Share import mac code signing certificate steps for release (#851)

.github/scripts/apple-signing/setup-dev.sh

@@ -20,12 +20,6 @@ P12_FILE=$FILE_PREFIX.p12
 
 EXT_SECTION=codesign_reqext
 
-## Keychain material
-
-KEYCHAIN_NAME=$NAME
-KEYCHAIN_PATH=$HOME/Library/Keychains/$KEYCHAIN_NAME-db
-KEYCHAIN_PASSWORD="topsykretts"
-
 # setup_signing
 #
 # preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
@@ -46,7 +40,7 @@ function setup_signing() {
   mkdir -p "${DIR}"
 
   # configure the openssl extensions
-  cat << EOF > $EXT_FILE
+  cat << EOF > "$EXT_FILE"
   [ req ]
   default_bits          = 2048                  # RSA key size
   encrypt_key           = yes                   # Protect private key
@@ -105,7 +99,7 @@ EOF
             -extensions $EXT_SECTION
 
   commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in $CERT_FILE | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
+  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
 
   title "export cert and private key to .p12 file"
   # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
@@ -117,55 +111,18 @@ EOF
             -passin "pass:$KEY_PASSWORD" \
             -passout "pass:$P12_PASSWORD"
 
-
-  title "create the dev keychain"
-
   # delete the keychain if it already exists
-  if [ -f "$(KEYCHAIN_PATH)" ]; then
-    security delete-keychain "$KEYCHAIN_NAME" &> /dev/null
+  if [ -f "${KEYCHAIN_PATH}" ]; then
+    cleanup_dev_signing
   fi
 
-  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$CERT_FILE" &> /dev/null; then
-    set -e
-    title "import the cert into the dev keychain if it is not already trusted by the system"
-
-    security import "$P12_FILE" -P $P12_PASSWORD -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-    # note: add-trusted-cert requires user interaction
-    commentary "adding the developer certificate as a trusted certificate... (requires user interaction)"
-    security add-trusted-cert -d -r trustRoot -k "$KEYCHAIN_PATH" "$CERT_FILE"
-  else
-    set -e
-    commentary "...dev cert has already been imported onto the dev keychain"
-  fi
-
-  # remove any generated cert material since the keychain now has all of this material loaded
-  rm -rf "${DIR}"
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$IDENTITY" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the dev keychain to the search path for codesign"
-  add_keychain $KEYCHAIN_NAME
-
-  commentary "verify the keychain actually shows up"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$IDENTITY
-  commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-
+  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
 }
 
-function cleanup_signing() {
+function cleanup_dev_signing() {
   title "delete the dev keychain and all certificate material"
   set -xue
-  security delete-keychain "$KEYCHAIN_NAME"
-  rm -f "$KEYCHAIN_PATH"
-  rm -rf "${DIR}"
+  security delete-keychain "$KEYCHAIN_NAME" || true
+  rm -f "$KEYCHAIN_PATH" || true
+  rm -rf "${DIR}" || true
 }