Bug 1950203 - Add a behavior that notarizes openh264 plugins for macosx

signingscript/README.md

@@ -39,6 +39,7 @@ This is a best effort list of supported signing formats and what they correspond
 - `autograph_rsa`: get a detached signature for a file using autograph's hash signing endpoint
 - `apple_notarization`: notarize and staple a mac pkg or tarball
 - `apple_notarization_geckodriver`: notarize a mac binary (without stapling)
+- `apple_notarize_openh264_plugin`: notarize a mac openh264 plugin (without stapling)
 
 
 Testing

signingscript/src/signingscript/script.py

@@ -37,7 +37,9 @@ async def async_main(context):
             if not context.config.get("widevine_cert"):
                 raise Exception("Widevine format is enabled, but widevine_cert is not defined")
 
-        if {"apple_notarization", "apple_notarization_geckodriver", "apple_notarization_stacked"}.intersection(all_signing_formats):
+        if {"apple_notarization", "apple_notarization_geckodriver", "apple_notarization_stacked", "apple_notarize_openh264_plugin"}.intersection(
+            all_signing_formats
+        ):
             if not context.config.get("apple_notarization_configs", False):
                 raise Exception("Apple notarization is enabled but apple_notarization_configs is not defined")
             setup_apple_notarization_credentials(context)

signingscript/src/signingscript/sign.py

@@ -1541,6 +1541,13 @@ async def _notarize_geckodriver(context, path, workdir):
     return path
 
 
+async def _notarize_openh264_plugin(context, path, workdir):
+    """Notarizes an openh264 plugin binary"""
+    # the artifact from the openh264 plugin build task is already a .zip file
+    await _notarize_single(path, context.apple_credentials_path, staple=False)
+    return path
+
+
 async def _notarize_all(context, path, workdir):
     """
     Notarizes all files in a tarball
@@ -1603,6 +1610,19 @@ async def apple_notarize_geckodriver(context, path, *args, **kwargs):
     return await _notarize_geckodriver(context, path, notarization_workdir)
 
 
+@time_async_function
+async def apple_notarize_openh264_plugin(context, path, *args, **kwargs):
+    """
+    Notarizes given geckodriver package using rcodesign.
+    """
+    # Setup workdir
+    notarization_workdir = os.path.join(context.config["work_dir"], "apple_notarize")
+    shutil.rmtree(notarization_workdir, ignore_errors=True)
+    utils.mkdir(notarization_workdir)
+
+    return await _notarize_openh264_plugin(context, path, notarization_workdir)
+
+
 @time_async_function
 async def apple_notarize_stacked(context, filelist_dict):
     """

signingscript/src/signingscript/task.py

@@ -18,6 +18,7 @@
 from signingscript.sign import (
     apple_notarize,
     apple_notarize_geckodriver,
+    apple_notarize_openh264_plugin,
     apple_notarize_stacked,  # noqa: F401
     sign_authenticode,
     sign_file,
@@ -57,6 +58,7 @@
         "widevine": sign_widevine,
         "apple_notarization": apple_notarize,
         "apple_notarization_geckodriver": apple_notarize_geckodriver,
+        "apple_notarization_openh264_plugin": apple_notarize_openh264_plugin,
         "macapp": sign_macapp,
         # This format is handled in script.py
         # Should be refactored in https://github.com/mozilla-releng/scriptworker-scripts/issues/980