nucleic/nucleic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update provisioning system

Browse Source
This commit is contained in:
abkslm
2026-07-12 17:30:55 -07:00
parent b4dc244bd4
commit 0951907fd7
3 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/package-app.sh
+16 -4
View File
@@ -28,9 +28,8 @@
# NUCLEIC_BUILD build number / CFBundleVersion (default: ./VERSION, else git commit count)
# NUCLEIC_SIGN_ID codesign identity (default: "-", ad-hoc). Set to a Developer ID
# to sign for distribution (notarization/TestFlight is separate).
# NUCLEIC_PROVISIONING_PROFILE Developer ID .provisionprofile authorizing every desktop
# channel plus L7UDTQ6F5W.xyz.blakeslee.nucleic. Required with a real identity;
# defaults to signing/nucleic.provisionprofile (untracked).
# NUCLEIC_PROVISIONING_PROFILE Developer ID .provisionprofile for this channel. Required with
# a real identity; overrides the channel-specific profile in signing/.
#
# An app icon is picked up automatically. Two formats, in priority order:
# • Resources/AppIcon.icon — Icon Composer package (macOS 26 Liquid Glass). Carries the
@@ -62,7 +61,20 @@ cd "$ROOT"
# Fail before the expensive Swift build when a distribution signature cannot be provisioned.
if [ "$SIGN_ID" != "-" ]; then
PROFILE="${NUCLEIC_PROVISIONING_PROFILE:-$ROOT/signing/nucleic.provisionprofile}"
if [ -n "${NUCLEIC_PROVISIONING_PROFILE:-}" ]; then
PROFILE="$NUCLEIC_PROVISIONING_PROFILE"
else
case "$CHANNEL" in
canary) PROFILE="$ROOT/signing/Nucleic_Desktop_Canary__Provisioning.provisionprofile" ;;
beta) PROFILE="$ROOT/signing/Nucleic_Desktop_Beta__Provisioning.provisionprofile" ;;
rc) PROFILE="$ROOT/signing/Nucleic_Desktop_RC__Provisioning.provisionprofile" ;;
stable) PROFILE="$ROOT/signing/Nucleic_Desktop_Release__Provisioning.provisionprofile" ;;
dev)
echo "no default Developer ID provisioning profile for the dev channel; set NUCLEIC_PROVISIONING_PROFILE" >&2
exit 1
;;
esac
fi
"$ROOT/scripts/validate-macos-profile.sh" \
"$PROFILE" "$BUNDLE_ID" "L7UDTQ6F5W.xyz.blakeslee.nucleic" "L7UDTQ6F5W"
fi
scripts/release-macos.sh
+1 -1
View File
@@ -21,7 +21,7 @@
# Env:
# NUCLEIC_SIGN_ID signing identity (default: auto-detect Developer ID Application)
# NUCLEIC_PROVISIONING_PROFILE Developer ID profile authorizing the desktop App ID and shared
# Keychain group (default: signing/nucleic.provisionprofile)
# Keychain group (default: channel-specific profile in signing/)
# NUCLEIC_BUMP semver bump: minor (default; build on canary/dev) | major | patch | build (build = build number only)
# NUCLEIC_VERSION_COMMIT commit the ./VERSION bump on success (default 1; 0 leaves it unstaged)
# NUCLEIC_VERSION pin the marketing version (overrides ./VERSION; forwarded to package-app.sh)
signing/README.md
+13 -5
View File
@@ -26,11 +26,19 @@ keychain — it's unrelated to distribution and isn't used by any of this.)
(Optionally **Developer ID Installer** if you ever ship a `.pkg` instead of a DMG.)
> `com.apple.security.virtualization` is unrestricted and needs no provisioning profile. In
> contrast, Apple requires a provisioning profile to authorize `keychain-access-groups`. Register a
> macOS App ID (a wildcard covering `xyz.blakeslee.nucleic.desktop.*` is convenient), enable Keychain
> Sharing for `L7UDTQ6F5W.xyz.blakeslee.nucleic`, create a Developer ID provisioning profile, and save
> it as `signing/nucleic.provisionprofile` (untracked) or set `NUCLEIC_PROVISIONING_PROFILE`. Packaging
> validates the team, bundle-ID pattern, and group before signing, then embeds it at
> contrast, Apple requires a provisioning profile to authorize `keychain-access-groups`. Register
> one explicit macOS App ID for each desktop release bundle ID, then create the corresponding
> Developer ID provisioning profiles. Keychain Sharing is represented by the checked-in entitlement;
> it is not a service selected while registering the App IDs. Save the untracked profiles as:
>
> - `signing/Nucleic_Desktop_Canary__Provisioning.provisionprofile`
> - `signing/Nucleic_Desktop_Beta__Provisioning.provisionprofile`
> - `signing/Nucleic_Desktop_RC__Provisioning.provisionprofile`
> - `signing/Nucleic_Desktop_Release__Provisioning.provisionprofile`
>
> Packaging automatically selects the profile matching the release channel. Set
> `NUCLEIC_PROVISIONING_PROFILE` only to override that selection. Packaging validates the team,
> exact bundle ID, and shared group before signing, then embeds the selected profile at
> `Contents/embedded.provisionprofile`. This is required so Nucleic can read its own data-protection-
> Keychain items silently across updates. `com.apple.vm.networking` remains deliberately absent.