macosnotarylib

README

This notarizes files using Apple's Notary API, which means that it can run on any OS.

Note that the archived binary must already be signed, see testdata/sign.sh, which unortunate is harder to do outside of a Macintosh.

See the single test for a "how to use". Running that prints something ala:

2022/08/30 13:13:39 Submitting helloworld.zip with checksum a53c8738fdd28a3558057c8825f633860846773baae89cf3e0e36f12896393af
2022/08/30 13:13:48 Successfully uploaded file to S3 location https://notary-submissions-prod.s3.us-west-2.amazonaws.com/prod/AROARQRX7CZS3PRF6ZA5L%3A22390004-2418-4edc-bb06-661cca8cf6e0
2022/08/30 13:13:59 [1] Checking status of 22390004-2418-4edc-bb06-661cca8cf6e0
2022/08/30 13:14:12 [2] Checking status of 22390004-2418-4edc-bb06-661cca8cf6e0
2022/08/30 13:14:12 Notarization completed!
--- PASS: TestNotarizeZip (33.55s)

Documentation

Index

• func LoadPrivateKeyFromEnvBase64(envKey string) (*ecdsa.PrivateKey, error)
• type Notarizer
  • func New(opts Options) (*Notarizer, error)
  • func (n *Notarizer) Submit(filename string) error
• type Options

Functions

func LoadPrivateKeyFromEnvBase64

func LoadPrivateKeyFromEnvBase64(envKey string) (*ecdsa.PrivateKey, error)

LoadPrivateKeyFromEnvBase64 is a helper function to load a key from the environment in base64 format.

Types

type Notarizer

type Notarizer struct {
	// contains filtered or unexported fields
}

Notarizer is the main struct for notarizing files.

func New

func New(opts Options) (*Notarizer, error)

New creates a new Notarizer. You can call Submit multiple time to submit multiple files, but the JWT token will eventually expire, default after 20 minutes.

func (*Notarizer) Submit

func (n *Notarizer) Submit(filename string) error

Submit submits a new notarization request.

type Options

type Options struct {
	// InfoLogger will log information about the notarization process. No secrets.
	InfoLoggerf func(format string, a ...any)

	// Your issuer ID from the API Keys page in App Store Connect; for example, 57246542-96fe-1a63-e053-0824d011072a.
	IssuerID string

	// Your private key ID from App Store Connect.
	Kid string

	// Timeout waiting for the notarization to complete.
	// Defaults to 5 minutes.
	SubmissionTimeout time.Duration

	// The JWT signing token expires after this duration,
	// default is 20 minutes.
	TokenTimeout time.Duration

	// The signing function to use.
	// Return the result of token.SignedString(appStoreConnectPrivateKey)
	// where the private key is the one connected to the kid field.
	SignFunc func(token *jwt.Token) (string, error)
}