Function test_macos_signing

tests/test_examples.py:956–1000

(tmp_path, self_signed_application_certificate_macos)

@pytest.mark.skipif(not shutil.which("xcodebuild"), reason="requires xcodebuild")
@pytest.mark.skipif("CI" not in os.environ, reason="CI only")
def test_macos_signing(tmp_path, self_signed_application_certificate_macos):
    try:
        subprocess.run(["xcodebuild", "--help"], check=True, capture_output=True)
    except subprocess.CalledProcessError:
        pytest.skip("xcodebuild requires XCode to compile extra pages.")
    input_path = tmp_path / "input"
    recipe_path = _example_path("osxpkg_extra_pages")
    shutil.copytree(str(recipe_path), str(input_path))
    with open(input_path / "construct.yaml", "a") as f:
        f.write(f"notarization_identity_name: {self_signed_application_certificate_macos}\n")
    output_path = tmp_path / "output"
    installer, _ = next(create_installer(input_path, output_path))

    # Check component signatures
    expanded_path = output_path / "expanded"
    # expand-full is an undocumented option that extracts all archives,
    # including binary archives like the PlugIns file
    cmd = ["pkgutil", "--expand-full", installer, expanded_path]
    _execute(cmd)
    conda_exe_name = format_conda_exe_name(CONSTRUCTOR_CONDA_EXE)
    components = [
        Path(expanded_path, "prepare_installation.pkg", "Payload", "osx-pkg-test", conda_exe_name),
        Path(expanded_path, "Plugins", "ExtraPage.bundle"),
    ]
    internal_dir = Path(
        expanded_path, "prepare_installation.pkg", "Payload", "osx-pkg-test", "_internal"
    )
    components.extend([file for file in internal_dir.glob("**") if is_macho_binary(file)])
    validated_signatures = []
    for component in components:
        p = subprocess.run(
            ["/usr/bin/codesign", "--verify", str(component), "--verbose=4"],
            check=True,
            text=True,
            capture_output=True,
        )
        # codesign --verify outputs to stderr
        lines = p.stderr.split("\n")[:-1]
        if (
            len(lines) == 2
            and lines[0] == f"{component}: valid on disk"
            and lines[1] == f"{component}: satisfies its Designated Requirement"
        ):
            validated_signatures.append(component)
    assert validated_signatures == components


def test_example_scripts(tmp_path, request):