recipes/engine_v2/signer.py

# Copyright 2022 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Recipe that executes apple code signing on a code signing bot. A code
# signing bot is a machine with flutter certificates and signing related
# set ups.
#
# This recipe receives as properties the list of google cloud bucket paths
# of engine artifacts, and reads code sign related passwords from
# kms securely. The engine artifact bucket paths and codesign credentials
# are then supplied to a codesign standalone app, which communicates with
# Apple notary server to finish code signing. The codesign standalone app
# is run as a cipd package, and the codesigned artifacts are uploaded back
# to the same google cloud bucket path.

DEPS = [
    'depot_tools/gsutil',
    'flutter/archives',
    'flutter/flutter_deps',
    'recipe_engine/context',
    'recipe_engine/futures',
    'flutter/kms',
    'flutter/osx_sdk',
    'recipe_engine/file',
    'recipe_engine/path',
    'recipe_engine/platform',
    'recipe_engine/properties',
    'recipe_engine/step',
]


def RunSteps(api):
  if not api.platform.is_mac:
    pass

  # Installing dependencies for code sign.
  env = {}
  env_prefixes = {}
  with api.step.nest('Dependencies'):
    codesign_path = api.flutter_deps.codesign(env, env_prefixes)

  # The list is iterated running one signer tool command per file. This can be
  # optimized using the multiprocessing API.
  final_sources_list = api.properties.get('signing_file_list', [])
  signer_builds = []
  codesign_dir = api.path.mkdtemp()
  app_specific_password_filepath = codesign_dir.join(
      'codesign_app_specific_password.encrypted'
  )
  appstore_id_filepath = codesign_dir.join('codesign_app_store_id.encrypted')
  team_id_filepath = codesign_dir.join('codesign_team_id.encrypted')
  api.kms.get_secret('codesign_team_id.encrypted', team_id_filepath)
  api.kms.get_secret(
      'codesign_app_specific_password.encrypted', app_specific_password_filepath
  )
  api.kms.get_secret('codesign_app_store_id.encrypted', appstore_id_filepath)

  # unlock keychain
  with api.context(env=env, env_prefixes=env_prefixes):
    resource_name = api.resource('runner.sh')
    api.step('Set execute permission', ['chmod', '755', resource_name])
    cmd = ['bash', resource_name]
    api.step('unlock keychain', cmd)

  # keep track of the output zip files in separate temp folders to avoid name conflicts
  output_zips = {}

  codesign_string_path = "%s" % codesign_path
  with api.osx_sdk('ios'):
    for source_path in final_sources_list:
      input_tmp_folder = api.path.mkdtemp()
      _, artifact_base_name = api.path.split(source_path) 
      local_zip_path = input_tmp_folder.join('unsigned_%s' % artifact_base_name)
      local_zip_string_path = str(local_zip_path)

      output_zip_path = input_tmp_folder.join(artifact_base_name)
      output_zip_string_path = str(output_zip_path)
      output_zips[source_path] = output_zip_string_path
      api.archives.download(source_path, local_zip_path)
      signer_builds.append(
          api.futures.spawn(
              RunSignerToolCommand, api, env, env_prefixes,
              local_zip_string_path, output_zip_string_path,
              app_specific_password_filepath, appstore_id_filepath,
              team_id_filepath, codesign_string_path
          )
      )

    futures = api.futures.wait(signer_builds)
    for future in futures:
      future.result()

  for source_path, output_zip_path in output_zips.items():
    api.archives.upload_artifact(src=output_zip_path, dst=source_path)

def RunSignerToolCommand(
    api, env, env_prefixes, input_zip_string_path, output_zip_string_path,
    app_specific_password_filepath, appstore_id_filepath, team_id_filepath,
    codesign_string_path
):
  """Runs code sign standalone app.

  Args:
      input_zip_string_path (str): path of the unsigned artifact in the file system.
      output_zip_string_path (str): path of the signed artifact in the file system.
      app_specific_password_filepath (str) : path of app specific password, one of
      the code sign credentials.
      appstore_id_filepath (str) : path of apple store id, one of the codesign
      credentials.
      team_id_filepath (str) : path of flutter team id used for codesign, one of the
      codesign credentials.
      codesign_string_path (str): the absolute path of the codesign standalone app
      cipd package. This is to differentiate codesign cipd from mac system codesign.
  """
  flutter_certificate_name = 'FLUTTER.IO LLC'
  with api.context(env=env, env_prefixes=env_prefixes):
    api.step(
        'codesign Apple engine binaries',
        [
            codesign_string_path,
            '--codesign-cert-name',
            flutter_certificate_name,
            '--no-dryrun',
            '--app-specific-password-file-path',
            app_specific_password_filepath,
            '--codesign-appstore-id-file-path',
            appstore_id_filepath,
            '--codesign-team-id-file-path',
            team_id_filepath,
            '--input-zip-file-path',
            input_zip_string_path,
            '--output-zip-file-path',
            output_zip_string_path,
        ],
    )


def GenTests(api):

  yield api.test(
      'config_from_file',
      api.properties(
          dependencies=[{
              'dependency': 'codesign',
              'version': 'latest',
          }],
          signing_file_list=["gs://a/b/c/artifact.zip"]
      )
  )