Add xcframework code signing #966
Conversation
jkmassel
force-pushed
the
add/xcframework-code-signing
branch
2 times, most recently
from
e70ef6e to
3a46021
Compare
jkmassel
force-pushed
the
add/xcframework-code-signing
branch
from
3a46021 to
2d78421
Compare
Otherwise, looking at the logs without expanding them would make you think the build is stuck on sync_code_signing. See https://buildkite.com/automattic/wordpress-rs/builds/4084/steps/canvas?sid=019a531b-f04b-4764-9cf7-673e189f3f26
|
Sorry, I meant to create a dedicated branch for the distribution certificate (tracked in https://linear.app/a8c/issue/AINFRA-1477/make-a-release-mode-code-signing-certificate) but I pushed without realizing I was on this branch... |
|
I know how to fix the build failures caused by the change in the artifact path... but my Docker is bricked and that is blocking my shell from entering into the this repo's folder -.-' |
| swift package compute-checksum libwordpressFFI.xcframework.zip | tee libwordpressFFI.xcframework.zip.checksum.txt | ||
|
|
||
| xcframework-sign: | ||
| codesign --timestamp -v --sign "${certificate_name_release}" target/libwordpressFFI.xcframework |
There was a problem hiding this comment.
| pushd target | ||
| buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework" | ||
| unzip libwordpressFFI.xcframework.zip -d . | ||
| rm libwordpressFFI.xcframework.zip |
There was a problem hiding this comment.
@jkmassel @crazytonyli This PR changed the ZIP destination from target/ to ./ in https://github.com/Automattic/wordpress-rs/pull/966/files#diff-a3991ebf1475eb82acab13946ffc1eca02b43917f6d5bec3898f45c8b0b9bd53L74
I thought it would be enough to update the download call at the start of the script (see above) but there evidently are other parts of the automation that expect the file to be in target/, because to make the build pass I had to add this additional ZIP expansion in the target/ folder.
I'm happy to help tidy this up. Alternatively, we could restore the ZIP-to-target-folder behavior and leave it at that. Up to you.
There was a problem hiding this comment.
Looks like make xcframework-package was introduced to replace the zip command. Maybe we can update xcframework-package to put the zip file at target/, and you don't need the new script here to unzip twice?
Adds code signing to the release and debug XCFrameworks. This allows consumer projects to ensure the binary dependency hasn't been tampered with.