From 2cb47c981ec7ed7d62917fe754001ec66f40339c Mon Sep 17 00:00:00 2001 From: Guy J Grigsby Date: Wed, 23 Sep 2026 15:54:43 +0000 Subject: [PATCH] release: add release-mac target for signed macOS binaries The goreleaser workflow runs on ubuntu-latest, which cannot codesign, so tagged releases ship unsigned darwin binaries and the signing cert lives on a developer Mac. A local make target puts signing where the cert is instead of moving the cert to CI. Hardened runtime and a secure timestamp are on the signature so notarization can be layered on later without re-signing. --- Makefile | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 7525a73..338f781 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -.PHONY: build test lint check clean install +.PHONY: build test lint check clean install release-mac BUILD_DATE := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ") GIT_HEIGHT := $(shell git rev-list --count HEAD 2>/dev/null || echo 0) @@ -35,3 +35,16 @@ install: clean: rm -rf .build/ + +# First Developer ID Application identity in the keychain; override when there +# is more than one: make release-mac SIGN_IDENTITY="Developer ID Application: Name (TEAMID)" +SIGN_IDENTITY ?= $(shell security find-identity -v -p codesigning 2>/dev/null | sed -n 's/.*"\(Developer ID Application[^"]*\)".*/\1/p' | head -1) + +# Signed macOS release binaries in .build/release/. Runs on the Mac that holds +# the cert; codesign and the identity do not exist elsewhere. +release-mac: + @if [ -z "$(SIGN_IDENTITY)" ]; then echo "no Developer ID Application identity in the keychain"; exit 1; fi + GOOS=darwin GOARCH=arm64 go build -ldflags "-s -w $(LDFLAGS)" -o .build/release/aperture_darwin_arm64 ./cmd/aperture + GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w $(LDFLAGS)" -o .build/release/aperture_darwin_amd64 ./cmd/aperture + codesign --options runtime --timestamp --sign "$(SIGN_IDENTITY)" .build/release/aperture_darwin_arm64 .build/release/aperture_darwin_amd64 + codesign --verify --verbose=2 .build/release/aperture_darwin_arm64 .build/release/aperture_darwin_amd64