Install macOS helper from PKG for XPC enroll
Browser enrollment used osascript on every elevate. Ship a signed privileged helper installed at PKG time so probo:// can enroll over XPC with no second admin prompt. Add make install/uninstall/clean for local PKG test loops, and show alerts only on failure. Mirror the Go lint path for the macOS SPM package: Make targets, root configs, and a Linux CI job. Keep checks syntax-only so they do not need a macOS SDK. Format the existing sources so the new gates start clean. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
@@ -1,15 +1,37 @@
|
||||
# Local build / install helpers for probo-agent.
|
||||
#
|
||||
# macOS (primary for browser-enroll testing):
|
||||
# make install build signed PKG, uninstall leftovers, install PKG
|
||||
# make uninstall remove all system artifacts (idempotent)
|
||||
# make clean uninstall + wipe local build caches
|
||||
#
|
||||
# Requires on Darwin: CODESIGN_IDENTITY, APPLE_TEAM_ID
|
||||
# Optional: INSTALLER_IDENTITY; notarize via APPLE_ID+APPLE_ID_PASSWORD
|
||||
# (stored into a keychain profile; submit uses --keychain-profile)
|
||||
#
|
||||
# CLI-only (no app / helper), any Unix:
|
||||
# make install-cli
|
||||
# make run
|
||||
|
||||
CP ?= cp
|
||||
MKDIR ?= mkdir -p
|
||||
RMRF ?= rm -rf
|
||||
SUDO ?= sudo
|
||||
|
||||
REPO_ROOT= $(abspath ../..)
|
||||
PROBO_AGENT_BIN= $(REPO_ROOT)/bin/probo-agent
|
||||
VERSION= $(shell cat VERSION)
|
||||
|
||||
STATE_DIR= $(HOME)/.local/share/probo-agent-dev
|
||||
CACHE_ROOT= $(HOME)/.cache/probo-agent-dev
|
||||
DEV_TAG= probo-agent/dev
|
||||
BINARY= /usr/local/bin/probo-agent
|
||||
RELEASE_DIR= $(CACHE_ROOT)/release/$(DEV_TAG)
|
||||
INSTALL_SCRIPT= installer/install.sh
|
||||
REPO_ROOT= ../..
|
||||
PROBO_AGENT_BIN= $(REPO_ROOT)/bin/probo-agent
|
||||
MACOS_BUILD_SCRIPT= installer/macos/build.sh
|
||||
MACOS_UNINSTALL_SCRIPT= installer/macos/uninstall.sh
|
||||
MACOS_REINSTALL_SCRIPT= installer/macos/reinstall.sh
|
||||
ENROLL_UI_BUILD= installer/macos/enroll-ui/.build
|
||||
|
||||
UNAME_S:= $(shell uname -s)
|
||||
UNAME_M:= $(shell uname -m)
|
||||
@@ -26,12 +48,19 @@ endif
|
||||
|
||||
ifeq ($(UNAME_M),x86_64)
|
||||
ARCH_LABEL= x86_64
|
||||
BUILD_ARCH= amd64
|
||||
else ifeq ($(UNAME_M),amd64)
|
||||
ARCH_LABEL= x86_64
|
||||
BUILD_ARCH= amd64
|
||||
else ifeq ($(UNAME_M),arm64)
|
||||
ARCH_LABEL= arm64
|
||||
BUILD_ARCH= arm64
|
||||
else ifeq ($(UNAME_M),aarch64)
|
||||
ARCH_LABEL= arm64
|
||||
BUILD_ARCH= arm64
|
||||
else
|
||||
ARCH_LABEL=
|
||||
BUILD_ARCH=
|
||||
endif
|
||||
|
||||
AGENT_DIR= probo-agent_$(OS_LABEL)_$(ARCH_LABEL)
|
||||
@@ -40,26 +69,104 @@ ARCHIVE_PATH= $(RELEASE_DIR)/$(ARCHIVE_NAME)
|
||||
STAGING_DIR= $(CACHE_ROOT)/staging/$(AGENT_DIR)
|
||||
BUILD_BINARY= $(STAGING_DIR)/probo-agent
|
||||
|
||||
PKG= $(REPO_ROOT)/dist/probo-agent_$(VERSION)_darwin_$(ARCH_LABEL).pkg
|
||||
|
||||
INSTALL_ARGS?= --skip-service --dir "$(STATE_DIR)"
|
||||
INSTALL_ENV= PROBO_AGENT_RELEASE_TAG="$(DEV_TAG)" \
|
||||
PROBO_AGENT_RELEASE_BASE="file://$(abspath $(RELEASE_DIR))" \
|
||||
PROBO_AGENT_SKIP_CHECKSUM_VERIFY=true \
|
||||
PROBO_AGENT_STATE_DIR="$(STATE_DIR)" \
|
||||
PROBO_SERVER_URL="$(PROBO_SERVER_URL)" \
|
||||
PROBO_ENROLLMENT_TOKEN="$(PROBO_ENROLLMENT_TOKEN)"
|
||||
PROBO_AGENT_RELEASE_BASE="file://$(abspath $(RELEASE_DIR))" \
|
||||
PROBO_AGENT_SKIP_CHECKSUM_VERIFY=true \
|
||||
PROBO_AGENT_STATE_DIR="$(STATE_DIR)" \
|
||||
PROBO_SERVER_URL="$(PROBO_SERVER_URL)" \
|
||||
PROBO_ENROLLMENT_TOKEN="$(PROBO_ENROLLMENT_TOKEN)"
|
||||
|
||||
.PHONY: all install run clean
|
||||
all: install
|
||||
.PHONY: help all pkg install uninstall clean clean-build install-cli run
|
||||
.PHONY: $(PROBO_AGENT_BIN)
|
||||
|
||||
install: $(ARCHIVE_PATH)
|
||||
$(SUDO) $(INSTALL_ENV) sh "$(INSTALL_SCRIPT)" $(INSTALL_ARGS)
|
||||
all: help
|
||||
|
||||
run:
|
||||
help: ## Show targets
|
||||
@printf '%s\n' \
|
||||
'Targets:' \
|
||||
' install macOS: build signed PKG, wipe previous install, install PKG' \
|
||||
' other: same as install-cli' \
|
||||
' uninstall Remove system install (macOS: full PKG/helper/app teardown)' \
|
||||
' clean uninstall + remove local build caches' \
|
||||
' clean-build Remove local caches only (no sudo)' \
|
||||
' pkg Build signed macOS PKG to dist/ (Darwin only)' \
|
||||
' install-cli Install binary via installer/install.sh (dev state dir)' \
|
||||
' run Foreground run against install-cli state dir' \
|
||||
'' \
|
||||
'Darwin install requires CODESIGN_IDENTITY and APPLE_TEAM_ID.'
|
||||
|
||||
# --- primary local test loop -------------------------------------------------
|
||||
|
||||
install: ## Install for local testing (PKG on macOS)
|
||||
ifeq ($(UNAME_S),Darwin)
|
||||
$(MAKE) pkg
|
||||
$(SUDO) "$(MACOS_REINSTALL_SCRIPT)" "$(PKG)"
|
||||
else
|
||||
$(MAKE) install-cli
|
||||
endif
|
||||
|
||||
uninstall: ## Remove all system artifacts
|
||||
ifeq ($(UNAME_S),Darwin)
|
||||
$(SUDO) "$(MACOS_UNINSTALL_SCRIPT)"
|
||||
else
|
||||
@if [ -x "$(BINARY)" ]; then \
|
||||
$(SUDO) "$(BINARY)" uninstall || true; \
|
||||
fi
|
||||
$(SUDO) $(RMRF) "$(BINARY)"
|
||||
endif
|
||||
|
||||
clean: uninstall clean-build ## uninstall + wipe build caches
|
||||
|
||||
clean-build: ## Wipe local build caches (no sudo)
|
||||
$(RMRF) "$(STATE_DIR)" "$(CACHE_ROOT)" "$(ENROLL_UI_BUILD)"
|
||||
@# Unquoted globs so the shell can expand dist artifacts.
|
||||
-$(RMRF) $(REPO_ROOT)/dist/probo-agent_*.pkg
|
||||
@# Native binary under /usr/local is owned by root after install; leave it
|
||||
@# to `uninstall`. Never remove it here without sudo.
|
||||
|
||||
# --- macOS PKG ---------------------------------------------------------------
|
||||
|
||||
pkg: $(PKG) ## Build signed .pkg into dist/
|
||||
|
||||
$(PKG): $(PROBO_AGENT_BIN)
|
||||
ifeq ($(UNAME_S),Darwin)
|
||||
@if [ -z "$(CODESIGN_IDENTITY)" ]; then \
|
||||
echo 'error: CODESIGN_IDENTITY is required' >&2; exit 2; \
|
||||
fi
|
||||
@if [ -z "$(APPLE_TEAM_ID)" ]; then \
|
||||
echo 'error: APPLE_TEAM_ID is required' >&2; exit 2; \
|
||||
fi
|
||||
@if [ -z "$(BUILD_ARCH)" ]; then \
|
||||
echo 'error: unsupported arch $(UNAME_M)' >&2; exit 2; \
|
||||
fi
|
||||
@$(MKDIR) "$(dir $(PKG))"
|
||||
@CODESIGN_IDENTITY="$(CODESIGN_IDENTITY)" \
|
||||
APPLE_TEAM_ID="$(APPLE_TEAM_ID)" \
|
||||
INSTALLER_IDENTITY="$(INSTALLER_IDENTITY)" \
|
||||
APPLE_ID="$(APPLE_ID)" \
|
||||
APPLE_ID_PASSWORD="$(APPLE_ID_PASSWORD)" \
|
||||
NOTARYTOOL_KEYCHAIN_PROFILE="$(NOTARYTOOL_KEYCHAIN_PROFILE)" \
|
||||
sh "$(MACOS_BUILD_SCRIPT)" \
|
||||
--binary "$(PROBO_AGENT_BIN)" \
|
||||
--arch "$(BUILD_ARCH)" \
|
||||
--version "$(VERSION)" \
|
||||
--output "$(PKG)"
|
||||
else
|
||||
@echo 'error: pkg target is macOS-only' >&2
|
||||
@exit 1
|
||||
endif
|
||||
|
||||
# --- CLI-only (no Probo Agent.app / helper) ----------------------------------
|
||||
|
||||
install-cli: $(ARCHIVE_PATH) ## Install binary only via install.sh
|
||||
@$(SUDO) $(INSTALL_ENV) sh "$(INSTALL_SCRIPT)" $(INSTALL_ARGS)
|
||||
|
||||
run: ## Run agent in foreground (install-cli state dir)
|
||||
$(SUDO) "$(BINARY)" run --dir "$(STATE_DIR)"
|
||||
|
||||
clean:
|
||||
rm -rf "$(STATE_DIR)" "$(CACHE_ROOT)" "$(BINARY)"
|
||||
|
||||
$(ARCHIVE_PATH): $(BUILD_BINARY)
|
||||
$(MKDIR) "$(RELEASE_DIR)"
|
||||
tar -czf "$(ARCHIVE_PATH)" -C "$(CACHE_ROOT)/staging" "$(AGENT_DIR)"
|
||||
|
||||
Reference in New Issue
Block a user