sign for macos with goreleaser + gon

Author: bendrucker

.github/workflows/release.yaml

@@ -21,4 +21,5 @@ jobs:
         version: latest
         args: release --rm-dist
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        AC_PASSWORD: ${{ secrets.AC_PASSWORD }}

.gitignore

@@ -0,0 +1 @@
+dist/

.gon.hcl

@@ -0,0 +1,14 @@
+source = ["./dist/macos_darwin_amd64/terraform-credentials-keychain"]
+bundle_id = "com.bendrucker.terraform-credentials-keychain"
+
+apple_id {
+  username = "bvdrucker@gmail.com"
+}
+
+sign {
+  application_identity = "Developer ID Application: Benjamin V Drucker"
+}
+
+zip {
+  output_path = "./dist/macos_darwin_amd64/terraform-credentials-keychain.zip"
+}

.goreleaser.yml

@@ -0,0 +1,25 @@
+builds:
+  - id: default
+    goos:
+      - linux
+      - windows
+    goarch:
+      - amd64
+  - id: macos
+    goos:
+      - darwin
+    goarch:
+      - amd64
+    hooks:
+      post: ./gon.sh {{.Path}} {{dir (dir .Path)}}/{{.ProjectName}}_{{.Version}}_{{.Target}}.zip
+archives:
+  - builds:
+      - default
+    format_overrides:
+      - goos: windows
+        format: zip
+release:
+  ids:
+    - none
+  extra_files:
+    - glob: ./dist/*_darwin_amd64.zip

gon.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euf -o pipefail
+
+binary="$1"
+zip="$2"
+config="$(dirname "$binary")/gon.hcl"
+
+cat <<-EOF > "$config"
+source = ["$binary"]
+bundle_id = "com.bendrucker.terraform-credentials-keychain"
+
+apple_id {
+  username = "bvdrucker@gmail.com"
+}
+
+sign {
+  application_identity = "Developer ID Application: Benjamin V Drucker"
+}
+
+zip {
+  output_path = "$zip"
+}
+EOF
+
+gon "$config"

keychain.go

@@ -15,7 +15,9 @@ var _ credentialhelper.Helper = (*KeychainHelper)(nil)
 
 // Open opens a keyring for Terraform
 func (h *KeychainHelper) Open() (keyring.Keyring, error) {
-	return keyring.Open(keyring.Config{ServiceName: "terraform"})
+	return keyring.Open(keyring.Config{
+		ServiceName: "terraform",
+	})
 }
 
 // Get gets the stored credentials from the keyring