Conversation
PlatCore
force-pushed
the
PlatCore/5161-add-signing-macos-binaries
branch
from
0f7d199 to
05fafb7
Compare
Add detached GPG signatures (.sig) to the macOS packaging pipeline, reusing the same key infrastructure as RPM and linux tarball signing. Extract inline zip/upload steps into build-zip-pkg.sh script.
PlatCore
force-pushed
the
PlatCore/5161-add-signing-macos-binaries
branch
from
05fafb7 to
a0f5e32
Compare
maru-ava
left a comment
maru-ava
left a comment
There was a problem hiding this comment.
I'm not sure I understand the motivation for this PR. Is there a requirement for gpg signing that I somehow missed? afaik we care about notarization for macos binaries which is something entirely different.
Currently, our GH release includes the following curl -s \
-H "Accept: application/vnd.github+json" \
https://api.github.com/repos/ava-labs/avalanchego/releases/tags/v1.14.2 \
| jq -r '.assets[] | .name' | grep macos
avalanchego-macos-v1.14.2.zip
avalanchego-macos-v1.14.2.zip.sig
subnet-evm-macos-v1.14.2.zip
subnet-evm-macos-v1.14.2.zip.sigI match this behavior (/ customers' expectation) in our CI. The notarization is out of scope of this PR and will be implemented separately. |
Fair point that there are separate trust domains involved - notarization for ensuring our binaries can run without jumping through hoops, gpg-signing for demonstrating the provenance of the zip file we distribute the binary in. However, I'm not sure I agree that notarization can be considered out-of-scope. The current manual release process is 'notarize -> zip -> GPG sign' because notarization modifies the binary and that has to happen before the zip is built and signed. What you're proposing is to sign a zip file containing an unnotarized binary. When are you planning to enable the notarization? |
2 participants
Why this should be merged
macOS binary zips are uploaded to S3 unsigned. This adds detached GPG signatures (
.zip.sig), matching the linux tarball and RPM signing pipelines.Closes #5161
Note: When
RPM_GPG_PRIVATE_KEYis unset or empty, unsigned zips are silently published to S3. This matches linux tarball behavior.How this works
build-zip-pkg.sh: GPG setup, zip creation, signing, S3 upload. No-op when no key is provided.build-macos-release.yml: GPG key import, script call,.sigin artifacts.How this was tested
.sigfiles produced,gpg --verifypassesNeed to be documented in RELEASES.md?
No