Fix Tart release code signing (#1284)

.ci/sign-release.sh

@@ -10,5 +10,15 @@ if [ "${TART_RELEASE_SNAPSHOT:-false}" = "true" ]; then
     --entitlements Resources/tart-dev.entitlements \
     dist/tart_darwin_all/tart.app
 else
-  gon gon.hcl
+  codesign \
+    --force \
+    --verbose \
+    --sign "Developer ID Application: Cirrus Labs, Inc. (9M2P8L4D89)" \
+    --timestamp \
+    --options runtime \
+    --keychain "$RUNNER_TEMP/build.keychain" \
+    --entitlements Resources/tart-prod.entitlements \
+    dist/tart_darwin_all/tart.app
+
+  codesign --verify --strict --verbose=2 dist/tart_darwin_all/tart.app
 fi

.github/workflows/release.yml

@@ -34,6 +34,7 @@ jobs:
         run: |
           echo "$MACOS_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
           security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
+          security set-keychain-settings -lut 21600 "$RUNNER_TEMP/build.keychain"
           security default-keychain -s "$RUNNER_TEMP/build.keychain"
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
           security import "$RUNNER_TEMP/certificate.p12" \
@@ -46,8 +47,7 @@ jobs:
             -s \
             -k "$KEYCHAIN_PASSWORD" \
             "$RUNNER_TEMP/build.keychain"
-      - name: Install gon
-        run: brew install mitchellh/gon/gon
+          security list-keychain -d user -s "$RUNNER_TEMP/build.keychain"
       - name: Create release app token for this repo
         id: app-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
@@ -72,7 +72,6 @@ jobs:
           version: "~> v2"
           args: release --clean
         env:
-          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}

.goreleaser.yml

@@ -30,7 +30,8 @@ universal_binaries:
         - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
         - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
         - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
-        - .ci/sign-release.sh
+        - cmd: .ci/sign-release.sh
+          output: true
 
 archives:
   - name_template: "{{ .ProjectName }}"

gon.hcl

@@ -1,12 +0,0 @@
-source = [ "dist/tart_darwin_all/tart.app" ]
-bundle_id = "com.github.cirruslabs.tart"
-
-apple_id {
-  username = "hello@cirruslabs.org"
-  password = "@env:AC_PASSWORD"
-}
-
-sign {
-  application_identity = "Developer ID Application: Cirrus Labs, Inc."
-  entitlements_file = "Resources/tart-prod.entitlements"
-}