aleleba/photocraft
1
0
Fork 0
mirror of https://github.com/storytold/photocraft.git synced 2026-10-24 01:47:08 -06:00
Code Issues Packages Projects Releases Wiki Activity

packaging(macos): retry stapling when Apple's ticket lookup drops (#8995)

Browse Source 
* packaging(macos): retry stapling when Apple's ticket lookup drops

The 0.15.0 release's macOS job failed after both notarizations were
accepted: stapling the DMG lost its connection to Apple's CloudKit
ticket service (error 68). Retry stapling up to five times with a
growing pause before failing the job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* packaging(macos): retry stapler validation too

The re-run of the 0.15.0 macOS job stapled the DMG, then lost the
CloudKit connection in `stapler validate` (error 68 again). Retry
staple + validate as a pair in package.sh, and retry the validation
verify.sh does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Brandon Thomas
2026-10-23 17:11:00 -04:00
committed by GitHub
co-authored by Claude Opus 5.5
parent 6d4b9690ab
commit 4991f6377e
2 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/macos/package.sh
+20 -4
View File
@@ -97,6 +97,24 @@ notarize() {
fi
}
# Stapling and validating both look the ticket up in Apple's CloudKit service. Right after
# notarization that lookup can drop the connection ("The network connection was lost", error 68)
# even though the ticket exists, so retry the pair a few times before failing the release.
staple() {
local file="$1" attempt
for attempt in 1 2 3 4 5; do
if xcrun stapler staple "$file" && xcrun stapler validate "$file"; then
return
fi
if [ "$attempt" = 5 ]; then
echo "error: stapling $(basename "$file") failed after $attempt attempts" >&2
exit 1
fi
echo "stapling $(basename "$file") failed (attempt $attempt); retrying in $((attempt * 20))s" >&2
sleep $((attempt * 20))
done
}
# ---- PhotoCraft.app ----------------------------------------------------------------------------
echo "==> assembling $APP"
mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
@@ -123,8 +141,7 @@ codesign --verify --strict --deep --verbose=2 "$APP"
if [[ "$NOTARIZE" = 1 ]]; then
ditto -c -k --keepParent "$APP" "$WORK/PhotoCraft-notarize.zip"
notarize "$WORK/PhotoCraft-notarize.zip"
xcrun stapler staple "$APP"
xcrun stapler validate "$APP"
staple "$APP"
spctl --assess --type execute -vvv "$APP"
fi
@@ -149,8 +166,7 @@ sign "$DMG"
codesign --verify --strict --verbose=2 "$DMG"
if [[ "$NOTARIZE" = 1 ]]; then
notarize "$DMG"
xcrun stapler staple "$DMG"
xcrun stapler validate "$DMG"
staple "$DMG"
spctl --assess --type open --context context:primary-signature -vvv "$DMG"
fi
packaging/macos/verify.sh
+12 -1
View File
@@ -70,6 +70,17 @@ assess() {
return 1
}
# `stapler validate` asks Apple's CloudKit service too, which sometimes drops the connection
# (error 68) though the ticket is there.
validate_staple() {
local attempt
for attempt in 1 2 3 4 5; do
xcrun stapler validate "$1" && return 0
[[ "$attempt" = 5 ]] || sleep $((attempt * 20))
done
return 1
}
for f in "$DMG" "$CLI_ZIP"; do
if [[ ! -f "$f" ]]; then
echo "error: missing $f" >&2
@@ -126,7 +137,7 @@ fi
echo "==> $(basename "$DMG")"
codesign --verify --strict --verbose=2 "$DMG"
if [[ "$STRICT" = 1 ]]; then
xcrun stapler validate "$DMG" || fail "no notarization ticket stapled to the DMG"
validate_staple "$DMG" || fail "no notarization ticket stapled to the DMG"
assess --assess --type open --context context:primary-signature -vv "$DMG" \
|| fail "Gatekeeper rejects the DMG"
fi