Skip to content

Commit 686fa79

Browse files
laanwjlaanwj
committed
Merge pull request #5363
7a9cf80 docs: add/update docs for osx dmg signing (Cory Fields) 914868a build: add a deterministic dmg signer (Cory Fields) d69ed2b build: Clean up the dmg layout (Cory Fields) 2f327a3 build: add the deploydir target for gitian (Cory Fields)
2 parents ce7204b + 7a9cf80 commit 686fa79

File tree

8 files changed

+218
-16
lines changed

8 files changed

+218
-16
lines changed

‎Makefile.am‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,9 @@ WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \
2626

2727
OSX_PACKAGING = $(OSX_DEPLOY_SCRIPT) $(OSX_FANCY_PLIST) $(OSX_INSTALLER_ICONS) \
2828
$(top_srcdir)/contrib/macdeploy/background.png \
29-
$(top_srcdir)/contrib/macdeploy/DS_Store
29+
$(top_srcdir)/contrib/macdeploy/DS_Store \
30+
$(top_srcdir)/contrib/macdeploy/detached-sig-apply.sh \
31+
$(top_srcdir)/contrib/macdeploy/detached-sig-create.sh
3032

3133
COVERAGE_INFO = baseline_filtered_combined.info baseline.info block_test.info \
3234
leveldb_baseline.info test_bitcoin_filtered.info total_coverage.info \
@@ -85,14 +87,30 @@ if BUILD_DARWIN
8587
$(OSX_DMG): $(OSX_APP_BUILT) $(OSX_PACKAGING)
8688
$(OSX_DEPLOY_SCRIPT) $(OSX_APP) -add-qt-tr $(OSX_QT_TRANSLATIONS) -translations-dir=$(QT_TRANSLATION_DIR) -dmg -fancy $(OSX_FANCY_PLIST) -verbose 2
8789

90+
deploydir: $(OSX_DMG)
8891
else
89-
$(OSX_DMG): $(OSX_APP_BUILT) $(OSX_PACKAGING)
90-
INSTALLNAMETOOL=$(INSTALLNAMETOOL) OTOOL=$(OTOOL) STRIP=$(STRIP) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) -add-qt-tr $(OSX_QT_TRANSLATIONS) -translations-dir=$(QT_TRANSLATION_DIR) -verbose 2
91-
$(MKDIR_P) dist/.background
92-
$(INSTALL) contrib/macdeploy/background.png dist/.background
93-
$(INSTALL) contrib/macdeploy/DS_Store dist/.DS_Store
94-
cd dist; $(LN_S) /Applications Applications
95-
$(GENISOIMAGE) -no-cache-inodes -l -probe -V "Bitcoin-Qt" -no-pad -r -apple -o $@ dist
92+
APP_DIST_DIR=$(top_builddir)/dist
93+
APP_DIST_EXTRAS=$(APP_DIST_DIR)/.background/background.png $(APP_DIST_DIR)/.DS_Store $(APP_DIST_DIR)/Applications
94+
95+
$(APP_DIST_DIR)/Applications:
96+
@rm -f $@
97+
@cd $(@D); $(LN_S) /Applications $(@F)
98+
99+
$(APP_DIST_EXTRAS): $(APP_DIST_DIR)/$(OSX_APP)/Contents/MacOS/Bitcoin-Qt
100+
101+
$(OSX_DMG): $(APP_DIST_EXTRAS)
102+
$(GENISOIMAGE) -no-cache-inodes -D -l -probe -V "Bitcoin-Qt" -no-pad -r -apple -o $@ dist
103+
104+
$(APP_DIST_DIR)/.background/background.png:
105+
$(MKDIR_P) $(@D)
106+
$(INSTALL) $(top_srcdir)/contrib/macdeploy/background.png $@
107+
$(APP_DIST_DIR)/.DS_Store:
108+
$(INSTALL) $(top_srcdir)/contrib/macdeploy/DS_Store $@
109+
110+
$(APP_DIST_DIR)/$(OSX_APP)/Contents/MacOS/Bitcoin-Qt: $(OSX_APP_BUILT) $(OSX_PACKAGING)
111+
INSTALLNAMETOOL=$(INSTALLNAMETOOL) OTOOL=$(OTOOL) STRIP=$(STRIP) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) -translations-dir=$(QT_TRANSLATION_DIR) -add-qt-tr $(OSX_QT_TRANSLATIONS) -verbose 2
112+
113+
deploydir: $(APP_DIST_EXTRAS)
96114
endif
97115

98116
if TARGET_DARWIN

‎contrib/gitian-descriptors/gitian-osx-signer.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
name: "bitcoin-dmg-signer"
3+
suites:
4+
- "precise"
5+
architectures:
6+
- "amd64"
7+
packages:
8+
- "libc6:i386"
9+
- "faketime"
10+
reference_datetime: "2013-06-01 00:00:00"
11+
remotes: []
12+
files:
13+
- "bitcoin-0.9.99-osx-unsigned.tar.gz"
14+
- "signature.tar.gz"
15+
script: |
16+
WRAP_DIR=$HOME/wrapped
17+
mkdir -p ${WRAP_DIR}
18+
export PATH=`pwd`:$PATH
19+
FAKETIME_PROGS="dmg genisoimage"
20+
21+
# Create global faketime wrappers
22+
for prog in ${FAKETIME_PROGS}; do
23+
echo '#!/bin/bash' > ${WRAP_DIR}/${prog}
24+
echo "REAL=\`which -a ${prog} | grep -v ${WRAP_DIR}/${prog} | head -1\`" >> ${WRAP_DIR}/${prog}
25+
echo 'export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1' >> ${WRAP_DIR}/${prog}
26+
echo "export FAKETIME=\"${REFERENCE_DATETIME}\"" >> ${WRAP_DIR}/${prog}
27+
echo "\$REAL \$@" >> $WRAP_DIR/${prog}
28+
chmod +x ${WRAP_DIR}/${prog}
29+
done
30+
31+
UNSIGNED=`echo bitcoin-*.tar.gz`
32+
SIGNED=`echo ${UNSIGNED} | sed 's/.tar.*//' | sed 's/-unsigned//'`.dmg
33+
34+
tar -xf ${UNSIGNED}
35+
./detached-sig-apply.sh ${UNSIGNED} signature.tar.gz
36+
${WRAP_DIR}/genisoimage -no-cache-inodes -D -l -probe -V "Bitcoin-Qt" -no-pad -r -apple -o uncompressed.dmg signed-app
37+
${WRAP_DIR}/dmg dmg uncompressed.dmg ${OUTDIR}/${SIGNED}

‎contrib/gitian-descriptors/gitian-osx.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,21 @@ script: |
106106
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
107107
make ${MAKEOPTS}
108108
make install-strip
109+
110+
make deploydir
111+
mkdir -p unsigned-app-${i}
112+
cp contrib/macdeploy/detached-sig-apply.sh unsigned-app-${i}
113+
cp contrib/macdeploy/detached-sig-create.sh unsigned-app-${i}
114+
cp ${BASEPREFIX}/${i}/native/bin/dmg ${BASEPREFIX}/${i}/native/bin/genisoimage unsigned-app-${i}
115+
cp ${BASEPREFIX}/${i}/native/bin/${i}-codesign_allocate unsigned-app-${i}/codesign_allocate
116+
cp ${BASEPREFIX}/${i}/native/bin/${i}-pagestuff unsigned-app-${i}/pagestuff
117+
mv dist unsigned-app-${i}
118+
pushd unsigned-app-${i}
119+
find . | sort | tar --no-recursion -czf ${OUTDIR}/${DISTNAME}-osx-unsigned.tar.gz -T -
120+
popd
121+
109122
make deploy
110-
${WRAP_DIR}/dmg dmg Bitcoin-Qt.dmg ${OUTDIR}/${DISTNAME}-osx.dmg
123+
${WRAP_DIR}/dmg dmg Bitcoin-Qt.dmg ${OUTDIR}/${DISTNAME}-osx-unsigned.dmg
111124
112125
cd installed
113126
find . -name "lib*.la" -delete

‎contrib/macdeploy/DS_Store‎

0 Bytes
Binary file not shown.

‎contrib/macdeploy/detached-sig-apply.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/sh
2+
set -e
3+
4+
UNSIGNED=$1
5+
SIGNATURE=$2
6+
ARCH=x86_64
7+
ROOTDIR=dist
8+
BUNDLE=${ROOTDIR}/Bitcoin-Qt.app
9+
TEMPDIR=signed.temp
10+
OUTDIR=signed-app
11+
12+
if [ -z "$UNSIGNED" ]; then
13+
echo "usage: $0 <unsigned app> <signature>"
14+
exit 1
15+
fi
16+
17+
if [ -z "$SIGNATURE" ]; then
18+
echo "usage: $0 <unsigned app> <signature>"
19+
exit 1
20+
fi
21+
22+
rm -rf ${TEMPDIR} && mkdir -p ${TEMPDIR}
23+
tar -C ${TEMPDIR} -xf ${UNSIGNED}
24+
tar -C ${TEMPDIR} -xf ${SIGNATURE}
25+
26+
if [ -z "${PAGESTUFF}" ]; then
27+
PAGESTUFF=${TEMPDIR}/pagestuff
28+
fi
29+
30+
if [ -z "${CODESIGN_ALLOCATE}" ]; then
31+
CODESIGN_ALLOCATE=${TEMPDIR}/codesign_allocate
32+
fi
33+
34+
for i in `find ${TEMPDIR} -name "*.sign"`; do
35+
SIZE=`stat -c %s ${i}`
36+
TARGET_FILE=`echo ${i} | sed 's/\.sign$//'`
37+
38+
echo "Allocating space for the signature of size ${SIZE} in ${TARGET_FILE}"
39+
${CODESIGN_ALLOCATE} -i ${TARGET_FILE} -a ${ARCH} ${SIZE} -o ${i}.tmp
40+
41+
OFFSET=`${PAGESTUFF} ${i}.tmp -p | tail -2 | grep offset | sed 's/[^0-9]*//g'`
42+
if [ -z ${QUIET} ]; then
43+
echo "Attaching signature at offset ${OFFSET}"
44+
fi
45+
46+
dd if=$i of=${i}.tmp bs=1 seek=${OFFSET} count=${SIZE} 2>/dev/null
47+
mv ${i}.tmp ${TARGET_FILE}
48+
rm ${i}
49+
echo "Success."
50+
done
51+
mv ${TEMPDIR}/${ROOTDIR} ${OUTDIR}
52+
rm -rf ${TEMPDIR}
53+
echo "Signed: ${OUTDIR}"

‎contrib/macdeploy/detached-sig-create.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/sh
2+
set -e
3+
4+
ROOTDIR=dist
5+
BUNDLE=${ROOTDIR}/Bitcoin-Qt.app
6+
CODESIGN=codesign
7+
TEMPDIR=sign.temp
8+
TEMPLIST=${TEMPDIR}/signatures.txt
9+
OUT=signature.tar.gz
10+
11+
if [ ! -n "$1" ]; then
12+
echo "usage: $0 <codesign args>"
13+
echo "example: $0 -s MyIdentity"
14+
exit 1
15+
fi
16+
17+
rm -rf ${TEMPDIR} ${TEMPLIST}
18+
mkdir -p ${TEMPDIR}
19+
20+
${CODESIGN} -f --file-list ${TEMPLIST} "$@" "${BUNDLE}"
21+
22+
for i in `grep -v CodeResources ${TEMPLIST}`; do
23+
TARGETFILE="${BUNDLE}/`echo ${i} | sed "s|.*${BUNDLE}/||"`"
24+
SIZE=`pagestuff $i -p | tail -2 | grep size | sed 's/[^0-9]*//g'`
25+
OFFSET=`pagestuff $i -p | tail -2 | grep offset | sed 's/[^0-9]*//g'`
26+
SIGNFILE="${TEMPDIR}/${TARGETFILE}.sign"
27+
DIRNAME="`dirname ${SIGNFILE}`"
28+
mkdir -p "${DIRNAME}"
29+
echo "Adding detached signature for: ${TARGETFILE}. Size: ${SIZE}. Offset: ${OFFSET}"
30+
dd if=$i of=${SIGNFILE} bs=1 skip=${OFFSET} count=${SIZE} 2>/dev/null
31+
done
32+
33+
for i in `grep CodeResources ${TEMPLIST}`; do
34+
TARGETFILE="${BUNDLE}/`echo ${i} | sed "s|.*${BUNDLE}/||"`"
35+
RESOURCE="${TEMPDIR}/${TARGETFILE}"
36+
DIRNAME="`dirname "${RESOURCE}"`"
37+
mkdir -p "${DIRNAME}"
38+
echo "Adding resource for: "${TARGETFILE}""
39+
cp "${i}" "${RESOURCE}"
40+
done
41+
42+
rm ${TEMPLIST}
43+
44+
tar -C ${TEMPDIR} -czf ${OUT} .
45+
rm -rf ${TEMPDIR}
46+
echo "Created ${OUT}"

‎doc/README_osx.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,18 @@ Background images and other features can be added to DMG files by inserting a
6565
.DS_Store before creation. The easiest way to create this file is to build a
6666
DMG without one, move it to a device running OSX, customize the layout, then
6767
grab the .DS_Store file for later use. That is the approach taken here.
68+
69+
As of OSX Mavericks (10.9), using an Apple-blessed key to sign binaries is a
70+
requirement in order to satisfy the new Gatekeeper requirements. Because this
71+
private key cannot be shared, we'll have to be a bit creative in order for the
72+
build process to remain somewhat deterministic. Here's how it works:
73+
74+
- Builders use gitian to create an unsigned release. This outputs an unsigned
75+
dmg which users may choose to bless and run. It also outputs an unsigned app
76+
structure in the form of a tarball, which also contains all of the tools
77+
that have been previously (deterministically) built in order to create a
78+
final dmg.
79+
- The Apple keyholder uses this unsigned app to create a detached signature,
80+
using the script that is also included there.
81+
- Builders feed the unsigned app + detached signature back into gitian. It
82+
uses the pre-built tools to recombine the pieces into a deterministic dmg.

‎doc/release-process.md‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,17 +59,18 @@ Release Process
5959
./bin/gsign --signer $SIGNER --release ${VERSION}-win --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-win.yml
6060
mv build/out/bitcoin-*.zip build/out/bitcoin-*.exe ../
6161
./bin/gbuild --commit bitcoin=v${VERSION} ../bitcoin/contrib/gitian-descriptors/gitian-osx.yml
62-
./bin/gsign --signer $SIGNER --release ${VERSION}-osx --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-osx.yml
62+
./bin/gsign --signer $SIGNER --release ${VERSION}-osx-unsigned --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-osx.yml
63+
mv build/out/bitcoin-*-unsigned.tar.gz inputs
6364
mv build/out/bitcoin-*.tar.gz build/out/bitcoin-*.dmg ../
6465
popd
65-
66+
bitcoin-0.9.99-osx-unsigned.tar.gz
6667
Build output expected:
6768

6869
1. source tarball (bitcoin-${VERSION}.tar.gz)
6970
2. linux 32-bit and 64-bit binaries dist tarballs (bitcoin-${VERSION}-linux[32|64].tar.gz)
7071
3. windows 32-bit and 64-bit installers and dist zips (bitcoin-${VERSION}-win[32|64]-setup.exe, bitcoin-${VERSION}-win[32|64].zip)
71-
4. OSX installer (bitcoin-${VERSION}-osx.dmg)
72-
5. Gitian signatures (in gitian.sigs/${VERSION}-<linux|win|osx>/(your gitian key)/
72+
4. OSX unsigned installer (bitcoin-${VERSION}-osx-unsigned.dmg)
73+
5. Gitian signatures (in gitian.sigs/${VERSION}-<linux|win|osx-unsigned>/(your gitian key)/
7374

7475
###Next steps:
7576

@@ -78,7 +79,28 @@ Commit your signature to gitian.sigs:
7879
pushd gitian.sigs
7980
git add ${VERSION}-linux/${SIGNER}
8081
git add ${VERSION}-win/${SIGNER}
81-
git add ${VERSION}-osx/${SIGNER}
82+
git add ${VERSION}-osx-unsigned/${SIGNER}
83+
git commit -a
84+
git push # Assuming you can push to the gitian.sigs tree
85+
popd
86+
87+
Wait for OSX detached signature:
88+
Once the OSX build has 3 matching signatures, Gavin will sign it with the apple App-Store key.
89+
He will then upload a detached signature to be combined with the unsigned app to create a signed binary.
90+
91+
Create the signed OSX binary:
92+
pushd ./gitian-builder
93+
# Fetch the signature as instructed by Gavin
94+
cp signature.tar.gz inputs/
95+
./bin/gbuild -i ../bitcoin/contrib/gitian-descriptors/gitian-osx-signer.yml
96+
./bin/gsign --signer $SIGNER --release ${VERSION}-osx-signed --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-osx-signer.yml
97+
mv build/out/bitcoin-${VERSION}-osx.dmg ../
98+
popd
99+
100+
Commit your signature for the signed OSX binary:
101+
102+
pushd gitian.sigs
103+
git add ${VERSION}-osx-signed/${SIGNER}
82104
git commit -a
83105
git push # Assuming you can push to the gitian.sigs tree
84106
popd
@@ -91,8 +113,6 @@ Commit your signature to gitian.sigs:
91113

92114
- Code-sign Windows -setup.exe (in a Windows virtual machine using signtool)
93115

94-
- Code-sign MacOSX .dmg
95-
96116
Note: only Gavin has the code-signing keys currently.
97117

98118
- Create `SHA256SUMS.asc` for the builds, and GPG-sign it:

0 commit comments

Comments
 (0)