anchore / quill

Simple mac binary signing from any platform
Apache License 2.0
312 stars 13 forks source link

App specific passwords not possible? #372

Open NorseGaud opened 5 months ago

NorseGaud commented 5 months ago

We need to use app specific passwords with Team ID (https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool#App-specific-password). We do not have App Store applications to notarize and just notarize binaries.

Is this supported? I see TeamID is not according to https://github.com/anchore/quill/issues/147.

If not, this is extremely important as almost every one of our projects are just golang binaries that need signing and notarization to be distributed on github for example, Quill is the perfect solution for this if it supports app specific password/team ID.

Our current scripts (which run on mac) are as follows:

  1. codesign --sign "Developer ID Application" --force -o runtime --timestamp "$BINARY"
  2. run notarytool submit
    if ! INFO=$(xcrun notarytool submit --team-id TTXXXXXX --apple-id "${NOTARIZE_USERNAME}" --password "${NOTARIZE_PASSWORD}" --wait "$TEMP"); then
    echo "problem with notarization command -- run manually to determine failure reason"
    exit 3
    fi
kzantow commented 1 day ago

Hey @NorseGaud -- we're not opposed to making some of these changes, but we simply don't have a way to test them to validate that anything we do actually works, since there are some specifics needed for the Apple accounts. If someone is interested in contributing this, we can certainly help to get these changes in.

NorseGaud commented 1 day ago

@kzantow , I have since moved on from quill due to the lack of reply. It's up to your what you want to do here.