diff --git a/.github/workflows/build_python_3.9.10.yml b/.github/workflows/build_python_3.9.10.yml index 4c7ed3b..955cf38 100644 --- a/.github/workflows/build_python_3.9.10.yml +++ b/.github/workflows/build_python_3.9.10.yml @@ -33,6 +33,8 @@ jobs: p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} - name: Run build package script + env: + NOTARY_PASS: ${{ secrets.NOTARY_PASS }} run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_ID" "$PYTHON_VERSION" "${BUILD_DATE}" - name: Create Release diff --git a/README.md b/README.md index 4ea1c12..4e5e92f 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ Downgrades will not be supported by this repository. ### pip While `pip` is bundled in this framework, it is **not recommended** to install any external libraries into your frameworks folder outside of what comes with the package. If you need to use or test external libraries not present in the package, it is recommended to use a [virtual environment](https://docs.python.org/3/library/venv.html) or a tool like [pyenv](https://github.com/pyenv/pyenv). -Pull requests can be issued to the `opinionated` or `recommended` packages, but more scrutiny will be applied to the `recommended` package. +Pull requests can and are encouraged to be issued to the `recommended` packages requirements file. # Flavors of Python We currently offer four versions of Python. You can chose which version suits your needs. @@ -71,16 +71,6 @@ Tools that should work when using the "Recommended Flavor": - [Nudge](https://github.com/macadmins/nudge) - [UMAD](https://github.com/macadmins/umad) -## Opinionated -This is a Python.framework that contains everything from "Recommended", and libraries that various open source projects require. - -This is a **kitchen sink** approach, opting for the latest known packages. - -Tools that should work when using the "Opinionated Flavor": -- [Gusto's AutoPkg promotion tool](https://github.com/Gusto/it-cpe-opensource/tree/master/autopromote) -- [Munki CloudFront Middleware](https://github.com/AaronBurchfield/CloudFront-Middleware) -- [Python-jss](https://github.com/jssimporter/python-jss) - # Updating packages This should be done in a clean virtual environment. After every Python package install, you can run `pip freeze | xargs pip uninstall -y` to cleanup the environment. diff --git a/build_python_framework_pkgs.zsh b/build_python_framework_pkgs.zsh index b78e509..ad70049 100755 --- a/build_python_framework_pkgs.zsh +++ b/build_python_framework_pkgs.zsh @@ -18,6 +18,10 @@ RP_BINDIR="/tmp/relocatable-python" MP_BINDIR="/tmp/munki-pkg" CONSOLEUSER=$(/usr/bin/stat -f "%Su" /dev/console) PIPCACHEDIR="/Users/${CONSOLEUSER}/Library/Caches/pip" +# NOTARY_PASS="" # Store as a repo secret +XCODE_PATH="/Applications/Xcode_13.2.1.app" +XCODE_NOTARY_PATH="$XCODE_PATH/Contents/Developer/usr/bin/notarytool" +XCODE_STAPLER_PATH="$XCODE_PATH/Contents/Developer/usr/bin/stapler" # Sanity Checks ## Type Check @@ -73,6 +77,9 @@ RP_ZIP="/tmp/relocatable-python.zip" MP_ZIP="/tmp/munki-pkg.zip" echo "Creating Python Framework - $TYPE" +# Setup notary item +$XCODE_NOTARY_PATH store-credentials --apple-id "macadmins@cleverdevops.com" --team-id "9GQZ7KUFR6" --password "$NOTARY_PASS" macadminpython + # Create framework path if not present with 777 so sudo is not needed if [ ! -d "${FRAMEWORKDIR}" ]; then /usr/bin/sudo /bin/mkdir -m 777 -p "${FRAMEWORKDIR}" @@ -242,7 +249,11 @@ SIGNED_JSONFILE if [ "${PKG_RESULT}" != "0" ]; then echo "Could not sign package: ${PKG_RESULT}" 1>&2 else - # Move the signed pkg + # Notarize and staple the package + # If these fail, it will bail on the entire process + $XCODE_NOTARY_PATH submit "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" --keychain-profile "macadminpython" --wait + $XCODE_STAPLER_PATH staple "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" + # Move the signed + notarized pkg /bin/mv "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" "$OUTPUTSDIR" fi else