mitts 0.3.21

Rust-first build and package tooling with a shared artifact cache
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

# Mitts Build — Developer ID and fail-closed notarization before release packaging.
# Copyright (c) 2026 Alexander Panasenko
# Contact: alex@prod.codes
# Author: https://prod.codes/about/
# Project: https://github.com/alex09x/mitts
# SPDX-License-Identifier: MIT OR Apache-2.0
import argparse
import hashlib
import json
import tarfile
import tempfile
import zipfile
from pathlib import Path

from apple_keychain import credentials, expected_team, run
from apple_verify import MAC_TARGETS, extract_archive, receipt_matches, signature
from assets import validate
from plan import stable_tag


def sign_release(source, output, evidence, tag, sha):
    tag = stable_tag(tag)
    validate(source, tag, sha)
    output.mkdir(parents=True, exist_ok=False)
    evidence.mkdir(parents=True, exist_ok=False)
    team = expected_team()
    with tempfile.TemporaryDirectory(prefix="mitts-notary-payload-") as directory:
        root = Path(directory)
        binaries = {}
        metadata = {}
        for target in MAC_TARGETS:
            name = f"mitts-{tag}-{target}.tar.gz"
            metadata[target] = extract_archive(
                source / name, root / target, tag, sha, target
            )
            binaries[target] = root / target / "mitts"
        with credentials() as auth:
            cdhashes = {}
            for target, binary in binaries.items():
                run(
                    [
                        "codesign",
                        "--force",
                        "--sign",
                        auth["identity"],
                        "--keychain",
                        auth["keychain"],
                        "--identifier",
                        "com.mittsbuild.mitts",
                        "--options",
                        "runtime",
                        "--timestamp",
                        binary,
                    ]
                )
                cdhashes[target] = signature(binary, team)
            submission_zip = root / "submission.zip"
            # Exact allowlist: private P12/P8/keychain files are never in payload.
            with zipfile.ZipFile(submission_zip, "w", zipfile.ZIP_DEFLATED) as archive:
                for target, binary in binaries.items():
                    archive.write(binary, target + "/mitts")
            result = run(
                [
                    "xcrun",
                    "notarytool",
                    "submit",
                    submission_zip,
                    *auth["auth"],
                    "--wait",
                    "--timeout",
                    "20m",
                    "--output-format",
                    "json",
                ],
                timeout=1300,
            )
            submission = json.loads(result.stdout)
            if submission.get("status") != "Accepted":
                raise ValueError(
                    "Apple notarization was not Accepted; no release artifacts produced"
                )
            job = submission["id"]
            log_file = evidence / "apple-notary-log.json"
            run(
                ["xcrun", "notarytool", "log", job, *auth["auth"], log_file],
                timeout=120,
            )
            receipt = json.loads(log_file.read_text())
        zip_sha = hashlib.sha256(submission_zip.read_bytes()).hexdigest()
        for target, binary in binaries.items():
            receipt_matches(receipt, job, zip_sha, target, cdhashes[target])
            clean = [
                line
                for line in metadata[target].splitlines()
                if not line.startswith(
                    ("Signing-", "Signed-", "CodeDirectory-", "Notarization-")
                )
            ]
            clean += [
                f"Signing-Team: {team}",
                "Signed-Binary-SHA256: "
                + hashlib.sha256(binary.read_bytes()).hexdigest(),
                "CodeDirectory-Hash: " + cdhashes[target],
                "Notarization-ID: " + job,
                "Notarization-Status: Accepted",
                "Notarization-Receipt: " + json.dumps(receipt, separators=(",", ":")),
            ]
            (root / target / "BUILD.txt").write_text("\n".join(clean) + "\n")
            name = f"mitts-{tag}-{target}.tar.gz"
            archive = output / name
            with tarfile.open(archive, "w:gz") as content:
                for member in ["mitts", "BUILD.txt", "LICENSE-MIT", "LICENSE-APACHE"]:
                    content.add(root / target / member, arcname=member, recursive=False)
            (output / (name + ".sha256")).write_text(
                hashlib.sha256(archive.read_bytes()).hexdigest() + "  " + name + "\n"
            )
        (evidence / "submission.json").write_text(
            json.dumps(
                {
                    "id": job,
                    "status": "Accepted",
                    "source": sha,
                    "tag": tag,
                    "zip_sha256": zip_sha,
                },
                indent=2,
            )
            + "\n"
        )
    print(
        "Supported Mac binary signed and notarized Accepted; final archives/checksums produced"
    )


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("source", type=Path)
    parser.add_argument("output", type=Path)
    parser.add_argument("evidence", type=Path)
    parser.add_argument("tag")
    parser.add_argument("sha")
    args = parser.parse_args()
    sign_release(args.source, args.output, args.evidence, args.tag, args.sha)


if __name__ == "__main__":
    main()