3 ms·

Yea. Why cant github actions build these artifacts?

by 1kaizen 2y ago

keepamovin 2y ago
Because of the code signing for macOS
- Brian_K_White 2y ago
  That is chef's kiss right there. Security or authenticity is prevented by a security or authenticity policy.
  - thih9 2y ago
    This is common. Sometimes a security policy works (e.g. a password length requirement may cause people to come up with stronger password) and sometimes people consider it excessive and prefer to work around it (e.g. a password length requirement may cause people to write the password down on a sticky note and attach it to the computer screen).
- winkelmann 2y ago
  I haven't tried it myself, but it seems like that should be possible? > You can sign Xcode apps within your continuous integration (CI) workflow by installing an Apple code signing certificate on GitHub Actions runners. https://docs.github.com/en/actions/use-cases-and-examples/deploying/installing-an-apple-certificate-on-macos-runners-for-xcode-development https://docs.github.com/en/actions/use-cases-and-examples/de...
  - sdflhasjd 2y ago
    This costs money, requires some agreement signing and can "dox" developers, so not everyone wants a cert.
vodkapump 2y ago
It needs way too much space to build with github actions
- lifesaverluke 2y ago
  It's possible! I do it here: https://github.com/chromium-for-lambda/chromium-binaries/actions/workflows/build-chromium.yml https://github.com/chromium-for-lambda/chromium-binaries/act...
  - bracketfocus 2y ago
    According to the workflow file, you’re using self-hosted runners…
winkelmann 2y ago
GitHub now offers "artifact attestation"[1], which would be ideal for this use case. It records what build process binaries originated from, so they can still be published elsewhere while remaining verifiable. [1] https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/ https://github.blog/changelog/2024-06-25-artifact-attestatio...
Ahrotahn 2y ago
It does! That warning is for a different repo that allows community contribution: https://github.com/ungoogled-software/ungoogled-chromium-binaries https://github.com/ungoogled-software/ungoogled-chromium-bin...

Yea. Why cant github actions build these artifacts?

keepamovin 2y ago

Because of the code signing for macOS

Brian_K_White 2y ago
That is chef's kiss right there. Security or authenticity is prevented by a security or authenticity policy.
- thih9 2y ago
  This is common. Sometimes a security policy works (e.g. a password length requirement may cause people to come up with stronger password) and sometimes people consider it excessive and prefer to work around it (e.g. a password length requirement may cause people to write the password down on a sticky note and attach it to the computer screen).
winkelmann 2y ago
I haven't tried it myself, but it seems like that should be possible? > You can sign Xcode apps within your continuous integration (CI) workflow by installing an Apple code signing certificate on GitHub Actions runners. https://docs.github.com/en/actions/use-cases-and-examples/deploying/installing-an-apple-certificate-on-macos-runners-for-xcode-development https://docs.github.com/en/actions/use-cases-and-examples/de...
- sdflhasjd 2y ago
  This costs money, requires some agreement signing and can "dox" developers, so not everyone wants a cert.

vodkapump 2y ago

It needs way too much space to build with github actions

lifesaverluke 2y ago
It's possible! I do it here: https://github.com/chromium-for-lambda/chromium-binaries/actions/workflows/build-chromium.yml https://github.com/chromium-for-lambda/chromium-binaries/act...
- bracketfocus 2y ago
  According to the workflow file, you’re using self-hosted runners…

winkelmann 2y ago

GitHub now offers "artifact attestation"[1], which would be ideal for this use case. It records what build process binaries originated from, so they can still be published elsewhere while remaining verifiable. [1] https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/ https://github.blog/changelog/2024-06-25-artifact-attestatio...

Ahrotahn 2y ago

It does! That warning is for a different repo that allows community contribution: https://github.com/ungoogled-software/ungoogled-chromium-binaries https://github.com/ungoogled-software/ungoogled-chromium-bin...