mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
Ethan
e738ff5299
## Summary The macOS `.dylib` is only used by Coder Desktop macOS v0.7.2 or older. v0.7.2 was released in August 2025. v0.8.0 of Coder Desktop macOS, also released in August 2025, uses a signed Coder slim binary from the deployment instead. It's unlikely customers will be using Coder Desktop macOS v0.7.2 and the next release of Coder simultaneously, so I think we can safely remove this process, given it slows down CI & release processes. ## Changes - **Makefile**: Remove `DYLIB_ARCHES`, `CODER_DYLIBS` variables and `build/coder-dylib` target - **scripts/build_go.sh**: Remove `--dylib` flag and all dylib-specific logic (c-shared buildmode, CGO, plist embedding, vpn/dylib entrypoint) - **scripts/sign_darwin.sh**: Remove dylib-specific comment - **CI (ci.yaml)**: Remove `build-dylib` job, artifact download/insert steps, and `build-dylib` dependency from `build` job - **Release (release.yaml)**: Remove `build-dylib` job, artifact download/insert steps, and `build-dylib` dependency from `release` job - **vpn/dylib/**: Delete entire directory (`lib.go` + `info.plist.tmpl`) - **vpn/router.go, vpn/dns.go**: Clean up comments referencing dylib The slim and fat binary builds are completely unaffected — the dylib was an independent build target with its own CI job. _Generated by mux but reviewed by a human_
50 lines
1.5 KiB
Bash
Executable File
50 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# This script signs the provided darwin binary with an Apple Developer
|
|
# certificate.
|
|
#
|
|
# Usage: ./sign_darwin.sh path/to/binary binary_identifier
|
|
#
|
|
# On success, the input file will be signed using the Apple Developer
|
|
# certificate.
|
|
#
|
|
# For the Coder CLI, the binary_identifier should be "com.coder.cli".
|
|
#
|
|
# You can check if a binary is signed by running the following command on a Mac:
|
|
# codesign -dvv path/to/binary
|
|
#
|
|
# You can also run the following command to verify the signature on other
|
|
# systems, but it may be less accurate:
|
|
# rcodesign verify path/to/binary
|
|
#
|
|
# Depends on the rcodesign utility. Requires the following environment variables
|
|
# to be set:
|
|
# - $AC_CERTIFICATE_FILE: The path to the Apple Developer P12 certificate file.
|
|
# - $AC_CERTIFICATE_PASSWORD_FILE: The path to the file containing the password
|
|
# for the Apple Developer certificate.
|
|
|
|
set -euo pipefail
|
|
# shellcheck source=scripts/lib.sh
|
|
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
|
|
|
|
if [[ "$#" -lt 2 ]]; then
|
|
echo "Usage: $0 path/to/binary binary_identifier"
|
|
exit 1
|
|
fi
|
|
|
|
BINARY_PATH="$1"
|
|
BINARY_IDENTIFIER="$2"
|
|
|
|
# Check dependencies
|
|
dependencies rcodesign
|
|
requiredenvs AC_CERTIFICATE_FILE AC_CERTIFICATE_PASSWORD_FILE
|
|
|
|
# -v is quite verbose, the default output is pretty good on it's own.
|
|
rcodesign sign \
|
|
--binary-identifier "$BINARY_IDENTIFIER" \
|
|
--p12-file "$AC_CERTIFICATE_FILE" \
|
|
--p12-password-file "$AC_CERTIFICATE_PASSWORD_FILE" \
|
|
--code-signature-flags runtime \
|
|
"$BINARY_PATH" \
|
|
1>&2
|