Show HN: Xcnotary – a Mac app notarization helper made with Rust (opens in new tab)

(github.com)

125 pointsdavidvartan5y ago29 comments

29 comments

(The author.) I had originally written a version of this in Python for my own use, and recently thought of rewriting it in Rust as a learning experience.

What I found is that writing a CLI in Rust is a absolute breeze, in part due to excellent documentation and the tooling, and also thanks to various well-maintained crates, such as StructOpt [1] to parse command line arguments of any complexity, or indicatif [2] to show animated progress.

[1] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...

[2] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...

tedmielczarek5y ago

Very cool! Tangentially related, I looked into reimplementing `codesign` in Rust while I was at Mozilla. We wanted to see if we could take Apple hardware out of the loop for our release process after we had switched Mac Firefox builds to cross-compile from Linux. I got a bunch of code written and I'm pretty sure I could have made it work if I had gotten the go-ahead to spend time on it but then we heard about notarization and decided it wasn't worth the effort since Apple was going to require us to use their service anyway.

davidvartanOP5y ago

That sounds like a fun project! I do hope Apple shows more love to the command line tooling in general (even if Mac-only) as the workflow still seems somewhat optimized for clicking one-by-one in Xcode.

detaro5y ago

> after we had switched Mac Firefox builds to cross-compile from Linux

Do you happen to have a link with more details about how that's done?

1 more reply

saagarjha5y ago

> we had switched Mac Firefox builds to cross-compile from Linux

Did you link against TBD files?

robenkleene5y ago

There’s also a nice GUI app called “SD Notary” from a well-respected, long-time Mac app developer (Late Night Software, developer of Script Debugger) https://latenightsw.com/sd-notary-notarizing-made-easy/

ridiculous_fish5y ago

Thank you for building this. The notarization process is navigable but baroque, especially from the command line.

fish shell's notarization script: https://github.com/fish-shell/fish-shell/blob/master/build_t...

davidvartanOP5y ago

It was surprising that they didn't provide an all-in-one blocking command, leaving everyone to write their own version of the submit(); while(true) { poll(); }.

I will need to add support for .pkg to cover more use cases. (Right now the tool specifically checks the input to be an .app bundle and zips it up for submission.)

robin_reala5y ago

Strange that it’s written in Bash!

faho5y ago

This is necessary for building fish. If we wrote it in fish script, we'd run into the bootstrapping problem, where you'd need fish to build fish.

_bxg15y ago

Very cool utility. Rust seems like an odd choice since there's little processing work to be done other than the zipping - which could be outsourced to the "zip" tool - but I guess a learning exercise is a learning exercise.

cjbassi5y ago

Rust is actually great for cli applications regardless of performance benefits because of its good ergonomics and package management once you get over the hump of learning it.

jfkebwjsbx5y ago

The comparison is against Python, which definitely has better ergonomics and includes everything needed for scripts like this (but does have package management too if the huge standard library is not enough).

1 more reply

filmgirlcw5y ago

I love this. Amazing work — thanks for making this process easier.

davidvartanOP5y ago

Thank you!

cmyr5y ago

Neat! I was just about to need something like this, for building native app bundles for druid[1]. I'll open an issue, but do you have any interest in exposing this as a library?

[1] https://github.com/xi-editor/druid

leecb5y ago

Very cool work! I just manually implemented this in a python script.

Does it support other platforms? Will it run on Linux?

davidvartanOP5y ago

The notarization service is opaque (uses Xcode's "xcrun altool" to submit/read status, instead of something like a REST API...) so unfortunately Mac-only at the moment.

baszalmstra5y ago

That's too bad, I would've loved to do this from a docker container.

saagarjha5y ago

Aside: GitHub seems to dislike your animated SVG for some reason, since it won't play unless I open it manually. I think sanitize=true does that; try hosting it somewhere else?

davidvartanOP5y ago

Thanks for the heads up! May I ask what browser you are using? If there are compatibility issues I may just re-render these as GIFs.

Sephr5y ago

How did you generate this animated SVG terminal screen capture?

1 more reply

floatingatoll5y ago

The SVG works fine in jsfiddle, which eventually led me to find https://stackoverflow.com/a/53717429 talking about 'animation' (which your SVG seems to mention, and I don't see a dur= property which GitHub does seem to support.)

1 more reply

saagarjha5y ago

Safari. I know that animated SVGs do work on GitHub in the browser; I just don't know why this one doesn't.

j / k navigate · click thread line to collapse

29 comments

davidvartanOP5y ago

(The author.) I had originally written a version of this in Python for my own use, and recently thought of rewriting it in Rust as a learning experience.

[1] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...

[2] https://github.com/akeru-inc/xcnotary/blob/11649e49892d81754...

tedmielczarek5y ago

davidvartanOP5y ago

detaro5y ago

> after we had switched Mac Firefox builds to cross-compile from Linux

Do you happen to have a link with more details about how that's done?

1 more reply

saagarjha5y ago

> we had switched Mac Firefox builds to cross-compile from Linux

Did you link against TBD files?

robenkleene5y ago

ridiculous_fish5y ago

Thank you for building this. The notarization process is navigable but baroque, especially from the command line.

fish shell's notarization script: https://github.com/fish-shell/fish-shell/blob/master/build_t...

davidvartanOP5y ago

It was surprising that they didn't provide an all-in-one blocking command, leaving everyone to write their own version of the submit(); while(true) { poll(); }.

I will need to add support for .pkg to cover more use cases. (Right now the tool specifically checks the input to be an .app bundle and zips it up for submission.)

robin_reala5y ago

Strange that it’s written in Bash!

faho5y ago

This is necessary for building fish. If we wrote it in fish script, we'd run into the bootstrapping problem, where you'd need fish to build fish.

_bxg15y ago

cjbassi5y ago

Rust is actually great for cli applications regardless of performance benefits because of its good ergonomics and package management once you get over the hump of learning it.

jfkebwjsbx5y ago

1 more reply

filmgirlcw5y ago

I love this. Amazing work — thanks for making this process easier.

davidvartanOP5y ago

Thank you!

cmyr5y ago

Neat! I was just about to need something like this, for building native app bundles for druid[1]. I'll open an issue, but do you have any interest in exposing this as a library?

[1] https://github.com/xi-editor/druid

leecb5y ago

Very cool work! I just manually implemented this in a python script.

Does it support other platforms? Will it run on Linux?

davidvartanOP5y ago

The notarization service is opaque (uses Xcode's "xcrun altool" to submit/read status, instead of something like a REST API...) so unfortunately Mac-only at the moment.

baszalmstra5y ago

That's too bad, I would've loved to do this from a docker container.

saagarjha5y ago

Aside: GitHub seems to dislike your animated SVG for some reason, since it won't play unless I open it manually. I think sanitize=true does that; try hosting it somewhere else?

davidvartanOP5y ago

Thanks for the heads up! May I ask what browser you are using? If there are compatibility issues I may just re-render these as GIFs.

Sephr5y ago

How did you generate this animated SVG terminal screen capture?

1 more reply

floatingatoll5y ago

1 more reply

saagarjha5y ago

Safari. I know that animated SVGs do work on GitHub in the browser; I just don't know why this one doesn't.

j / k navigate · click thread line to collapse