diff --git a/scripts/desktop/notarize_macos.sh b/scripts/desktop/notarize_macos.sh index ec5d910..d66a60d 100755 --- a/scripts/desktop/notarize_macos.sh +++ b/scripts/desktop/notarize_macos.sh @@ -73,6 +73,12 @@ else: PY } +is_notary_agreement_error() { + local output="$1" + + [[ "$output" == *"HTTP status code: 403"* && "$output" == *"required agreement"* ]] +} + sign_binary() { local path="$1" @@ -201,12 +207,22 @@ else NOTARY_TARGET_PATH="$DMG_PATH" fi -submit_output="$(xcrun notarytool submit "$NOTARY_TARGET_PATH" \ - --key "$APPLE_API_KEY_PATH" \ - --key-id "$APPLE_API_KEY_ID" \ - --issuer "$APPLE_API_ISSUER" \ - --wait \ - --output-format json)" +submit_output="$( + xcrun notarytool submit "$NOTARY_TARGET_PATH" \ + --key "$APPLE_API_KEY_PATH" \ + --key-id "$APPLE_API_KEY_ID" \ + --issuer "$APPLE_API_ISSUER" \ + --wait \ + --output-format json 2>&1 +)" || { + if is_notary_agreement_error "$submit_output"; then + echo "Apple team agreement is missing or expired; skip notarization and continue release packaging." + echo "$submit_output" + exit 0 + fi + echo "$submit_output" + exit 1 +} notary_id="$(extract_notary_field id "$submit_output")" notary_status="$(extract_notary_field status "$submit_output")" diff --git a/scripts/test/notarize_macos_test.sh b/scripts/test/notarize_macos_test.sh index f6bf457..b2332b1 100644 --- a/scripts/test/notarize_macos_test.sh +++ b/scripts/test/notarize_macos_test.sh @@ -107,6 +107,10 @@ if [[ "$1" == "notarytool" && "$2" == "submit" ]]; then Accepted) printf '{"id":"submission-123","status":"Accepted"}\n' ;; + AgreementRequired) + echo "Error: HTTP status code: 403. A required agreement is missing or has expired. This request requires an in-effect agreement that has not been signed or has expired." >&2 + exit 1 + ;; Invalid) printf '{"id":"submission-123","status":"Invalid"}\n' ;; @@ -180,6 +184,28 @@ assert_contains "$log_invalid" "xcrun:notarytool submit" assert_contains "$log_invalid" "xcrun:notarytool log submission-123" assert_not_contains "$log_invalid" "stapler:" +repo_agreement="$tmp_dir/repo-agreement" +bin_agreement="$tmp_dir/bin-agreement" +log_agreement="$tmp_dir/agreement.log" +make_repo "$repo_agreement" +make_fake_bin "$bin_agreement" +make_fake_appdmg "$repo_agreement" + +( + cd "$repo_agreement" + CALL_LOG="$log_agreement" \ + PATH="$bin_agreement:$PATH" \ + APPLE_SIGNING_IDENTITY="Developer ID Application: Example Developer (TEAMID1234)" \ + APPLE_API_KEY_PATH="$tmp_dir/AuthKey.p8" \ + APPLE_API_KEY_ID="ABC123DEFG" \ + APPLE_API_ISSUER="00000000-0000-0000-0000-000000000000" \ + NOTARY_STATUS="AgreementRequired" \ + bash scripts/desktop/notarize_macos.sh +) + +assert_contains "$log_agreement" "xcrun:notarytool submit" +assert_not_contains "$log_agreement" "stapler:" + repo_accept="$tmp_dir/repo-accept" bin_accept="$tmp_dir/bin-accept" log_accept="$tmp_dir/accept.log"