Redline updater hardening: signed-update verification, atomic install + revert, update visibility, notarization pipeline (MMDB-2681) #24
@@ -367,6 +367,10 @@ if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}";
|
||||
fi
|
||||
|
||||
TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"
|
||||
if [[ -z "${TEAM_IDENTIFIER}" ]]; then
|
||||
echo "No TeamIdentifier on ${APP_BUNDLE} — the build is not signed with a team identity; refusing to publish." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> Writing ${APPCAST_PATH}"
|
||||
python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" "${NOTARIZED}" "${TEAM_IDENTIFIER}" <<'PY'
|
||||
|
||||
Reference in New Issue
Block a user