|
3 | 3 | * [Adding firewall entries for Jenkins workers](#adding-firewall-entries-for-jenkins-workers) |
4 | 4 | * [`release-*` machines](#release--machines) |
5 | 5 | * [`release-*container*` machines](#release-container-machines) |
6 | | - * [macOS release machines](#macos-release-machines) |
7 | | - * [Full Xcode](#full-xcode) |
8 | | - * [Signing certificates](#signing-certificates) |
9 | | -* [macOS](#macos) |
10 | | - * [Install Command Line Tools for Xcode](#install-command-line-tools-for-xcode) |
11 | 6 | * [AIX](#aix) |
12 | 7 | * [Disk layout](#disk-layout) |
13 | 8 | * [OpenSSL](#openssl) |
@@ -99,107 +94,6 @@ Therefore, the above SSH configuration should take place in |
99 | 94 | 2. Enter the container using `docker exec <containerid> -ti bash` |
100 | 95 | 3. Run `ssh node-www date` (as above) |
101 | 96 |
|
102 | | -### macOS release machines |
103 | | - |
104 | | -Previous notes: [#1393](https://github.com/nodejs/build/issues/1393) |
105 | | - |
106 | | -#### Full Xcode |
107 | | - |
108 | | -Xcode Command-line tools are not enough to perform a full notarization cycle, full Xcode must be installed manually. |
109 | | - |
110 | | -As root: |
111 | | - |
112 | | -* Download Xcode: https://developer.apple.com/download/more/ - find non-beta version, open Developer Tools in browser, Networking tab, start download (then cancel), in Networking tab "Copy as cURL" (available in Chrome & FF) |
113 | | - * On OSX 11 we currently install 13.2.1 |
114 | | -* Download onto release machine using the copied curl command (may need `-o xcode.xip` appended to curl command) to `/tmp` |
115 | | - * If you have trouble on the command line, pasting into a shell script file can make pasting/editing to add -o xcode.xip easier |
116 | | -* Extract: `xip --expand xcode.xip` |
117 | | - * This takes a long time since xcode.xip is 7-10G in size depending on version |
118 | | - * If you run out of space you can delete `/Users/build/workspace/*` to free up some space. Also make sure that |
119 | | - if you are updating Xcode that you have removed any existing version of /Applications/Xcode.app. You may also |
120 | | - need to clear the ccache by running `sudo -s su - iojs` followed by `ccache --clear` |
121 | | -* Move `Xcode.app` directory to `/Applications` by running `mv Xcode.app /Applications/Xcode.app` |
122 | | -* `sudo xcode-select --switch /Applications/Xcode.app` |
123 | | -* `sudo xcodebuild -license` - accept license |
124 | | -* `git` - check that git is working (confirming license has been accepted) |
125 | | - |
126 | | -#### OSX Keychain Profile |
127 | | - |
128 | | -Create a keychain profile (`NODE_RELEASE_PROFILE`) for the release machine: |
129 | | - |
130 | | -```bash |
131 | | -sudo xcrun notarytool store-credentials NODE_RELEASE_PROFILE \ |
132 | | - --apple-id XXXX \ |
133 | | - --team-id XXXX \ |
134 | | - --password XXXX \ |
135 | | - --keychain /Library/Keychains/System.keychain |
136 | | -``` |
137 | | - |
138 | | -Note: `XXXX` values are found in `secrets/build/release/apple.md` |
139 | | - |
140 | | -Note2: (`security unlock-keychain -u /Library/Keychains/System.keychain` _may_ be required prior to running this command). |
141 | | - |
142 | | -The expected output is: |
143 | | - |
144 | | -``` |
145 | | -This process stores your credentials securely in the Keychain. You reference these credentials later using a profile name. |
146 | | -
|
147 | | -Validating your credentials... |
148 | | -Success. Credentials validated. |
149 | | -Credentials saved to Keychain. |
150 | | -To use them, specify `--keychain-profile "NODE_RELEASE_PROFILE" --keychain /Library/Keychains/System.keychain` |
151 | | -``` |
152 | | - |
153 | | -#### Signing certificates |
154 | | - |
155 | | -* Go to the `build/release` folder in the secrets repo. |
156 | | -* Extract from secrets/build/release: `dotgpg cat Apple\ Developer\ ID\ Node.js\ Foundation.p12.base64 | base64 -D > /tmp/Apple\ Developer\ ID\ Node.js\ Foundation.p12` |
157 | | -* Transfer to release machine (scp to /tmp) |
158 | | -* `sudo security import /tmp/Apple\ Developer\ ID\ Node.js\ Foundation.p12 -k /Library/Keychains/System.keychain -T /usr/bin/codesign -T /usr/bin/productsign -P 'XXXX'` (where XXXX is found in secrets/build/release/apple.md) (`security unlock-keychain -u /Library/Keychains/System.keychain` _may_ be required prior to running this command). |
159 | | - |
160 | | -#### Validating certificates are in date and valid |
161 | | - |
162 | | -1. `security -i unlock-keychain` Enter the password for the machine located in secrets |
163 | | -2. `security find-certificate -c "Developer ID Application" -p > /tmp/app.cert` outputs the PEM format of the cert so we can properly inspect it |
164 | | -3. `security find-certificate -c "Developer ID Installer" -p > /tmp/installer.cert` |
165 | | -4. `openssl x509 -inform PEM -text -in /tmp/app.cert | less` |
166 | | -5. `openssl x509 -inform PEM -text -in /tmp/installer.cert | less` |
167 | | -6. `security find-identity -p codesigning -v` |
168 | | -The steps 4 and 5 will show the details of the certificates allowing to see expiry dates. |
169 | | - |
170 | | -Example: |
171 | | - |
172 | | -``` |
173 | | -Not Before: Jan 22 03:40:05 2020 GMT |
174 | | -Not After : Jan 22 03:40:05 2025 GMT |
175 | | -``` |
176 | | - |
177 | | -The step 6 will show the list of certificates available on the machine. |
178 | | - |
179 | | -Example: |
180 | | - |
181 | | -``` |
182 | | - 1) XXXXXXXXXXX "Developer ID Application: Node.js Foundation (XXXXXXX)" |
183 | | -1 valid identities found |
184 | | -``` |
185 | | - |
186 | | -## macOS |
187 | | -1. Update Sudoers file: |
188 | | - |
189 | | -this requires `NOPASSWD` to be added to the sudoers file to enable elevation |
190 | | - |
191 | | -`sudo visudo` |
192 | | -and change: |
193 | | -`%admin ALL = (ALL) ALL` |
194 | | -to |
195 | | -`%admin ALL = (ALL) NOPASSWD:ALL` |
196 | | - |
197 | | -2. Allow ssh access |
198 | | - |
199 | | -```bash |
200 | | -sudo systemsetup -setremotelogin on |
201 | | -``` |
202 | | - |
203 | 97 | ## AIX |
204 | 98 |
|
205 | 99 | ### Disk Layout |
|
0 commit comments