diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0e6ba09c..531a3b72 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -138,86 +138,86 @@ jobs: # ------------------------------------------------------ - # Build-iOS: - # runs-on: macos-13 + Build-iOS: + runs-on: macos-13 - # env: - # QT_VERSION: 6.6.2 - # CC: cc - # CXX: c++ - # PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }} - # DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }} + env: + QT_VERSION: 6.6.2 + CC: cc + CXX: c++ + PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }} + DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }} - # steps: - # - name: 'Setup xcode' - # uses: maxim-lobanov/setup-xcode@v1 - # with: - # xcode-version: '15.2' + steps: + - name: 'Setup xcode' + uses: maxim-lobanov/setup-xcode@v1 + with: + xcode-version: '15.2' - # - name: 'Install desktop Qt' - # uses: jurplel/install-qt-action@v3 - # with: - # version: ${{ env.QT_VERSION }} - # host: 'mac' - # target: 'desktop' - # modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia' - # arch: 'clang_64' - # dir: ${{ runner.temp }} - # set-env: 'true' - # extra: '--base ${{ env.QT_MIRROR }}' + - name: 'Install desktop Qt' + uses: jurplel/install-qt-action@v3 + with: + version: ${{ env.QT_VERSION }} + host: 'mac' + target: 'desktop' + modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia' + arch: 'clang_64' + dir: ${{ runner.temp }} + set-env: 'true' + extra: '--base ${{ env.QT_MIRROR }}' - # - name: 'Install iOS Qt' - # uses: jurplel/install-qt-action@v3 - # with: - # version: ${{ env.QT_VERSION }} - # host: 'mac' - # target: 'ios' - # modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia' - # dir: ${{ runner.temp }} - # setup-python: 'true' - # set-env: 'true' - # extra: '--external 7z --base ${{ env.QT_MIRROR }}' + - name: 'Install iOS Qt' + uses: jurplel/install-qt-action@v3 + with: + version: ${{ env.QT_VERSION }} + host: 'mac' + target: 'ios' + modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia' + dir: ${{ runner.temp }} + setup-python: 'true' + set-env: 'true' + extra: '--external 7z --base ${{ env.QT_MIRROR }}' - # - name: 'Install go' - # uses: actions/setup-go@v5 - # with: - # go-version: '1.22.1' - # cache: false + - name: 'Install go' + uses: actions/setup-go@v5 + with: + go-version: '1.22.1' + cache: false - # - name: 'Setup gomobile' - # run: | - # export PATH=$PATH:~/go/bin - # go install golang.org/x/mobile/cmd/gomobile@latest - # gomobile init + - name: 'Setup gomobile' + run: | + export PATH=$PATH:~/go/bin + go install golang.org/x/mobile/cmd/gomobile@latest + gomobile init - # - name: 'Get sources' - # uses: actions/checkout@v4 - # with: - # submodules: 'true' - # fetch-depth: 10 + - name: 'Get sources' + uses: actions/checkout@v4 + with: + submodules: 'true' + fetch-depth: 10 - # - name: 'Setup ccache' - # uses: hendrikmuhs/ccache-action@v1.2 + - name: 'Setup ccache' + uses: hendrikmuhs/ccache-action@v1.2 - # - name: 'Install dependencies' - # run: pip install jsonschema jinja2 + - name: 'Install dependencies' + run: pip install jsonschema jinja2 - # - name: 'Build project' - # run: | - # git submodule update --init --recursive - # export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/ios/bin" - # export QT_MACOS_ROOT_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos" - # export PATH=$PATH:~/go/bin - # sh deploy/build_ios.sh - # env: - # IOS_TRUST_CERT_BASE64: ${{ secrets.IOS_TRUST_CERT_BASE64 }} - # IOS_SIGNING_CERT_BASE64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }} - # IOS_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }} - # APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }} - # APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }} - # APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }} - # IOS_APP_PROVISIONING_PROFILE: ${{ secrets.IOS_APP_PROVISIONING_PROFILE }} - # IOS_NE_PROVISIONING_PROFILE: ${{ secrets.IOS_NE_PROVISIONING_PROFILE }} + - name: 'Build project' + run: | + git submodule update --init --recursive + export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/ios/bin" + export QT_MACOS_ROOT_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos" + export PATH=$PATH:~/go/bin + sh deploy/build_ios.sh + env: + IOS_TRUST_CERT_BASE64: ${{ secrets.IOS_TRUST_CERT_BASE64 }} + IOS_SIGNING_CERT_BASE64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }} + IOS_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }} + APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }} + APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }} + APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }} + IOS_APP_PROVISIONING_PROFILE: ${{ secrets.IOS_APP_PROVISIONING_PROFILE }} + IOS_NE_PROVISIONING_PROFILE: ${{ secrets.IOS_NE_PROVISIONING_PROFILE }} # - name: 'Upload appstore .ipa and dSYMs to artifacts' # uses: actions/upload-artifact@v4 @@ -352,12 +352,12 @@ jobs: export QT_MACOS_ROOT_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos" bash deploy/build_macos_ne.sh env: - MAC_CERT_PW: ${{ secrets.MAC_CERT_PW }} - MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }} - APPLE_DEV_EMAIL: ${{ secrets.APPLE_DEV_EMAIL }} - MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }} - APPLE_DEV_PASSWORD: ${{ secrets.APPLE_DEV_PASSWORD }} - + APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }} + APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }} + APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }} + MAC_TRUST_CERT_BASE64: ${{ secrets.IOS_TRUST_CERT_BASE64 }} + MAC_SIGNING_CERT_BASE64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }} + MAC_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }} # ------------------------------------------------------ # Build-Android: diff --git a/deploy/AnhTVMacOSMain.provisionprofile b/deploy/AnhTVMacOSMain.provisionprofile new file mode 100644 index 00000000..675c8dd0 Binary files /dev/null and b/deploy/AnhTVMacOSMain.provisionprofile differ diff --git a/deploy/AnhTVMacOSNE.mobileprovision b/deploy/AnhTVMacOSNE.mobileprovision new file mode 100644 index 00000000..88735f24 Binary files /dev/null and b/deploy/AnhTVMacOSNE.mobileprovision differ diff --git a/deploy/build_macos_ne.sh b/deploy/build_macos_ne.sh index a1459d6f..27cc7cc4 100755 --- a/deploy/build_macos_ne.sh +++ b/deploy/build_macos_ne.sh @@ -1,5 +1,5 @@ #!/bin/bash -echo "Build script started ..." +echo "Build script for macOS Network Extension started ..." set -o errexit -o nounset @@ -35,21 +35,39 @@ INSTALLER_DATA_DIR=$BUILD_DIR/installer/packages/$APP_DOMAIN/data INSTALLER_BUNDLE_DIR=$BUILD_DIR/installer/$APP_FILENAME DMG_FILENAME=$PROJECT_DIR/${APP_NAME}.dmg -# Copy provisioning profiles -mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles/" +# Setup provisioning profiles for main app and NE +echo "Setting up provisioning profiles..." -echo $MACOS_APP_PROVISIONING_PROFILE | base64 --decode > ~/Library/MobileDevice/Provisioning\ Profiles/macos_app.mobileprovision -echo $MACOS_NE_PROVISIONING_PROFILE | base64 --decode > ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision +# Tạo thư mục Provisioning Profiles nếu chưa tồn tại +mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles -shasum -a 256 ~/Library/MobileDevice/Provisioning\ Profiles/macos_app.mobileprovision -shasum -a 256 ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision +# Setup provisioning profile cho main app +echo "Setting up provisioning profile for main app (AmneziaVPN)" +cp $PROJECT_DIR/deploy/AnhTVMacOSMain.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/ +macos_main_uuid=$(grep UUID -A1 -a ~/Library/MobileDevice/Provisioning\ Profiles/AnhTVMacOSMain.provisionprofile | grep -io "[-A-F0-9]\{36\}") +mv ~/Library/MobileDevice/Provisioning\ Profiles/AnhTVMacOSMain.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$macos_main_uuid.mobileprovision -macos_app_uuid=`grep UUID -A1 -a ~/Library/MobileDevice/Provisioning\ Profiles/macos_app.mobileprovision | grep -io "[-A-F0-9]\{36\}"` -macos_ne_uuid=`grep UUID -A1 -a ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision | grep -io "[-A-F0-9]\{36\}"` - -mv ~/Library/MobileDevice/Provisioning\ Profiles/macos_app.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/$macos_app_uuid.mobileprovision +# Setup provisioning profile cho Network Extension (NE) +echo "Setting up provisioning profile for Network Extension" +cp $PROJECT_DIR/deploy/AnhTVMacOSNE.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision +macos_ne_uuid=$(grep UUID -A1 -a ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision | grep -io "[-A-F0-9]\{36\}") mv ~/Library/MobileDevice/Provisioning\ Profiles/macos_ne.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/$macos_ne_uuid.mobileprovision +# Giải mã và cài đặt chứng chỉ ký code +echo "Installing signing certificates..." +echo $MAC_TRUST_CERT_BASE64 | base64 --decode > mac_trust_cert.pem +echo $MAC_SIGNING_CERT_BASE64 | base64 --decode > mac_signing_cert.p12 + +# Cài đặt chứng chỉ vào keychain +security create-keychain -p password build.keychain +security default-keychain -s build.keychain +security unlock-keychain -p password build.keychain +security import mac_trust_cert.pem -k build.keychain -A +security import mac_signing_cert.p12 -k build.keychain -P $MAC_SIGNING_CERT_PASSWORD -A + +# Thiết lập keychain cho quá trình ký +security set-key-partition-list -S apple-tool:,apple: -s -k password build.keychain + # Check if QIF_VERSION is properly set, otherwise set a default if [ -z "${QIF_VERSION+x}" ]; then echo "QIF_VERSION is not set, using default 4.6" @@ -63,14 +81,13 @@ $QT_BIN_DIR/qt-cmake --version || { echo "Error: qt-cmake not found in $QT_BIN_D cmake --version || { echo "Error: cmake not found"; exit 1; } clang -v || { echo "Error: clang not found"; exit 1; } -# Build the app -echo "Building App..." -mkdir -p build-macos -cd build-macos +# Build the Network Extension app +echo "Building Network Extension App..." +mkdir -p build-macos-ne +cd build-macos-ne $QT_BIN_DIR/qt-cmake .. -GXcode -DQT_HOST_PATH=$QT_MACOS_ROOT_DIR -DMACOS_NE=TRUE -# Xác định target hợp lệ và build -cmake --build . --config release --target AmneziaVPN # Hoặc target chính xác của bạn +cmake --build . --config release --target AmneziaVPN -- -allowProvisioningUpdates # Thay đổi target phù hợp cho Network Extension # Build and run tests here @@ -78,18 +95,17 @@ echo "____________________________________" echo "............Deploy.................." echo "____________________________________" -# Package -echo "Packaging ..." +# Package Network Extension +echo "Packaging Network Extension ..." +# Copy necessary data cp -Rv $PREBUILT_DEPLOY_DATA_DIR/* $BUNDLE_DIR/Contents/macOS $QT_BIN_DIR/macdeployqt $OUT_APP_DIR/$APP_FILENAME -always-overwrite -qmldir=$PROJECT_DIR cp -av $BUILD_DIR/service/server/$APP_NAME-service $BUNDLE_DIR/Contents/macOS cp -Rv $PROJECT_DIR/deploy/data/macos/* $BUNDLE_DIR/Contents/macOS -rm -f $BUNDLE_DIR/Contents/macOS/post_install.sh $BUNDLE_DIR/Contents/macOS/post_uninstall.sh -# Signing and notarizing the app +# Signing and notarizing the Network Extension if [ "${MAC_CERT_PW+x}" ]; then - CERTIFICATE_P12=$DEPLOY_DIR/PrivacyTechAppleCertDeveloperId.p12 WWDRCA=$DEPLOY_DIR/WWDRCA.cer KEYCHAIN=amnezia.build.macos.keychain @@ -99,84 +115,24 @@ if [ "${MAC_CERT_PW+x}" ]; then security default-keychain -s $KEYCHAIN security unlock-keychain -p $TEMP_PASS $KEYCHAIN - security default-keychain - security list-keychains - security import $WWDRCA -k $KEYCHAIN -T /usr/bin/codesign || true security import $CERTIFICATE_P12 -k $KEYCHAIN -P $MAC_CERT_PW -T /usr/bin/codesign || true - security set-key-partition-list -S apple-tool:,apple: -k $TEMP_PASS $KEYCHAIN - security find-identity -p codesigning - - echo "Signing App bundle..." + echo "Signing Network Extension..." /usr/bin/codesign --deep --force --verbose --timestamp -o runtime --sign "$MAC_SIGNER_ID" $BUNDLE_DIR - /usr/bin/codesign --verify -vvvv $BUNDLE_DIR || true spctl -a -vvvv $BUNDLE_DIR || true if [ "${NOTARIZE_APP+x}" ]; then - echo "Notarizing App bundle..." - /usr/bin/ditto -c -k --keepParent $BUNDLE_DIR $PROJECT_DIR/Bundle_to_notarize.zip - xcrun notarytool submit $PROJECT_DIR/Bundle_to_notarize.zip --apple-id $APPLE_DEV_EMAIL --team-id $MAC_TEAM_ID --password $APPLE_DEV_PASSWORD - rm $PROJECT_DIR/Bundle_to_notarize.zip + echo "Notarizing Network Extension bundle..." + /usr/bin/ditto -c -k --keepParent $BUNDLE_DIR $PROJECT_DIR/NE_Bundle_to_notarize.zip + xcrun notarytool submit $PROJECT_DIR/NE_Bundle_to_notarize.zip --apple-id $APPLE_DEV_EMAIL --team-id $MAC_TEAM_ID --password $APPLE_DEV_PASSWORD + rm $PROJECT_DIR/NE_Bundle_to_notarize.zip sleep 300 xcrun stapler staple $BUNDLE_DIR - xcrun stapler validate $BUNDLE_DIR spctl -a -vvvv $BUNDLE_DIR || true fi fi -echo "Packaging installer..." -mkdir -p $INSTALLER_DATA_DIR -cp -av $PROJECT_DIR/deploy/installer $BUILD_DIR -cp -av $DEPLOY_DATA_DIR/post_install.sh $INSTALLER_DATA_DIR/post_install.sh -cp -av $DEPLOY_DATA_DIR/post_uninstall.sh $INSTALLER_DATA_DIR/post_uninstall.sh -cp -av $DEPLOY_DATA_DIR/$PLIST_NAME $INSTALLER_DATA_DIR/$PLIST_NAME +# Package installer, sign, and notarize (if needed) -chmod a+x $INSTALLER_DATA_DIR/post_install.sh $INSTALLER_DATA_DIR/post_uninstall.sh - -cd $BUNDLE_DIR -tar czf $INSTALLER_DATA_DIR/$APP_NAME.tar.gz ./ - -echo "Building installer..." -$QIF_BIN_DIR/binarycreator --offline-only -v -c $BUILD_DIR/installer/config/macos.xml -p $BUILD_DIR/installer/packages -f $INSTALLER_BUNDLE_DIR - -if [ "${MAC_CERT_PW+x}" ]; then - echo "Signing installer bundle..." - security unlock-keychain -p $TEMP_PASS $KEYCHAIN - /usr/bin/codesign --deep --force --verbose --timestamp -o runtime --sign "$MAC_SIGNER_ID" $INSTALLER_BUNDLE_DIR - /usr/bin/codesign --verify -vvvv $INSTALLER_BUNDLE_DIR || true - - if [ "${NOTARIZE_APP+x}" ]; then - echo "Notarizing installer bundle..." - /usr/bin/ditto -c -k --keepParent $INSTALLER_BUNDLE_DIR $PROJECT_DIR/Installer_bundle_to_notarize.zip - xcrun notarytool submit $PROJECT_DIR/Installer_bundle_to_notarize.zip --apple-id $APPLE_DEV_EMAIL --team-id $MAC_TEAM_ID --password $APPLE_DEV_PASSWORD - rm $PROJECT_DIR/Installer_bundle_to_notarize.zip - sleep 300 - xcrun stapler staple $INSTALLER_BUNDLE_DIR - xcrun stapler validate $INSTALLER_BUNDLE_DIR - spctl -a -vvvv $INSTALLER_BUNDLE_DIR || true - fi -fi - -echo "Building DMG installer..." -hdiutil create -size 256mb -volname AmneziaVPN -srcfolder $BUILD_DIR/installer/$APP_NAME.app -ov -format UDZO $DMG_FILENAME - -if [ "${MAC_CERT_PW+x}" ]; then - echo "Signing DMG installer..." - security unlock-keychain -p $TEMP_PASS $KEYCHAIN - /usr/bin/codesign --deep --force --verbose --timestamp -o runtime --sign "$MAC_SIGNER_ID" $DMG_FILENAME - /usr/bin/codesign --verify -vvvv $DMG_FILENAME || true - - if [ "${NOTARIZE_APP+x}" ]; then - echo "Notarizing DMG installer..." - xcrun notarytool submit $DMG_FILENAME --apple-id $APPLE_DEV_EMAIL --team-id $MAC_TEAM_ID --password $APPLE_DEV_PASSWORD - sleep 300 - xcrun stapler staple $DMG_FILENAME - xcrun stapler validate $DMG_FILENAME - fi -fi - -echo "Finished, artifact is $DMG_FILENAME" - -# restore keychain -security default-keychain -s login.keychain +# The rest of your installer packaging process similar to build_macos.sh diff --git a/deploy/match_AppStore_orgamneziaAmneziaVPNnetworkextension.mobileprovision b/deploy/match_AppStore_orgamneziaAmneziaVPNnetworkextension.mobileprovision new file mode 100644 index 00000000..03fd0f4f Binary files /dev/null and b/deploy/match_AppStore_orgamneziaAmneziaVPNnetworkextension.mobileprovision differ diff --git a/deploy/orgamneziaAmneziaVPN_manual_profile.provisionprofile b/deploy/orgamneziaAmneziaVPN_manual_profile.provisionprofile new file mode 100644 index 00000000..5cae104d Binary files /dev/null and b/deploy/orgamneziaAmneziaVPN_manual_profile.provisionprofile differ