fix: Use specific notary keychain to avoid issues with locking #952
Conversation
WalkthroughThe changes in the Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review Details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- .github/workflows/ci_beta.yml (2 hunks)
Additional comments not posted (5)
.github/workflows/ci_beta.yml (5)
6-10: Commenting out the push event trigger for specific tags.Please confirm if the intention is to disable the workflow for specific tags. This change will prevent the workflow from running on tag pushes matching the pattern
v[0-9]+.[0-9]+.[0-9]+-beta.
13-15: LGTM! The workflow will now trigger on pushes and pull requests to themasterbranch.
83-84: LGTM! Unlocking the default keychain addresses the keychain lock issue.
89-122: Commenting out the upload steps.Please confirm if the intention is to disable the upload of these artifacts. This change will prevent the upload of
Espressif-IDE-macosx-cocoa-x86_64.dmg,Espressif-IDE-macosx-cocoa-aarch64.dmg, build artifacts, Windows RCP, and Linux RCP.
125-163: Commenting out the upload steps todl.espressif.com.Please confirm if the intention is to disable the upload of build assets to
dl.espressif.com. This change will prevent the upload of various build assets to the specified S3 bucket and CloudFront distribution.
kolipakakondal
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
Review Details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- .github/workflows/ci_beta.yml (1 hunks)
Additional comments not posted (3)
.github/workflows/ci_beta.yml (3)
72-75: Ensure the notary keychain is properly managed.Verify that the notary keychain is properly managed and deleted after use to prevent security risks.
84-85: Ensure the notary keychain is properly managed.Verify that the notary keychain is properly managed and deleted after use to prevent security risks.
87-89: Ensure the notary keychain is properly managed.Verify that the notary keychain is properly managed and deleted after use to prevent security risks.
| - name: Notarization of Espressif-IDE dmg files | ||
| env: | ||
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | ||
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | ||
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | ||
| run: | | ||
| echo "Create notary keychain" | ||
| /usr/bin/security create-keychain -p espressif notary.keychain | ||
| /usr/bin/security default-keychain -s notary.keychain | ||
| /usr/bin/security unlock-keychain -p espressif notary.keychain | ||
|
|
||
| echo "Create keychain profile" | ||
| xcrun notarytool store-credentials "ide-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | ||
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg --keychain-profile "ide-notarytool-profile" --wait | ||
|
|
||
| echo "Attach staple for x86_64.dmg" | ||
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | ||
|
|
||
| - name: Notarization of Espressif-IDE-macosx-cocoa-aarch64.dmg | ||
| env: | ||
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | ||
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | ||
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | ||
| run: | | ||
| echo "Create keychain profile" | ||
| xcrun notarytool store-credentials "ide-notarytool-profile-arm64" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | ||
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile-arm64" --wait | ||
|
|
||
| echo "Unlock the notary keychain" | ||
| /usr/bin/security unlock-keychain -p espressif notary.keychain | ||
|
|
||
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile" --wait |
There was a problem hiding this comment.
Ensure proper cleanup of the notary keychain.
To avoid potential security risks, ensure that the notary keychain is deleted after the notarization process is complete. Add the following lines at the end of the step:
+ echo "Delete the notary keychain"
+ /usr/bin/security delete-keychain notary.keychainCommittable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| - name: Notarization of Espressif-IDE dmg files | |
| env: | |
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | |
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | |
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | |
| run: | | |
| echo "Create notary keychain" | |
| /usr/bin/security create-keychain -p espressif notary.keychain | |
| /usr/bin/security default-keychain -s notary.keychain | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| echo "Create keychain profile" | |
| xcrun notarytool store-credentials "ide-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| echo "Attach staple for x86_64.dmg" | |
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| - name: Notarization of Espressif-IDE-macosx-cocoa-aarch64.dmg | |
| env: | |
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | |
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | |
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | |
| run: | | |
| echo "Create keychain profile" | |
| xcrun notarytool store-credentials "ide-notarytool-profile-arm64" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile-arm64" --wait | |
| echo "Unlock the notary keychain" | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| - name: Notarization of Espressif-IDE dmg files | |
| env: | |
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | |
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | |
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | |
| run: | | |
| echo "Create notary keychain" | |
| /usr/bin/security create-keychain -p espressif notary.keychain | |
| /usr/bin/security default-keychain -s notary.keychain | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| echo "Create keychain profile" | |
| xcrun notarytool store-credentials "ide-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| echo "Attach staple for x86_64.dmg" | |
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| echo "Unlock the notary keychain" | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| echo "Delete the notary keychain" | |
| /usr/bin/security delete-keychain notary.keychain |
Description
Please include a summary of the change and which issue is fixed.
Fixes # (IEP-XXX)
Type of change
Please delete options that are not relevant.
How has this been tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
Test Configuration:
Dependent components impacted by this PR:
Checklist
Summary by CodeRabbit
pull_requesttrigger for themasterbranch.