Switch Apple Notarization from gon/altool to notarytool.
Closed this issue · 1 comments
We've been using gon since 2021. It was the best tool at the time used by other projects like Terraform (#273 (comment)), but it no longer gets any updates, and the project has been shut down by its maintainer: https://github.com/mitchellh/gon#readme
On top of that, the mechanism gon uses got deprecated by Apple, CI notarization produces deprecation warning:
{"@level":"info","@message":"notarization submission complete","@module":"notarize","@timestamp":"2024-01-30T22:14:25.909175Z","err":null,"output":"\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e\n\u003cplist version=\"1.0\"\u003e\n\u003cdict\u003e\n\t\u003ckey\u003enotarization-upload\u003c/key\u003e\n\t\u003cdict\u003e\n\t\t\u003ckey\u003eRequestUUID\u003c/key\u003e\n\t\t\u003cstring\u003e5346bf5b-0c9a-47af-8c0b-1866a0f8a9ea\u003c/string\u003e\n\t\u003c/dict\u003e\n\t\u003ckey\u003eos-version\u003c/key\u003e\n\t\u003cstring\u003e12.7.2\u003c/string\u003e\n\t\u003ckey\u003esuccess-message\u003c/key\u003e\n\t\u003cstring\u003eNo errors uploading 'tmp/ipfs-cluster-ctl_v1.0.8_amd64-signed.zip'.\u003c/string\u003e\n\t\u003ckey\u003etool-path\u003c/key\u003e\n\t\u003cstring\u003e/Applications/Xcode_14.2.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/Frameworks/AppStoreService.framework\u003c/string\u003e\n\t\u003ckey\u003etool-version\u003c/key\u003e\n\t\u003cstring\u003e6.043.14043\u003c/string\u003e\n\t\u003ckey\u003ewarnings\u003c/key\u003e\n\t\u003carray\u003e\n\t\t\u003cdict\u003e\n\t\t\t\u003ckey\u003ecode\u003c/key\u003e\n\t\t\t\u003cinteger\u003e-1030\u003c/integer\u003e\n\t\t\t\u003ckey\u003emessage\u003c/key\u003e\n\t\t\t\u003cstring\u003ealtool has been deprecated for notarization and starting in late 2023 will no longer be supported by the Apple notary service. You should start using notarytool to notarize your software.\u003c/string\u003e\n\t\t\t\u003ckey\u003euserInfo\u003c/key\u003e\n\t\t\t\u003cdict\u003e\n\t\t\t\t\u003ckey\u003eNSLocalizedDescription\u003c/key\u003e\n\t\t\t\t\u003cstring\u003ealtool has been deprecated for notarization and starting in late 2023 will no longer be supported by the Apple notary service. You should start using notarytool to notarize your software.\u003c/string\u003e\n\t\t\t\u003c/dict\u003e\n\t\t\u003c/dict\u003e\n\t\u003c/array\u003e\n\u003c/dict\u003e\n\u003c/plist\u003e\n\n"}
[...]altool has been deprecated for notarization and starting in late 2023 will no longer be supported by the Apple notary service. You should start using notarytool to notarize your software.
NodeJS switched from gon to notarytool, things to investigate:
- first version https://github.com/UlisesGascon/node/blob/076dbcb91647a51df3a8848ce031fbb4fde64f59/tools/osx-notarize.sh#L66-L75
- latets version https://github.com/nodejs/node/blob/main/tools/osx-notarize.sh#L39
Option B is to switch to "the most comprehensive implementation of Apple code signing outside the canonical Apple tools", a rust tool that does not require macOS runner.
- this one seems to be used by Mozilla and Tor Project, should be good enough for us:
I'll try the rust way first – if we can remove need for running this on macos worker, its only better.