recipes/engine_v2/signer.py - recipes - Git at Google

 # Copyright 2022 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.

 # Recipe that executes apple code signing on a mac bot.
 #
 # This recipe receives as properties the list of google cloud bucket paths
 # of engine artifacts, and reads code sign related passwords from
 # kms securely. The engine artifact bucket paths and codesign credentials
 # are then supplied to a codesign standalone app, which communicates with
 # Apple notary server to finish code signing. The codesign standalone app
 # is run as a cipd package, and the codesigned artifacts are uploaded back
 # to the same google cloud bucket path.

 DEPS = [
     'depot_tools/gsutil',
     'flutter/archives',
     'flutter/flutter_deps',
     'recipe_engine/context',
     'recipe_engine/futures',
     'flutter/kms',
     'flutter/osx_sdk',
     'recipe_engine/file',
     'recipe_engine/path',
     'recipe_engine/platform',
     'recipe_engine/properties',
     'recipe_engine/raw_io',
     'recipe_engine/step',
 ]


 def RunSteps(api):
   if not api.platform.is_mac:
     pass

   # Install dependencies for code sign.
   env = {}
   env_prefixes = {}
   with api.step.nest('Dependencies'):
     codesign_path = api.flutter_deps.codesign(env, env_prefixes)

   secrets_dict = {
       'FLUTTER_P12': 'flutter_p12.encrypted',
       'FLUTTER_P12_PASSWORD': 'p12_password.encrypted',
       'CODESIGN_TEAM_ID': 'codesign_team_id.encrypted',
       'CODESIGN_APP_SPECIFIC_PASSWORD':
         'codesign_app_specific_password.encrypted',
       'CODESIGN_APP_STORE_ID': 'codesign_app_store_id.encrypted'
   }

   api.kms.decrypt_secrets(env, secrets_dict)

   env['CODESIGN_PATH'] = codesign_path

   try:
     KeychainSetup(api, env, env_prefixes)

     SignerBuilds(
         api, codesign_path, env, env_prefixes
     )

   finally:
     KeychainCleanup(api)


 def KeychainSetup(api, env, env_prefixes):
   """KeychainSetup adds flutter .p12 to a temporary keychain named 'build'.

   Args:
       codesign_path (str): path of codesign cipd package.
       p12_filepath (str) : path of the .p12 file that has flutter credentials.
       p12_password_raw (str) : the password to decode the .p12 flutter file.
   """
   api.step(
       'delete previous keychain',
       ['security', 'delete-keychain', 'build.keychain'],
       ok_ret='any'
   )
   api.step(
       'create keychain',
       ['security', 'create-keychain', '-p', '', 'build.keychain']
   )
   api.step(
       'default keychain',
       ['security', 'default-keychain', '-s', 'build.keychain']
   )
   api.step(
       'unlock build keychain',
       ['security', 'unlock-keychain', '-p', '', 'build.keychain']
   )
   ImportCertificate(api, env, env_prefixes)
   api.step(
       'set key partition list', [
           'security', 'set-key-partition-list', '-S',
           'apple-tool:,apple:,codesign:', '-s', '-k', '', 'build.keychain'
       ]
   )
   show_identities_step = api.step(
       'show-identities', ['security', 'find-identity', '-v'],
       ok_ret='any',
       stdout=api.raw_io.output_text(),
       stderr=api.raw_io.output_text()
   )
   flutter_identity_name = 'FLUTTER.IO LLC'
   if flutter_identity_name not in show_identities_step.stdout:
     raise ValueError(
         'identities are %s, does not include flutter identity' %
         (show_identities_step.stdout)
     )


 def ImportCertificate(api, env, env_prefixes):
   """Import flutter codesign identity into keychain.

   This function triggers a shell script that supplies p12 password,
   and grants codesign cipd and system codesign the correct access controls.
   The p12 password is hidden from stdout.

   Args:
       env (dict): environment variables.
       env_prefixes (dict) : environment paths.
   """
   resource_name = api.resource('import_certificate.sh')
   api.step(
       'Set execute permission',
       ['chmod', '755', resource_name],
       infra_step=True,
   )
   # Only filepath with a .p12 suffix will be recognized.
   p12_suffix_filepath = api.path['cleanup'].join('flutter.p12')
   env['P12_SUFFIX_FILEPATH'] = p12_suffix_filepath
   with api.context(env=env, env_prefixes=env_prefixes):
     api.step('import certificate', [resource_name])


 def SignerBuilds(
     api, codesign_path, env, env_prefixes
 ):
   """Concurrently creates jobs to codesign each binary.

   Args:
       codesign_path (str): path of codesign cipd package.
       env (dict): environment variables.
       env_prefixes (dict) : environment paths.
   """
   # The list is iterated running one signer tool command per file. This can be
   # optimized using the multiprocessing API.
   final_sources_list = api.properties.get('signing_file_list', [])

   # keep track of the output zip files in separate temp folders to avoid name
   # conflicts
   output_zips = {}

   codesign_string_path = "%s" % codesign_path
   app_specific_password_filepath = env['CODESIGN_APP_SPECIFIC_PASSWORD']
   appstore_id_filepath = env['CODESIGN_APP_STORE_ID']
   team_id_filepath = env['CODESIGN_TEAM_ID']
   signer_builds = []
   with api.osx_sdk('ios'):
     for source_path in final_sources_list:
       input_tmp_folder = api.path.mkdtemp()
       _, artifact_base_name = api.path.split(source_path)
       local_zip_path = input_tmp_folder.join('unsigned_%s' % artifact_base_name)
       local_zip_string_path = str(local_zip_path)

       output_zip_path = input_tmp_folder.join(artifact_base_name)
       output_zip_string_path = str(output_zip_path)
       output_zips[source_path] = output_zip_string_path
       api.archives.download(source_path, local_zip_path)
       signer_builds.append(
           api.futures.spawn(
               RunSignerToolCommand, api, env, env_prefixes,
               local_zip_string_path, output_zip_string_path,
               app_specific_password_filepath, appstore_id_filepath,
               team_id_filepath, codesign_string_path
           )
       )

     futures = api.futures.wait(signer_builds)
     for future in futures:
       future.result()

   for source_path, output_zip_path in output_zips.items():
     api.archives.upload_artifact(src=output_zip_path, dst=source_path)


 def RunSignerToolCommand(
     api, env, env_prefixes, input_zip_string_path, output_zip_string_path,
     app_specific_password_filepath, appstore_id_filepath, team_id_filepath,
     codesign_string_path
 ):
   """Runs code sign standalone app.

   Args:
       input_zip_string_path (str): path of the unsigned artifact in the file system.
       output_zip_string_path (str): path of the signed artifact in the file system.
       app_specific_password_filepath (str) : path of app specific password, one of
       the code sign credentials.
       appstore_id_filepath (str) : path of apple store id, one of the codesign
       credentials.
       team_id_filepath (str) : path of flutter team id used for codesign, one of the
       codesign credentials.
       codesign_string_path (str): the absolute path of the codesign standalone app
       cipd package. This is to differentiate codesign cipd from mac system codesign.
   """
   flutter_certificate_name = 'FLUTTER.IO LLC'
   api.step(
       'unlock build keychain',
       ['security', 'unlock-keychain', '-p', '', 'build.keychain']
   )
   with api.context(env=env, env_prefixes=env_prefixes):
     api.step(
         'codesign Apple engine binaries',
         [
             codesign_string_path,
             '--codesign-cert-name',
             flutter_certificate_name,
             '--no-dryrun',
             '--app-specific-password-file-path',
             app_specific_password_filepath,
             '--codesign-appstore-id-file-path',
             appstore_id_filepath,
             '--codesign-team-id-file-path',
             team_id_filepath,
             '--input-zip-file-path',
             input_zip_string_path,
             '--output-zip-file-path',
             output_zip_string_path,
         ],
     )


 def KeychainCleanup(api):
   """Clean up temporary keychain used in codesign process."""
   api.step('delete keychain', ['security', 'delete-keychain', 'build.keychain'])
   api.step(
       'restore default keychain',
       ['security', 'default-keychain', '-s', 'login.keychain']
   )


 def GenTests(api):

   yield api.test(
       'config_from_file',
       api.properties(
           dependencies=[{
               'dependency': 'codesign',
               'version': 'latest',
           }],
           signing_file_list=["gs://a/b/c/artifact.zip"]
       ),
       api.step_data(
           'show-identities',
           stdout=api.raw_io.output_text(
               '1) ABCD "Developer ID Application: FLUTTER.IO LLC (ABCD)"'
           )
       ),
   )

   yield api.test(
       'import_flutter_identity_failure',
       api.properties(
           dependencies=[{
               'dependency': 'codesign',
               'version': 'latest',
           }],
           signing_file_list=["gs://a/b/c/artifact.zip"]
       ),
       api.expect_exception('ValueError'),
   )
	# Copyright 2022 The Chromium Authors. All rights reserved.
	# Use of this source code is governed by a BSD-style license that can be
	# found in the LICENSE file.

	# Recipe that executes apple code signing on a mac bot.
	#
	# This recipe receives as properties the list of google cloud bucket paths
	# of engine artifacts, and reads code sign related passwords from
	# kms securely. The engine artifact bucket paths and codesign credentials
	# are then supplied to a codesign standalone app, which communicates with
	# Apple notary server to finish code signing. The codesign standalone app
	# is run as a cipd package, and the codesigned artifacts are uploaded back
	# to the same google cloud bucket path.

	DEPS = [
	'depot_tools/gsutil',
	'flutter/archives',
	'flutter/flutter_deps',
	'recipe_engine/context',
	'recipe_engine/futures',
	'flutter/kms',
	'flutter/osx_sdk',
	'recipe_engine/file',
	'recipe_engine/path',
	'recipe_engine/platform',
	'recipe_engine/properties',
	'recipe_engine/raw_io',
	'recipe_engine/step',
	]


	def RunSteps(api):
	if not api.platform.is_mac:
	pass

	# Install dependencies for code sign.
	env = {}
	env_prefixes = {}
	with api.step.nest('Dependencies'):
	codesign_path = api.flutter_deps.codesign(env, env_prefixes)

	secrets_dict = {
	'FLUTTER_P12': 'flutter_p12.encrypted',
	'FLUTTER_P12_PASSWORD': 'p12_password.encrypted',
	'CODESIGN_TEAM_ID': 'codesign_team_id.encrypted',
	'CODESIGN_APP_SPECIFIC_PASSWORD':
	'codesign_app_specific_password.encrypted',
	'CODESIGN_APP_STORE_ID': 'codesign_app_store_id.encrypted'
	}

	api.kms.decrypt_secrets(env, secrets_dict)

	env['CODESIGN_PATH'] = codesign_path

	try:
	KeychainSetup(api, env, env_prefixes)

	SignerBuilds(
	api, codesign_path, env, env_prefixes
	)

	finally:
	KeychainCleanup(api)


	def KeychainSetup(api, env, env_prefixes):
	"""KeychainSetup adds flutter .p12 to a temporary keychain named 'build'.

	Args:
	codesign_path (str): path of codesign cipd package.
	p12_filepath (str) : path of the .p12 file that has flutter credentials.
	p12_password_raw (str) : the password to decode the .p12 flutter file.
	"""
	api.step(
	'delete previous keychain',
	['security', 'delete-keychain', 'build.keychain'],
	ok_ret='any'
	)
	api.step(
	'create keychain',
	['security', 'create-keychain', '-p', '', 'build.keychain']
	)
	api.step(
	'default keychain',
	['security', 'default-keychain', '-s', 'build.keychain']
	)
	api.step(
	'unlock build keychain',
	['security', 'unlock-keychain', '-p', '', 'build.keychain']
	)
	ImportCertificate(api, env, env_prefixes)
	api.step(
	'set key partition list', [
	'security', 'set-key-partition-list', '-S',
	'apple-tool:,apple:,codesign:', '-s', '-k', '', 'build.keychain'
	]
	)
	show_identities_step = api.step(
	'show-identities', ['security', 'find-identity', '-v'],
	ok_ret='any',
	stdout=api.raw_io.output_text(),
	stderr=api.raw_io.output_text()
	)
	flutter_identity_name = 'FLUTTER.IO LLC'
	if flutter_identity_name not in show_identities_step.stdout:
	raise ValueError(
	'identities are %s, does not include flutter identity' %
	(show_identities_step.stdout)
	)


	def ImportCertificate(api, env, env_prefixes):
	"""Import flutter codesign identity into keychain.

	This function triggers a shell script that supplies p12 password,
	and grants codesign cipd and system codesign the correct access controls.
	The p12 password is hidden from stdout.

	Args:
	env (dict): environment variables.
	env_prefixes (dict) : environment paths.
	"""
	resource_name = api.resource('import_certificate.sh')
	api.step(
	'Set execute permission',
	['chmod', '755', resource_name],
	infra_step=True,
	)
	# Only filepath with a .p12 suffix will be recognized.
	p12_suffix_filepath = api.path['cleanup'].join('flutter.p12')
	env['P12_SUFFIX_FILEPATH'] = p12_suffix_filepath
	with api.context(env=env, env_prefixes=env_prefixes):
	api.step('import certificate', [resource_name])


	def SignerBuilds(
	api, codesign_path, env, env_prefixes
	):
	"""Concurrently creates jobs to codesign each binary.

	Args:
	codesign_path (str): path of codesign cipd package.
	env (dict): environment variables.
	env_prefixes (dict) : environment paths.
	"""
	# The list is iterated running one signer tool command per file. This can be
	# optimized using the multiprocessing API.
	final_sources_list = api.properties.get('signing_file_list', [])

	# keep track of the output zip files in separate temp folders to avoid name
	# conflicts
	output_zips = {}

	codesign_string_path = "%s" % codesign_path
	app_specific_password_filepath = env['CODESIGN_APP_SPECIFIC_PASSWORD']
	appstore_id_filepath = env['CODESIGN_APP_STORE_ID']
	team_id_filepath = env['CODESIGN_TEAM_ID']
	signer_builds = []
	with api.osx_sdk('ios'):
	for source_path in final_sources_list:
	input_tmp_folder = api.path.mkdtemp()
	_, artifact_base_name = api.path.split(source_path)
	local_zip_path = input_tmp_folder.join('unsigned_%s' % artifact_base_name)
	local_zip_string_path = str(local_zip_path)

	output_zip_path = input_tmp_folder.join(artifact_base_name)
	output_zip_string_path = str(output_zip_path)
	output_zips[source_path] = output_zip_string_path
	api.archives.download(source_path, local_zip_path)
	signer_builds.append(
	api.futures.spawn(
	RunSignerToolCommand, api, env, env_prefixes,
	local_zip_string_path, output_zip_string_path,
	app_specific_password_filepath, appstore_id_filepath,
	team_id_filepath, codesign_string_path
	)
	)

	futures = api.futures.wait(signer_builds)
	for future in futures:
	future.result()

	for source_path, output_zip_path in output_zips.items():
	api.archives.upload_artifact(src=output_zip_path, dst=source_path)


	def RunSignerToolCommand(
	api, env, env_prefixes, input_zip_string_path, output_zip_string_path,
	app_specific_password_filepath, appstore_id_filepath, team_id_filepath,
	codesign_string_path
	):
	"""Runs code sign standalone app.

	Args:
	input_zip_string_path (str): path of the unsigned artifact in the file system.
	output_zip_string_path (str): path of the signed artifact in the file system.
	app_specific_password_filepath (str) : path of app specific password, one of
	the code sign credentials.
	appstore_id_filepath (str) : path of apple store id, one of the codesign
	credentials.
	team_id_filepath (str) : path of flutter team id used for codesign, one of the
	codesign credentials.
	codesign_string_path (str): the absolute path of the codesign standalone app
	cipd package. This is to differentiate codesign cipd from mac system codesign.
	"""
	flutter_certificate_name = 'FLUTTER.IO LLC'
	api.step(
	'unlock build keychain',
	['security', 'unlock-keychain', '-p', '', 'build.keychain']
	)
	with api.context(env=env, env_prefixes=env_prefixes):
	api.step(
	'codesign Apple engine binaries',
	[
	codesign_string_path,
	'--codesign-cert-name',
	flutter_certificate_name,
	'--no-dryrun',
	'--app-specific-password-file-path',
	app_specific_password_filepath,
	'--codesign-appstore-id-file-path',
	appstore_id_filepath,
	'--codesign-team-id-file-path',
	team_id_filepath,
	'--input-zip-file-path',
	input_zip_string_path,
	'--output-zip-file-path',
	output_zip_string_path,
	],
	)


	def KeychainCleanup(api):
	"""Clean up temporary keychain used in codesign process."""
	api.step('delete keychain', ['security', 'delete-keychain', 'build.keychain'])
	api.step(
	'restore default keychain',
	['security', 'default-keychain', '-s', 'login.keychain']
	)


	def GenTests(api):

	yield api.test(
	'config_from_file',
	api.properties(
	dependencies=[{
	'dependency': 'codesign',
	'version': 'latest',
	}],
	signing_file_list=["gs://a/b/c/artifact.zip"]
	),
	api.step_data(
	'show-identities',
	stdout=api.raw_io.output_text(
	'1) ABCD "Developer ID Application: FLUTTER.IO LLC (ABCD)"'
	)
	),
	)

	yield api.test(
	'import_flutter_identity_failure',
	api.properties(
	dependencies=[{
	'dependency': 'codesign',
	'version': 'latest',
	}],
	signing_file_list=["gs://a/b/c/artifact.zip"]
	),
	api.expect_exception('ValueError'),
	)