Struct apple_codesign::notarization::Notarizer

pub struct Notarizer { /* private fields */ }

An entity for performing notarizations.

Notarization works by uploading content to Apple, waiting for Apple to inspect and react to that upload, then downloading a notarization “ticket” from Apple and incorporating it into the entity being signed.

Implementations

impl Notarizer

pub fn from_api_key_id(
    issuer_id: impl ToString,
    key_id: impl ToString
) -> Result<Self, AppleCodesignError>

Construct an instance from an API issuer ID and API key.

Examples found in repository

src/cli.rs (line 1907)

fn notarizer_from_args(args: &ArgMatches) -> Result<Notarizer, AppleCodesignError> {
    let api_key_path = args.get_one::<PathBuf>("api_key_path");
    let api_issuer = args.get_one::<String>("api_issuer");
    let api_key = args.get_one::<String>("api_key");

    if let Some(api_key_path) = api_key_path {
        Notarizer::from_api_key(api_key_path)
    } else if let (Some(issuer), Some(key)) = (api_issuer, api_key) {
        Notarizer::from_api_key_id(issuer, key)
    } else {
        Err(AppleCodesignError::NotarizeNoAuthCredentials)
    }
}

pub fn from_api_key(path: &Path) -> Result<Self, AppleCodesignError>

Construct an instance from a file containing a JSON encoded API key.

Examples found in repository

src/cli.rs (line 1905)

fn notarizer_from_args(args: &ArgMatches) -> Result<Notarizer, AppleCodesignError> {
    let api_key_path = args.get_one::<PathBuf>("api_key_path");
    let api_issuer = args.get_one::<String>("api_issuer");
    let api_key = args.get_one::<String>("api_key");

    if let Some(api_key_path) = api_key_path {
        Notarizer::from_api_key(api_key_path)
    } else if let (Some(issuer), Some(key)) = (api_issuer, api_key) {
        Notarizer::from_api_key_id(issuer, key)
    } else {
        Err(AppleCodesignError::NotarizeNoAuthCredentials)
    }
}

pub fn notarize_path(
    &self,
    path: &Path,
    wait_limit: Option<Duration>
) -> Result<NotarizationUpload, AppleCodesignError>

Attempt to notarize an asset defined by a filesystem path.

The type of path is sniffed out and the appropriate notarization routine is called.

Examples found in repository

src/cli.rs (line 1953)

fn command_notary_submit(args: &ArgMatches) -> Result<(), AppleCodesignError> {
    let path = PathBuf::from(
        args.get_one::<String>("path")
            .expect("clap should have validated arguments"),
    );
    let staple = args.get_flag("staple");
    let wait = args.get_flag("wait") || staple;

    let wait_limit = if wait {
        Some(notarizer_wait_duration(args)?)
    } else {
        None
    };
    let notarizer = notarizer_from_args(args)?;

    let upload = notarizer.notarize_path(&path, wait_limit)?;

    if staple {
        match upload {
            crate::notarization::NotarizationUpload::UploadId(_) => {
                panic!(
                    "NotarizationUpload::UploadId should not be returned if we waited successfully"
                );
            }
            crate::notarization::NotarizationUpload::NotaryResponse(_) => {
                let stapler = crate::stapling::Stapler::new()?;
                stapler.staple_path(&path)?;
            }
        }
    }

    Ok(())
}

pub fn notarize_bundle(
    &self,
    bundle: &DirectoryBundle,
    wait_limit: Option<Duration>
) -> Result<NotarizationUpload, AppleCodesignError>

Attempt to notarize an on-disk bundle.

If wait_limit is provided, we will wait for the upload to finish processing. Otherwise, this returns as soon as the upload is performed.

Examples found in repository

src/notarization.rs (line 184)

    pub fn notarize_path(
        &self,
        path: &Path,
        wait_limit: Option<Duration>,
    ) -> Result<NotarizationUpload, AppleCodesignError> {
        match PathType::from_path(path)? {
            PathType::Bundle => {
                let bundle = DirectoryBundle::new_from_path(path)
                    .map_err(AppleCodesignError::DirectoryBundle)?;
                self.notarize_bundle(&bundle, wait_limit)
            }
            PathType::Xar => self.notarize_flat_package(path, wait_limit),
            PathType::Zip => self.notarize_flat_package(path, wait_limit),
            PathType::Dmg => self.notarize_dmg(path, wait_limit),
            PathType::MachO | PathType::Other => Err(AppleCodesignError::NotarizeUnsupportedPath(
                path.to_path_buf(),
            )),
        }
    }

pub fn notarize_dmg(
    &self,
    dmg_path: &Path,
    wait_limit: Option<Duration>
) -> Result<NotarizationUpload, AppleCodesignError>

Attempt to notarize a DMG file.

Examples found in repository

src/notarization.rs (line 188)

    pub fn notarize_path(
        &self,
        path: &Path,
        wait_limit: Option<Duration>,
    ) -> Result<NotarizationUpload, AppleCodesignError> {
        match PathType::from_path(path)? {
            PathType::Bundle => {
                let bundle = DirectoryBundle::new_from_path(path)
                    .map_err(AppleCodesignError::DirectoryBundle)?;
                self.notarize_bundle(&bundle, wait_limit)
            }
            PathType::Xar => self.notarize_flat_package(path, wait_limit),
            PathType::Zip => self.notarize_flat_package(path, wait_limit),
            PathType::Dmg => self.notarize_dmg(path, wait_limit),
            PathType::MachO | PathType::Other => Err(AppleCodesignError::NotarizeUnsupportedPath(
                path.to_path_buf(),
            )),
        }
    }

pub fn notarize_flat_package(
    &self,
    pkg_path: &Path,
    wait_limit: Option<Duration>
) -> Result<NotarizationUpload, AppleCodesignError>

Attempt to notarize a flat package (.pkg) installer or a .zip file.

Examples found in repository

src/notarization.rs (line 186)

    pub fn notarize_path(
        &self,
        path: &Path,
        wait_limit: Option<Duration>,
    ) -> Result<NotarizationUpload, AppleCodesignError> {
        match PathType::from_path(path)? {
            PathType::Bundle => {
                let bundle = DirectoryBundle::new_from_path(path)
                    .map_err(AppleCodesignError::DirectoryBundle)?;
                self.notarize_bundle(&bundle, wait_limit)
            }
            PathType::Xar => self.notarize_flat_package(path, wait_limit),
            PathType::Zip => self.notarize_flat_package(path, wait_limit),
            PathType::Dmg => self.notarize_dmg(path, wait_limit),
            PathType::MachO | PathType::Other => Err(AppleCodesignError::NotarizeUnsupportedPath(
                path.to_path_buf(),
            )),
        }
    }

impl Notarizer

pub fn get_submission(
    &self,
    submission_id: &str
) -> Result<SubmissionResponse, AppleCodesignError>

Examples found in repository

src/notarization.rs (line 381)

    pub fn wait_on_notarization(
        &self,
        submission_id: &str,
        wait_limit: Duration,
    ) -> Result<notary_api::SubmissionResponse, AppleCodesignError> {
        warn!(
            "waiting up to {}s for package upload {} to finish processing",
            wait_limit.as_secs(),
            submission_id
        );

        let start_time = std::time::Instant::now();

        loop {
            let status = self.get_submission(submission_id)?;

            let elapsed = start_time.elapsed();

            info!(
                "poll state after {}s: {:?}",
                elapsed.as_secs(),
                status.data.attributes.status
            );

            if status.data.attributes.status != notary_api::SubmissionResponseStatus::InProgress {
                warn!("Notary API Server has finished processing the uploaded asset");

                return Ok(status);
            }

            if elapsed >= wait_limit {
                warn!("reached wait limit after {}s", elapsed.as_secs());
                return Err(AppleCodesignError::NotarizeWaitLimitReached);
            }

            std::thread::sleep(self.wait_poll_interval);
        }
    }

pub fn wait_on_notarization(
    &self,
    submission_id: &str,
    wait_limit: Duration
) -> Result<SubmissionResponse, AppleCodesignError>

Examples found in repository

src/notarization.rs (line 424)

    pub fn wait_on_notarization_and_fetch_log(
        &self,
        submission_id: &str,
        wait_limit: Duration,
    ) -> Result<notary_api::SubmissionResponse, AppleCodesignError> {
        let status = self.wait_on_notarization(submission_id, wait_limit)?;

        let log = self.fetch_notarization_log(submission_id)?;

        for line in serde_json::to_string_pretty(&log)?.lines() {
            warn!("notary log> {}", line);
        }

        Ok(status)
    }

pub fn fetch_notarization_log(
    &self,
    submission_id: &str
) -> Result<Value, AppleCodesignError>

Obtain the processing log from an upload.

Examples found in repository

src/cli.rs (line 1929)

fn command_notary_log(args: &ArgMatches) -> Result<(), AppleCodesignError> {
    let notarizer = notarizer_from_args(args)?;
    let submission_id = args
        .get_one::<String>("submission_id")
        .expect("submission_id is required");

    let log = notarizer.fetch_notarization_log(submission_id)?;

    for line in serde_json::to_string_pretty(&log)?.lines() {
        println!("{line}");
    }

    Ok(())
}

src/notarization.rs (line 426)

    pub fn wait_on_notarization_and_fetch_log(
        &self,
        submission_id: &str,
        wait_limit: Duration,
    ) -> Result<notary_api::SubmissionResponse, AppleCodesignError> {
        let status = self.wait_on_notarization(submission_id, wait_limit)?;

        let log = self.fetch_notarization_log(submission_id)?;

        for line in serde_json::to_string_pretty(&log)?.lines() {
            warn!("notary log> {}", line);
        }

        Ok(status)
    }

pub fn wait_on_notarization_and_fetch_log(
    &self,
    submission_id: &str,
    wait_limit: Duration
) -> Result<SubmissionResponse, AppleCodesignError>

Waits on an app store package upload and fetches and logs the upload log.

This is just a convenience around [Self::wait_on_app_store_package_upload()] and [Self::fetch_upload_log()].

Examples found in repository

src/cli.rs (line 1979)

fn command_notary_wait(args: &ArgMatches) -> Result<(), AppleCodesignError> {
    let wait_duration = notarizer_wait_duration(args)?;
    let notarizer = notarizer_from_args(args)?;
    let submission_id = args
        .get_one::<String>("submission_id")
        .expect("submission_id is required");

    notarizer.wait_on_notarization_and_fetch_log(submission_id, wait_duration)?;

    Ok(())
}

src/notarization.rs (line 349)

    fn upload_s3_and_maybe_wait(
        &self,
        submission: notary_api::NewSubmissionResponse,
        upload_data: UploadKind,
        wait_limit: Option<Duration>,
    ) -> Result<NotarizationUpload, AppleCodesignError> {
        self.upload_s3_package(&submission, upload_data)?;

        let status = if let Some(wait_limit) = wait_limit {
            self.wait_on_notarization_and_fetch_log(&submission.data.id, wait_limit)?
        } else {
            return Ok(NotarizationUpload::UploadId(submission.data.id));
        };

        // Make sure notarization was successful.
        let status = status.into_result()?;

        Ok(NotarizationUpload::NotaryResponse(status))
    }

Trait Implementations

impl Clone for Notarizer

fn clone(&self) -> Notarizer

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.