test codesgin

.github/workflows/build.yaml

@@ -18,6 +18,12 @@ on:
         required: true
       credentials_json:
         required: false
+      apple_app_specific_password:
+        required: false
+      fastlane_password:
+        required: false
+      match_password:
+        required: false
 
 jobs:
   build:
@@ -76,6 +82,41 @@ jobs:
         run: |
           poetry run pyinstaller -c --onefile src/pieces/app.py  --hidden-import=pydantic_core --name=pieces
 
+      ### Setting up our fastlane certificates
+      - name: Setup Certificates
+        run: |-
+          cd macos
+          bundle install
+          bundle exec fastlane setup
+        env:
+          MATCH_PASSWORD: ${{ secrets.match_password }}
+          FASTLANE_PASSWORD: ${{ secrets.fastlane_password }}
+
+      ### Codesign Binary Macos
+      - name: Codesign Binary Macos
+        run: |
+          codesign -s "Developer ID Application: Mesh Intelligent Technologies, Inc. (287L9TU9JL)" -i com.pieces.cli -o runtime --entitlements macos/Release.entitlements --timestamp -f dist/pieces
+
+      ### Binary to Zip file
+      - name: Mac Binary to Zip File
+        run: |
+          if [[ ${{ steps.get_version.outputs.VERSION }} =~ [0-9]+.[0-9]+.[0-9]+$ ]]
+          then
+              ditto -c -k --sequesterRsrc "dist/pieces" dist/pieces-cli-mac-${{ steps.staging_version.outputs.RELEASE_VERSION }}.zip
+          else
+              ditto -c -k --sequesterRsrc "dist/pieces" dist/pieces-cli-mac-${{ steps.staging_version.outputs.STAGING_VERSION }}.zip
+          fi
+
+      ### Submission to apple notary
+      - name: Submit Zip to apple notary
+        run: |
+          if [[ ${{ steps.get_version.outputs.VERSION }} =~ [0-9]+.[0-9]+.[0-9]+$ ]]
+          then
+              xcrun notarytool submit dist/pieces-cli-mac-${{ steps.staging_version.outputs.RELEASE_VERSION }}.zip --password ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} --apple-id "[email protected]" --team-id "287L9TU9JL" --wait
+          else
+              xcrun notarytool submit dist/pieces-cli-mac-${{ steps.staging_version.outputs.STAGING_VERSION }}.zip --password ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} --apple-id "[email protected]" --team-id "287L9TU9JL" --wait
+          fi
+
       ### Writing our staging version to a file to be pulled in the last step to update our json in the cloud
       - name: Write staging version to file
         shell: bash
@@ -179,6 +220,7 @@ jobs:
           gsutil -h "Cache-Control: max-age=0" cp latest-single.json gs://$BUCKET/pieces_cli/$CHANNEL/latest-single.json
           gsutil -h "Cache-Control: max-age=0" cp latest.json gs://$BUCKET/pieces_cli/$CHANNEL/latest.json
           gsutil cp -r **.tar.gz gs://$BUCKET/pieces_cli/release/
+          gsutil cp -r **.zip gs://$BUCKET/pieces_cli/release/
           gsutil cp -r **.whl gs://$BUCKET/pieces_cli/release/
           echo "releasetag=$VERSION" >> $GITHUB_ENV
 
@@ -190,6 +232,7 @@ jobs:
           files: |
             **.tar.gz
             **.whl
+            **.zip
           fail_on_unmatched_files: true
           name: ${{ env.releasetag }}
           tag_name: ${{ env.releasetag }}
@@ -204,6 +247,7 @@ jobs:
           files: |
             **.tar.gz
             **.whl
+            **.zip
           fail_on_unmatched_files: true
           name: ${{ env.releasetag }}
           tag_name: ${{ env.releasetag }}

.github/workflows/release.yaml

@@ -16,3 +16,6 @@ jobs:
       pypi_test_token: ${{ secrets.PYPI_TEST_TOKEN }}
       ssh_private_key: ${{ secrets.PIECES_GITHUB_SSH }}
       credentials_json: ${{ secrets.GCP_CREDENTIALS }}
+      apple_app_specific_password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+      fastlane_password: ${{ secrets.FASTLANE_PASSWORD }}
+      match_password: ${{ secrets.MATCH_PASSWORD }}

.github/workflows/staging.yaml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - test_mac_binary
 
 jobs:
   build:
@@ -16,3 +17,6 @@ jobs:
       pypi_test_token: ${{ secrets.PYPI_TEST_TOKEN }}
       ssh_private_key: ${{ secrets.PIECES_GITHUB_SSH }}
       credentials_json: ${{ secrets.GCP_CREDENTIALS }}
+      apple_app_specific_password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+      fastlane_password: ${{ secrets.FASTLANE_PASSWORD }}
+      match_password: ${{ secrets.MATCH_PASSWORD }}

.gitignore

@@ -167,3 +167,4 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 .idea/
 
+cli-agent.iml

macos/Gemfile

@@ -0,0 +1,4 @@
+
+source "https://rubygems.org"
+
+gem "fastlane"

macos/Gemfile.lock

@@ -0,0 +1,223 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.7)
+      base64
+      nkf
+      rexml
+    addressable (2.8.6)
+      public_suffix (>= 2.0.2, < 6.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.919.0)
+    aws-sdk-core (3.192.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.651.0)
+      aws-sigv4 (~> 1.8)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-kms (1.79.0)
+      aws-sdk-core (~> 3, >= 3.191.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-s3 (1.147.0)
+      aws-sdk-core (~> 3, >= 3.192.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.8)
+    aws-sigv4 (1.8.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.2.0)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    declarative (0.0.20)
+    digest-crc (0.6.5)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (0.109.0)
+    faraday (1.10.3)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.7)
+      faraday (>= 0.8.0)
+      http-cookie (~> 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.0)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.4)
+      multipart-post (~> 2)
+    faraday-net_http (1.0.1)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    faraday_middleware (1.2.0)
+      faraday (~> 1.0)
+    fastimage (2.3.1)
+    fastlane (2.220.0)
+      CFPropertyList (>= 2.3, < 4.0.0)
+      addressable (>= 2.8, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.0)
+      babosa (>= 1.0.3, < 2.0.0)
+      bundler (>= 1.12.0, < 3.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 1.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.0.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.1.0, < 3)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      naturally (~> 2.2)
+      optparse (>= 0.1.1, < 1.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.3.0)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.54.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-core (0.11.3)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (>= 0.16.2, < 2.a)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-iamcredentials_v1 (0.17.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.13.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-storage_v1 (0.29.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-cloud-core (1.6.1)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    google-cloud-errors (1.3.1)
+    google-cloud-storage (1.45.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-iamcredentials_v1 (~> 0.1)
+      google-apis-storage_v1 (~> 0.29.0)
+      google-cloud-core (~> 1.6)
+      googleauth (>= 0.16.2, < 2.a)
+      mini_mime (~> 1.0)
+    googleauth (1.8.1)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.5)
+      domain_name (~> 0.5)
+    httpclient (2.8.3)
+    jmespath (1.6.2)
+    json (2.7.2)
+    jwt (2.8.1)
+      base64
+    mini_magick (4.12.0)
+    mini_mime (1.1.5)
+    multi_json (1.15.0)
+    multipart-post (2.4.0)
+    nanaimo (0.3.0)
+    naturally (2.2.1)
+    nkf (0.2.0)
+    optparse (0.5.0)
+    os (1.1.4)
+    plist (3.7.1)
+    public_suffix (5.0.5)
+    rake (13.2.1)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.1.2)
+    rexml (3.2.6)
+    rouge (2.0.7)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.3.2)
+    security (0.1.5)
+    signet (0.18.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.9.1)
+    unicode-display_width (2.5.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.24.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.3.0)
+      rexml (~> 3.2.4)
+    xcpretty (0.3.0)
+      rouge (~> 2.0.7)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  universal-darwin-20
+  universal-darwin-23
+  x86_64-linux
+
+DEPENDENCIES
+  fastlane
+
+BUNDLED WITH
+   2.2.29

macos/Matchfile

@@ -0,0 +1,11 @@
+git_url("[email protected]:pieces-app/apple_certs.git")
+
+platform("macos")
+
+storage_mode("git")
+
+type("developer_id") # The default type, can be: appstore, adhoc, enterprise or development
+
+username("[email protected]")
+
+app_identifier("com.pieces.cli")

macos/Release.entitlements

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+</dict>
+</plist>

macos/fastlane/Fastfile

@@ -0,0 +1,8 @@
+default_platform :ios
+
+platform :ios do
+  desc "Developer ID"
+  lane :setup do
+    match(type: "developer_id")
+  end
+end