tools: use OSX Keychain profile to notarize the releases by UlisesGascon · Pull Request #50715 · nodejs/node · GitHub

Main Changes

Use a OSX Keychain profile to retrieve the secrets in order to do the notarization with Notarytool

cc: @nodejs/build @nodejs/releasers

Context

Another PR related is docs: add manual step for OSX Keychain profile build#3569
Close Add --keychain-profile to notarytool build#3545

Notes

You can find more information in this amazing article https://tonygo.ghost.io/notarization-for-macos-app-with-notarytool/ by @tony-go and this comment: #48701 (comment)

Test

This was tested in iojs+release-ulises-experimental pipeline in jenkins ci release.

Full log available here

20:05:51 sh tools/osx-notarize.sh v22.0.0-test202311136410f3bf0d
20:05:51 Notarization process is done with Notarytool.
20:05:51 Submitting node-v22.0.0-test202311136410f3bf0d.pkg for notarization...
20:05:51 Conducting pre-submission checks for node-v22.0.0-test202311136410f3bf0d.pkg and initiating connection to the Apple notary service...
20:05:52 Submission ID received
20:05:52   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:06:08 Successfully uploaded file
20:06:08   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:06:08   path: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:06:08 Waiting for processing to complete.
20:06:14 
Current status: In Progress...
[...redacted...]
Current status: Accepted.............Processing complete
20:07:31   id: cb5ac9d6-9646-4226-bfa8-23b9c3e0995d
20:07:31   status: Accepted
20:07:31 
20:07:31 Notarization node-v22.0.0-test202311136410f3bf0d.pkg submitted successfully.
20:07:31 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:07:32 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311136410f3bf0d.pkg
20:07:32 The staple and validate action worked!
20:07:32 Stapler was successful.
[...redacted...]
20:09:07 Finished: SUCCESS

CI: https://ci.nodejs.org/job/node-test-pull-request/55624/

CI: https://ci.nodejs.org/job/node-test-pull-request/55768/

LGTM

CI: https://ci.nodejs.org/job/node-test-pull-request/55796/

CI: https://ci.nodejs.org/job/node-test-pull-request/55810/

CI: https://ci.nodejs.org/job/node-test-pull-request/55811/

CI: https://ci.nodejs.org/job/node-test-pull-request/55833/

Looks the status update failed. The latest ci run shows as all blue - https://ci.nodejs.org/job/node-test-pull-request/55833/

Going to land

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

Landed in 5f973d1

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) #50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525 deps: * upgrade npm to 10.2.4 (npm team) #50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com//pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51614 http: * add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520 lib: * update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621 tools: * add macOS notarization verification step (Ulises Gascón) #50833 * use macOS keychain to notarize the releases (Ulises Gascón) #50715 * remove unused file (Ulises Gascon) #50622 * add macOS notarization stapler (Ulises Gascón) #50625 * improve macOS notarization process output readability (Ulises Gascón) #50389 * remove unused `version` function (Ulises Gascón) #50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) #50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542 PR-URL: nodejs-private/node-private#545

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525 deps: * upgrade npm to 10.2.4 (npm team) nodejs/node#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614 http: * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520 lib: * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715 * remove unused file (Ulises Gascon) nodejs/node#50622 * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389 * remove unused `version` function (Ulises Gascón) nodejs/node#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542 PR-URL: https://github.com/nodejs-private/node-private/pull/545

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525 deps: * upgrade npm to 10.2.4 (npm team) nodejs/node#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614 http: * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520 lib: * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715 * remove unused file (Ulises Gascon) nodejs/node#50622 * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389 * remove unused `version` function (Ulises Gascón) nodejs/node#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542 PR-URL: https://github.com/nodejs-private/node-private/pull/545

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

This is a security release. Notable changes: crypto: * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs#50805 * disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525 deps: * upgrade npm to 10.2.4 (npm team) nodejs#50751 * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs#51614 * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/pull/51614 * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs#51614 http: * add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520 lib: * update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536 src: * fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505 test: * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs#49621 tools: * add macOS notarization verification step (Ulises Gascón) nodejs#50833 * use macOS keychain to notarize the releases (Ulises Gascón) nodejs#50715 * remove unused file (Ulises Gascon) nodejs#50622 * add macOS notarization stapler (Ulises Gascón) nodejs#50625 * improve macOS notarization process output readability (Ulises Gascón) nodejs#50389 * remove unused `version` function (Ulises Gascón) nodejs#50390 win,tools: * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs#50956 zlib: * pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542 PR-URL: nodejs-private/node-private#545

tools: use macOS keychain to notarize the releases

26c3f3c

nodejs-github-bot added macos Issues and PRs related to the macOS platform / OSX. tools Issues and PRs related to the tools directory. labels Nov 13, 2023

UlisesGascon marked this pull request as ready for review November 13, 2023 19:35

UlisesGascon added request-ci Add this label to start a Jenkins CI on a PR. lts-watch-v18.x labels Nov 13, 2023

UlisesGascon mentioned this pull request Nov 13, 2023

docs: add manual step for OSX Keychain profile nodejs/build#3569

Merged

3 tasks

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Nov 13, 2023

tony-go reviewed Nov 14, 2023

View reviewed changes

Comment thread tools/osx-notarize.sh

tony-go approved these changes Nov 14, 2023

View reviewed changes

github-actions Bot mentioned this pull request Nov 15, 2023

CI Reliability 2023-11-15 nodejs/reliability#718

Open

26 tasks

UlisesGascon mentioned this pull request Nov 19, 2023

Add --keychain-profile to notarytool nodejs/build#3545

Closed

5 tasks

mhdawson approved these changes Nov 20, 2023

View reviewed changes

mhdawson pushed a commit that referenced this pull request Nov 22, 2023

tools: use macOS keychain to notarize the releases

5f973d1

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

mhdawson closed this Nov 22, 2023

targos pushed a commit that referenced this pull request Nov 23, 2023

tools: use macOS keychain to notarize the releases

c90160f

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

lucshi pushed a commit to lucshi/node that referenced this pull request Nov 27, 2023

tools: use macOS keychain to notarize the releases

73e71ed

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

RafaelGSS mentioned this pull request Nov 28, 2023

v21.3.0 proposal #50954

Merged

RafaelGSS pushed a commit that referenced this pull request Nov 29, 2023

tools: use macOS keychain to notarize the releases

a12d9e0

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 11, 2023

tools: use macOS keychain to notarize the releases

341fcfd

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon mentioned this pull request Dec 12, 2023

v20.11.0 proposal #51124

Merged

UlisesGascon added a commit that referenced this pull request Dec 13, 2023

tools: use macOS keychain to notarize the releases

aa74680

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 15, 2023

tools: use macOS keychain to notarize the releases

eec1fd9

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

UlisesGascon added a commit that referenced this pull request Dec 19, 2023

tools: use macOS keychain to notarize the releases

c9bd0b0

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

richardlau pushed a commit that referenced this pull request Jan 16, 2024

tools: use macOS keychain to notarize the releases

728c609

PR-URL: #50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

richardlau added backported-to-v18.x and removed lts-watch-v18.x labels Jan 16, 2024

UlisesGascon deleted the tools/osx-keychain-profile branch February 26, 2024 15:33

sercher added a commit to sercher/graaljs that referenced this pull request Apr 25, 2024

tools: use macOS keychain to notarize the releases

3e5ca79

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

sercher added a commit to sercher/graaljs that referenced this pull request Apr 25, 2024

tools: use macOS keychain to notarize the releases

2fac833

PR-URL: nodejs/node#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

aduh95 pushed a commit to aduh95/node that referenced this pull request Feb 18, 2025

tools: use macOS keychain to notarize the releases

ccc676a

PR-URL: nodejs#50715 Reviewed-By: Michael Dawson <midawson@redhat.com>

tools: use OSX Keychain profile to notarize the releases by UlisesGascon · Pull Request #50715 · nodejs/node · GitHub

Uh oh!

Uh oh!

tools: use OSX Keychain profile to notarize the releases - #50715

tools: use OSX Keychain profile to notarize the releases#50715
UlisesGascon wants to merge 1 commit into
nodejs:mainfrom
UlisesGascon:tools/osx-keychain-profile

UlisesGascon commented Nov 13, 2023

Uh oh!

nodejs-github-bot commented Nov 13, 2023

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 19, 2023

Uh oh!

mhdawson left a comment

Uh oh!

nodejs-github-bot commented Nov 20, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

mhdawson commented Nov 22, 2023

Uh oh!

mhdawson commented Nov 22, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tools: use OSX Keychain profile to notarize the releases by UlisesGascon · Pull Request #50715 · nodejs/node · GitHub

Uh oh!

Uh oh!

tools: use OSX Keychain profile to notarize the releases - #50715

tools: use OSX Keychain profile to notarize the releases#50715UlisesGascon wants to merge 1 commit intonodejs:mainnodejs/node:mainfrom UlisesGascon:tools/osx-keychain-profileUlisesGascon/node:tools/osx-keychain-profileCopy head branch name to clipboard

Conversation

UlisesGascon commented Nov 13, 2023

Main Changes

Context

Notes

Test

Uh oh!

nodejs-github-bot commented Nov 13, 2023

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 19, 2023

Uh oh!

mhdawson left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Nov 20, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

nodejs-github-bot commented Nov 21, 2023

Uh oh!

mhdawson commented Nov 22, 2023

Uh oh!

mhdawson commented Nov 22, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tools: use OSX Keychain profile to notarize the releases#50715
UlisesGascon wants to merge 1 commit into
nodejs:mainfrom
UlisesGascon:tools/osx-keychain-profile