tools: use OSX Keychain profile to notarize the releases #50715

UlisesGascon · 2023-11-13T19:34:55Z

Main Changes

Use a OSX Keychain profile to retrieve the secrets in order to do the notarization with Notarytool

cc: @nodejs/build @nodejs/releasers

Context

Another PR related is docs: add manual step for OSX Keychain profile build#3569
Close Add --keychain-profile to notarytool build#3545

Notes

You can find more information in this amazing article https://tonygo.ghost.io/notarization-for-macos-app-with-notarytool/ by @tony-go and this comment: #48701 (comment)

Test

This was tested in iojs+release-ulises-experimental pipeline in jenkins ci release.

Full log available here

20:05:51 sh tools/osx-notarize.sh v22.0.0-test202311136410f3bf0d
20:05:51 Notarization process is done with Notarytool.
20:05:51 Submitting node-v22.0.0-test202311136410f3bf0d.pkg for notarization...
20:05:51 Conducting pre-submission checks for node-v22.0.0-test202311136410f3bf0d.pkg and initiating connection to the Apple notary service...
20:05:52 Submission ID received
20:05:52   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:06:08 Successfully uploaded file
20:06:08   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:06:08   path: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:06:08 Waiting for processing to complete.
20:06:14 
Current status: In Progress...
[...redacted...]
Current status: Accepted.............Processing complete
20:07:31   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:07:31   status: Accepted
20:07:31 
20:07:31 Notarization node-v22.0.0-test202311136410f3bf0d.pkg submitted successfully.
20:07:31 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:07:32 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:07:32 The staple and validate action worked!
20:07:32 Stapler was successful.
[...redacted...]
20:09:07 Finished: SUCCESS

nodejs-github-bot · 2023-11-13T19:40:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55624/

tools/osx-notarize.sh

nodejs-github-bot · 2023-11-19T19:49:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55768/

mhdawson

LGTM

nodejs-github-bot · 2023-11-20T19:27:31Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55796/

nodejs-github-bot · 2023-11-21T07:07:44Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55810/

nodejs-github-bot · 2023-11-21T07:37:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55811/

nodejs-github-bot · 2023-11-21T21:53:49Z

CI: https://ci.nodejs.org/job/node-test-pull-request/55833/

mhdawson · 2023-11-22T15:31:52Z

Looks the status update failed. The latest ci run shows as all blue - https://ci.nodejs.org/job/node-test-pull-request/55833/

Going to land

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

mhdawson · 2023-11-22T15:33:47Z

Landed in 5f973d1

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) #50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525 deps: * upgrade npm to 10.2.4 (npm team) #50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com//pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51614 http: * add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520 lib: * update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621 tools: * add macOS notarization verification step (Ulises Gascón) #50833 * use macOS keychain to notarize the releases (Ulises Gascón) #50715 * remove unused file (Ulises Gascon) #50622 * add macOS notarization stapler (Ulises Gascón) #50625 * improve macOS notarization process output readability (Ulises Gascón) #50389 * remove unused `version` function (Ulises Gascón) #50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) #50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542 PR-URL: nodejs-private/node-private#545

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525 deps: * upgrade npm to 10.2.4 (npm team) nodejs#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs#51614 http: * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520 lib: * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs#50715 * remove unused file (Ulises Gascon) nodejs#50622 * add macOS notarization stapler (Ulises Gascón) nodejs#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs#50389 * remove unused `version` function (Ulises Gascón) nodejs#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542 PR-URL: https://github.com/nodejs-private/node-private/pull/545

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525 deps: * upgrade npm to 10.2.4 (npm team) nodejs/node#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614 http: * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520 lib: * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715 * remove unused file (Ulises Gascon) nodejs/node#50622 * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389 * remove unused `version` function (Ulises Gascón) nodejs/node#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542 PR-URL: https://github.com/nodejs-private/node-private/pull/545

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525 deps: * upgrade npm to 10.2.4 (npm team) nodejs/node#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614 http: * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520 lib: * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715 * remove unused file (Ulises Gascon) nodejs/node#50622 * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389 * remove unused `version` function (Ulises Gascón) nodejs/node#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542 PR-URL: https://github.com/nodejs-private/node-private/pull/545

tools: use macOS keychain to notarize the releases

26c3f3c

nodejs-github-bot added macos Issues and PRs related to the macOS platform / OSX. tools Issues and PRs related to the tools directory. labels Nov 13, 2023

UlisesGascon marked this pull request as ready for review November 13, 2023 19:35

UlisesGascon added request-ci Add this label to start a Jenkins CI on a PR. lts-watch-v18.x PRs that may need to be released in v18.x. lts-watch-v20.x PRs that may need to be released in v20.x labels Nov 13, 2023

UlisesGascon mentioned this pull request Nov 13, 2023

docs: add manual step for OSX Keychain profile nodejs/build#3569

Merged

3 tasks

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Nov 13, 2023

tony-go reviewed Nov 14, 2023

View reviewed changes

tools/osx-notarize.sh Show resolved Hide resolved

tony-go approved these changes Nov 14, 2023

View reviewed changes

github-actions bot mentioned this pull request Nov 15, 2023

CI Reliability 2023-11-15 nodejs/reliability#718

Open

26 tasks

UlisesGascon mentioned this pull request Nov 19, 2023

Add --keychain-profile to notarytool nodejs/build#3545

Closed

5 tasks

mhdawson approved these changes Nov 20, 2023

View reviewed changes

mhdawson pushed a commit that referenced this pull request Nov 22, 2023

tools: use macOS keychain to notarize the releases

5f973d1

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

mhdawson closed this Nov 22, 2023

targos pushed a commit that referenced this pull request Nov 23, 2023

tools: use macOS keychain to notarize the releases

c90160f

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

martenrichter pushed a commit to martenrichter/node that referenced this pull request Nov 26, 2023

tools: use macOS keychain to notarize the releases

b443e4a

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

lucshi pushed a commit to lucshi/node that referenced this pull request Nov 27, 2023

tools: use macOS keychain to notarize the releases

73e71ed

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

RafaelGSS mentioned this pull request Nov 28, 2023

v21.3.0 proposal #50954

Merged

RafaelGSS pushed a commit that referenced this pull request Nov 29, 2023

tools: use macOS keychain to notarize the releases

a12d9e0

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

RafaelGSS pushed a commit that referenced this pull request Nov 30, 2023

tools: use macOS keychain to notarize the releases

3d3cd2a

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 11, 2023

tools: use macOS keychain to notarize the releases

341fcfd

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon mentioned this pull request Dec 12, 2023

v20.11.0 proposal #51124

Merged

UlisesGascon added a commit that referenced this pull request Dec 13, 2023

tools: use macOS keychain to notarize the releases

aa74680

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 15, 2023

tools: use macOS keychain to notarize the releases

eec1fd9

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 19, 2023

tools: use macOS keychain to notarize the releases

c9bd0b0

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

richardlau pushed a commit that referenced this pull request Jan 16, 2024

tools: use macOS keychain to notarize the releases

728c609

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

richardlau added backported-to-v18.x PRs backported to the v18.x-staging branch. backported-to-v20.x PRs backported to the v20.x-staging branch. and removed lts-watch-v18.x PRs that may need to be released in v18.x. lts-watch-v20.x PRs that may need to be released in v20.x labels Jan 16, 2024

UlisesGascon deleted the tools/osx-keychain-profile branch February 26, 2024 15:33

sercher added a commit to sercher/graaljs that referenced this pull request Apr 25, 2024

tools: use macOS keychain to notarize the releases

3e5ca79

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

sercher added a commit to sercher/graaljs that referenced this pull request Apr 25, 2024

tools: use macOS keychain to notarize the releases

2fac833

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tools: use OSX Keychain profile to notarize the releases #50715

tools: use OSX Keychain profile to notarize the releases #50715

UlisesGascon commented Nov 13, 2023

nodejs-github-bot commented Nov 13, 2023

nodejs-github-bot commented Nov 19, 2023

mhdawson left a comment

nodejs-github-bot commented Nov 20, 2023

nodejs-github-bot commented Nov 21, 2023

nodejs-github-bot commented Nov 21, 2023

nodejs-github-bot commented Nov 21, 2023

mhdawson commented Nov 22, 2023

mhdawson commented Nov 22, 2023

tools: use OSX Keychain profile to notarize the releases #50715

tools: use OSX Keychain profile to notarize the releases #50715

Conversation

UlisesGascon commented Nov 13, 2023

Main Changes

Context

Notes

Test

nodejs-github-bot commented Nov 13, 2023

nodejs-github-bot commented Nov 19, 2023

mhdawson left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Nov 20, 2023

nodejs-github-bot commented Nov 21, 2023

nodejs-github-bot commented Nov 21, 2023

nodejs-github-bot commented Nov 21, 2023

mhdawson commented Nov 22, 2023

mhdawson commented Nov 22, 2023