Add notarization (#37)

* Add notarization to build script

* Pass NOTARY_PASS secret as an env var to the build script

.github/workflows/build_python_3.9.10.yml

@@ -33,6 +33,8 @@ jobs:
         p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
 
     - name: Run build package script
+      env:
+        NOTARY_PASS: ${{ secrets.NOTARY_PASS }}
       run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_ID" "$PYTHON_VERSION" "${BUILD_DATE}"
 
     - name: Create Release

README.md

@@ -41,7 +41,7 @@ Downgrades will not be supported by this repository.
 ### pip
 While `pip` is bundled in this framework, it is **not recommended** to install any external libraries into your frameworks folder outside of what comes with the package. If you need to use or test external libraries not present in the package, it is recommended to use a [virtual environment](https://docs.python.org/3/library/venv.html) or a tool like [pyenv](https://github.com/pyenv/pyenv).
 
-Pull requests can be issued to the `opinionated` or `recommended` packages, but more scrutiny will be applied to the `recommended` package.
+Pull requests can and are encouraged to be issued to the `recommended` packages requirements file.
 
 # Flavors of Python
 We currently offer four versions of Python. You can chose which version suits your needs.
@@ -71,16 +71,6 @@ Tools that should work when using the "Recommended Flavor":
 - [Nudge](https://github.com/macadmins/nudge)
 - [UMAD](https://github.com/macadmins/umad)
 
-## Opinionated
-This is a Python.framework that contains everything from "Recommended", and libraries that various open source projects require.
-
-This is a **kitchen sink** approach, opting for the latest known packages.
-
-Tools that should work when using the "Opinionated Flavor":
-- [Gusto's AutoPkg promotion tool](https://github.com/Gusto/it-cpe-opensource/tree/master/autopromote)
-- [Munki CloudFront Middleware](https://github.com/AaronBurchfield/CloudFront-Middleware)
-- [Python-jss](https://github.com/jssimporter/python-jss)
-
 # Updating packages
 This should be done in a clean virtual environment. After every Python package install, you can run `pip freeze | xargs pip uninstall -y` to cleanup the environment.
 

build_python_framework_pkgs.zsh

@@ -18,6 +18,10 @@ RP_BINDIR="/tmp/relocatable-python"
 MP_BINDIR="/tmp/munki-pkg"
 CONSOLEUSER=$(/usr/bin/stat -f "%Su" /dev/console)
 PIPCACHEDIR="/Users/${CONSOLEUSER}/Library/Caches/pip"
+# NOTARY_PASS="" # Store as a repo secret
+XCODE_PATH="/Applications/Xcode_13.2.1.app"
+XCODE_NOTARY_PATH="$XCODE_PATH/Contents/Developer/usr/bin/notarytool"
+XCODE_STAPLER_PATH="$XCODE_PATH/Contents/Developer/usr/bin/stapler"
 
 # Sanity Checks
 ## Type Check
@@ -73,6 +77,9 @@ RP_ZIP="/tmp/relocatable-python.zip"
 MP_ZIP="/tmp/munki-pkg.zip"
 echo "Creating Python Framework - $TYPE"
 
+# Setup notary item
+$XCODE_NOTARY_PATH store-credentials --apple-id "macadmins@cleverdevops.com" --team-id "9GQZ7KUFR6" --password "$NOTARY_PASS" macadminpython
+
 # Create framework path if not present with 777 so sudo is not needed
 if [ ! -d "${FRAMEWORKDIR}" ]; then
     /usr/bin/sudo /bin/mkdir -m 777 -p "${FRAMEWORKDIR}"
@@ -242,7 +249,11 @@ SIGNED_JSONFILE
   if [ "${PKG_RESULT}" != "0" ]; then
     echo "Could not sign package: ${PKG_RESULT}" 1>&2
   else
-    # Move the signed pkg
+    # Notarize and staple the package
+    # If these fail, it will bail on the entire process
+    $XCODE_NOTARY_PATH submit "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" --keychain-profile "macadminpython" --wait
+    $XCODE_STAPLER_PATH staple "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg"
+    # Move the signed + notarized pkg
     /bin/mv "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" "$OUTPUTSDIR"
   fi
 else