool errors.
|
|
37
41
|
|
|
38
42
|
The input is copied and checked before signing. All Mach-O code and nested
|
data/docs/native-recipes.md
CHANGED
data/docs/releasing.md
CHANGED
|
@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
|
|
|
23
23
|
Create a GitHub release for that commit:
|
|
24
24
|
|
|
25
25
|
```sh
|
|
26
|
-
gh release create v0.
|
|
26
|
+
gh release create v0.5.1 --target main --title 'native-packages 0.5.1' --notes-file release-notes.md
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.
|
|
@@ -41,6 +41,21 @@ module NativePackages
|
|
|
41
41
|
def with_identity
|
|
42
42
|
doctor
|
|
43
43
|
return yield(nil) unless enabled?
|
|
44
|
+
# The search list belongs to the OS user, not this project. Coordinate
|
|
45
|
+
# our signing calls across checkouts, including parallel packaging hooks.
|
|
46
|
+
lock_path = signing_lock_path
|
|
47
|
+
FileUtils.mkdir_p(lock_path.dirname, mode: 0o700)
|
|
48
|
+
File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
|
|
49
|
+
lock.flock(File::LOCK_EX)
|
|
50
|
+
with_temporary_identity { yield self }
|
|
51
|
+
end
|
|
52
|
+
end
|
|
53
|
+
|
|
54
|
+
private def signing_lock_path
|
|
55
|
+
Pathname.new(Dir.home) / "Library/Caches/native-packages/macos-signing.lock"
|
|
56
|
+
end
|
|
57
|
+
|
|
58
|
+
private def with_temporary_identity
|
|
44
59
|
Dir.mktmpdir("native-packages-signing-") do |directory|
|
|
45
60
|
@keychain = Pathname.new(directory) / "signing.keychain-db"
|
|
46
61
|
certificate = Pathname.new(directory) / "certificate.p12"
|
|
@@ -49,6 +64,12 @@ module NativePackages
|
|
|
49
64
|
@redactions << password
|
|
50
65
|
begin
|
|
51
66
|
execute "security", "create-keychain", "-p", password, @keychain
|
|
67
|
+
# Clean runners may not add new keychains to the user search list.
|
|
68
|
+
# codesign needs that entry even when given an explicit --keychain.
|
|
69
|
+
search_list = Shellwords.shellsplit(execute("security", "list-keychains", "-d", "user"))
|
|
70
|
+
unless search_list.any? { |path| File.identical?(path, @keychain) }
|
|
71
|
+
execute "security", "list-keychains", "-d", "user", "-s", *search_list, @keychain
|
|
72
|
+
end
|
|
52
73
|
execute "security", "set-keychain-settings", "-lut", "21600", @keychain
|
|
53
74
|
execute "security", "unlock-keychain", "-p", password, @keychain
|
|
54
75
|
execute "security", "import", certificate, "-k", @keychain,
|
|
@@ -63,8 +84,8 @@ module NativePackages
|
|
|
63
84
|
"--password", @credentials.fetch("APPLE_APP_PASSWORD")
|
|
64
85
|
yield self
|
|
65
86
|
ensure
|
|
66
|
-
#
|
|
67
|
-
#
|
|
87
|
+
# delete-keychain removes only this keychain and its search-list entry.
|
|
88
|
+
# Never restore an old list over keychains added by another process.
|
|
68
89
|
execute "security", "delete-keychain", @keychain if @keychain.exist?
|
|
69
90
|
@keychain = nil
|
|
70
91
|
end
|