GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — tools: add staple to macOS notarized binaries by UlisesGascon · Pull Request #50625 · nodejs/node

Conversation

UlisesGascon commented Nov 8, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Main Changes

Added Staple for the notarized binaries in macOS.

cc: @nodejs/build @nodejs/releasers

Context

Gatekeeper will perform a check for a notarization ticket online. If it can't reach the server (due to no internet connection, for example), and if the ticket isn't stapled to the app, macOS will prevent the app from running because it can't verify that it is notarized.

You can find more information in this amazing article https://tonygo.ghost.io/notarization-for-macos-app-with-notarytool/ by @tony-go

Notes

I am working in a separate PR for the validation of the binaries

Test

This was tested in iojs+release-ulises-experimental pipeline in jenkins ci release.

Full log available here

14:27:03 sh tools/osx-notarize.sh v22.0.0-test202311086410f3bf0d
14:27:03 Notarization process is done with Notarytool.
14:27:03 Submitting node-v22.0.0-test202311086410f3bf0d.pkg for notarization...
14:27:03 Conducting pre-submission checks for node-v22.0.0-test202311086410f3bf0d.pkg and initiating connection to the Apple notary service...
14:27:05 Submission ID received
14:27:05   id: 28708d84-5489-4e4a-b1cc-fe1fa5d840d9
14:27:11 Successfully uploaded file
14:27:11   id: 28708d84-5489-4e4a-b1cc-fe1fa5d840d9
14:27:11   path: /Users/iojs/build/ws/node-v22.0.0-test202311086410f3bf0d.pkg
14:27:11 Waiting for processing to complete.
14:27:17 
Current status: In Progress...
Current status: In Progress....
Current status: In Progress.....
Current status: In Progress......
Current status: In Progress.......
Current status: In Progress........
Current status: In Progress.........
Current status: In Progress..........
Current status: In Progress...........
Current status: In Progress............
Current status: In Progress.............
Current status: In Progress..............
Current status: Accepted...............Processing complete
14:28:57   id: 28708d84-5489-4e4a-b1cc-fe1fa5d840d9
14:28:57   status: Accepted
14:28:57 
14:28:57 Notarization node-v22.0.0-test202311086410f3bf0d.pkg submitted successfully.
14:28:57 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311086410f3bf0d.pkg
14:28:57 Processing: /Users/iojs/build/ws/node-v22.0.0-test202311086410f3bf0d.pkg
14:28:58 The staple and validate action worked!
14:28:58 Stapler was successful.
[...redacted...]
14:29:10 Finished: SUCCESS

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

tony-go and fraxken reacted with heart emoji

All reactions

❤️ 2 reactions

UlisesGascon added 2 commits

November 8, 2023 11:09


          tools: add macOS notarization stapler

fc7bf89


          tools: remove return from macOS notarize script

b46a70e

nodejs-github-bot added macos

Issues and PRs related to the macOS platform.

tools Issues and PRs related to the tools directory. labels

Nov 8, 2023

UlisesGascon marked this pull request as ready for review

November 8, 2023 14:08

UlisesGascon added request-ci

Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review.

lts-watch-v18.x labels

Nov 8, 2023

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label

Nov 8, 2023

nodejs-github-bot commented Nov 8, 2023

Copy link

Copy Markdown

Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/55498/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

tony-go approved these changes

Nov 8, 2023

View reviewed changes

tony-go left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fantastic work, my dear @UlisesGascon 👏🏼 😍 and thanks for the mention.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

UlisesGascon reacted with heart emoji

All reactions

❤️ 1 reaction

Comment thread

tools/osx-notarize.sh Resolved

Uh oh!

There was an error while loading. Please reload this page.

richardlau approved these changes

Nov 8, 2023

View reviewed changes

This was referenced Nov 8, 2023

tools: add macOS notarization verification step #50628

Closed

Action required by Apple: Transition to the notarytool command-line utility nodejs/build#3385

Closed

lpinca approved these changes

Nov 11, 2023

View reviewed changes

lpinca added commit-queue-rebase

PRs the Commit Queue should land as multiple self-contained commits.

commit-queue

PRs queued for automated landing through the Commit Queue.

commit-queue-squash PRs the Commit Queue should land as one squashed commit. and removed commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. labels

Nov 11, 2023

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label

Nov 11, 2023

nodejs-github-bot merged commit ce6c9b0 into nodejs:main

Nov 11, 2023

nodejs-github-bot commented Nov 11, 2023

Copy link

Copy Markdown

Collaborator

Landed in ce6c9b0

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

targos pushed a commit that referenced this pull request

Nov 12, 2023


          tools: add macOS notarization stapler

0907b56

PR-URL: #50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

targos mentioned this pull request

Nov 12, 2023

v21.2.0 release proposal #50681

Merged

UlisesGascon mentioned this pull request

Nov 12, 2023

v20.10.0 release proposal #50682

Merged

targos pushed a commit that referenced this pull request

Nov 14, 2023


          tools: add macOS notarization stapler

5fcd67a

PR-URL: #50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

UlisesGascon added a commit that referenced this pull request

Dec 11, 2023


          tools: add macOS notarization stapler

797f6a9

PR-URL: #50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

UlisesGascon mentioned this pull request

Dec 12, 2023

v20.11.0 proposal #51124

Merged

richardlau pushed a commit that referenced this pull request

Jan 16, 2024


          tools: add macOS notarization stapler

03ff182

PR-URL: #50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

richardlau removed the lts-watch-v18.x label

Jan 16, 2024

richardlau added backported-to-v18.x and removed lts-watch-v20.x labels

Jan 16, 2024

RafaelGSS pushed a commit that referenced this pull request

Feb 14, 2024


          2024-02-14, Version 18.19.1 'Hydrogen' (LTS)

2a5a150

This is a security release.

Notable changes:

crypto:
  * update root certificates to NSS 3.95 (Node.js GitHub Bot) #50805
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
deps:
  * upgrade npm to 10.2.4 (npm team) #50751
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com//pull/51614
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51614
http:
  * add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520
lib:
  * update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
test:
  * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621
tools:
  * add macOS notarization verification step (Ulises Gascón) #50833
  * use macOS keychain to notarize the releases (Ulises Gascón) #50715
  * remove unused file (Ulises Gascon) #50622
  * add macOS notarization stapler (Ulises Gascón) #50625
  * improve macOS notarization process output readability (Ulises Gascón) #50389
  * remove unused `version` function (Ulises Gascón) #50390
win,tools:
  * upgrade Windows signing to smctl (Stefan Stojanovic) #50956
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542

PR-URL: nodejs-private/node-private#545

sercher added a commit to sercher/graaljs that referenced this pull request

Apr 25, 2024


          tools: add macOS notarization stapler

a5f41ac

PR-URL: nodejs/node#50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

sercher added a commit to sercher/graaljs that referenced this pull request

Apr 25, 2024


          2024-02-14, Version 18.19.1 'Hydrogen' (LTS)

1ddeb10

This is a security release.

Notable changes:

crypto:
  * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade npm to 10.2.4 (npm team) nodejs/node#50751
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
test:
  * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621
tools:
  * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833
  * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715
  * remove unused file (Ulises Gascon) nodejs/node#50622
  * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625
  * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389
  * remove unused `version` function (Ulises Gascón) nodejs/node#50390
win,tools:
  * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542

PR-URL: https://github.com/nodejs-private/node-private/pull/545

sercher added a commit to sercher/graaljs that referenced this pull request

Apr 25, 2024


          tools: add macOS notarization stapler

6fd30f7

PR-URL: nodejs/node#50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

sercher added a commit to sercher/graaljs that referenced this pull request

Apr 25, 2024


          2024-02-14, Version 18.19.1 'Hydrogen' (LTS)

d02cd45

This is a security release.

Notable changes:

crypto:
  * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs/node#50805
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade npm to 10.2.4 (npm team) nodejs/node#50751
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs/node#51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs/node#51614
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
test:
  * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs/node#49621
tools:
  * add macOS notarization verification step (Ulises Gascón) nodejs/node#50833
  * use macOS keychain to notarize the releases (Ulises Gascón) nodejs/node#50715
  * remove unused file (Ulises Gascon) nodejs/node#50622
  * add macOS notarization stapler (Ulises Gascón) nodejs/node#50625
  * improve macOS notarization process output readability (Ulises Gascón) nodejs/node#50389
  * remove unused `version` function (Ulises Gascón) nodejs/node#50390
win,tools:
  * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs/node#50956
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542

PR-URL: https://github.com/nodejs-private/node-private/pull/545

aduh95 pushed a commit to aduh95/node that referenced this pull request

Feb 18, 2025


          tools: add macOS notarization stapler

bd5f6fb

PR-URL: nodejs#50625
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

aduh95 pushed a commit to aduh95/node that referenced this pull request

Feb 18, 2025


          2024-02-14, Version 18.19.1 'Hydrogen' (LTS)

6610cc4

This is a security release.

Notable changes:

crypto:
  * update root certificates to NSS 3.95 (Node.js GitHub Bot) nodejs#50805
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
deps:
  * upgrade npm to 10.2.4 (npm team) nodejs#50751
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) nodejs#51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/pull/51614
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) nodejs#51614
http:
  * add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520
lib:
  * update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
test:
  * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) nodejs#49621
tools:
  * add macOS notarization verification step (Ulises Gascón) nodejs#50833
  * use macOS keychain to notarize the releases (Ulises Gascón) nodejs#50715
  * remove unused file (Ulises Gascon) nodejs#50622
  * add macOS notarization stapler (Ulises Gascón) nodejs#50625
  * improve macOS notarization process output readability (Ulises Gascón) nodejs#50389
  * remove unused `version` function (Ulises Gascón) nodejs#50390
win,tools:
  * upgrade Windows signing to smctl (Stefan Stojanovic) nodejs#50956
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542

PR-URL: nodejs-private/node-private#545

Reviewers

lpinca

lpinca approved these changes

richardlau

richardlau approved these changes

+1 more reviewer

tony-go

tony-go approved these changes

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

commit-queue-squash

PRs the Commit Queue should land as one squashed commit.

macos

Issues and PRs related to the macOS platform.

tools

Issues and PRs related to the tools directory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

UlisesGascon commented Nov 8, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Main Changes

Context

Notes

Test

Uh oh!

nodejs-github-bot commented Nov 8, 2023

Uh oh!

tony-go left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 11, 2023

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

UlisesGascon commented Nov 8, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.