Add MacOS signing

This utilizes changes in Vanagon to enable signing locally, instead of shipping files to a signing server. Details for how to set this up given the appropriate certs/keys can be found on the wiki.

With the changes from OpenVoxProject/vanagon#13, when the VANAGON_FORCE_SIGNING env var is set, vanagon will attempt the signing flow as noted in that PR. Otherwise, it will skip signing entirely. In order for signing to succeed, you must run the build on a VM that contains:
- A keychain created by root that contains the Developer Application and Installer identities (cert + key), and a Notarization profile.
- SIGNING_KEYCHAIN set to the name/location of the keychain
- SIGNING_KEYCHAIN_PW set to the password to unlock the keychain
- APPLICATION_SIGNING_CERT set to the description of the application signing identity
- INSTALLER_SIGNING_CERT set to the description of the installer signing identity
- NOTARY_PROFILE set to the name of the profile set up with a user account tied to the above signing identities

At some point, we may move all this out of vanagon and put it back in here, but since this should never really change and the only thing we're signing right now is the agent for MacOS, this works well enough.

Author: nmburgan

.github/workflows/checks.yaml

@@ -13,9 +13,6 @@ jobs:
   rake_checks:
     name: Rake Checks
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        check: [ 'rubocop', 'commits' ]
     steps:
       - name: Checkout current PR
         uses: actions/checkout@v4
@@ -29,4 +26,4 @@ jobs:
         run: |
           gem update --system --silent --no-document
           bundle install --jobs 4 --retry 3
-      - run: bundle exec rake ${{ matrix.check }} --trace
+      - run: bundle exec rake rubocop --trace

configs/projects/openvox-agent.rb

@@ -21,15 +21,6 @@
   metadata_uri = File.join(runtime_details['location'], "#{proj.settings[:puppet_runtime_basename]}.json")
   proj.inherit_yaml_settings(settings_uri, sha1sum_uri, metadata_uri: metadata_uri)
 
-  if platform.is_macos?
-    proj.extra_file_to_sign File.join(proj.bindir, 'puppet')
-    proj.extra_file_to_sign File.join(proj.bindir, 'pxp-agent')
-    proj.extra_file_to_sign File.join(proj.bindir, 'wrapper.sh')
-    proj.signing_hostname 'osx-signer-prod-3.delivery.puppetlabs.net'
-    proj.signing_username 'jenkins'
-    proj.signing_command 'security -q unlock-keychain -p \$$OSX_SIGNING_KEYCHAIN_PW \$$OSX_SIGNING_KEYCHAIN; codesign --timestamp --keychain \$$OSX_SIGNING_KEYCHAIN -vfs \"\$$OSX_CODESIGNING_CERT\"'
-  end
-
   if platform.is_fedora? || platform.name =~ /el-10/
     proj.package_override("# Disable check-rpaths since /opt/* is not a valid path\n%global __brp_check_rpaths %{nil}")
     proj.package_override("# Disable the removal of la files, they are still required\n%global __brp_remove_la_files %{nil}")
@@ -88,7 +79,11 @@
   proj.setting(:service_conf, File.join(proj.install_root, 'service_conf'))
 
   proj.description "The OpenVox Agent package contains all of the elements needed to run the agent, including ruby and facter."
-  proj.version_from_git
+  if ENV['OPENVOX_AGENT_VERSION']
+    proj.version ENV['OPENVOX_AGENT_VERSION']
+  else
+    proj.version_from_git
+  end
   proj.write_version_file File.join(proj.prefix, 'VERSION')
   proj.license "See components"
   proj.vendor "Vox Pupuli <[email protected]>"

tasks/build.rake

@@ -17,7 +17,12 @@ namespace :vox do
     engine = platform =~ /^(osx|windows)-/ ? 'local' : 'docker'
     cmd = "bundle exec build #{project} #{platform} --engine #{engine}"
 
-    FileUtils.rm_rf('C:/ProgramFiles64Folder') if platform =~ /^windows-/
+    if platform =~ /^windows-/
+      FileUtils.rm_rf('C:/ProgramFiles64Folder')
+    else
+      FileUtils.rm_rf('/opt/puppetlabs')
+      FileUtils.rm_rf('/etc/puppetlabs')
+    end
 
     run_command(cmd, silent: false, print_command: true, report_status: true)
   end