SQL-1310: Add release targets for ODBC on macos

RELEASE.md

@@ -72,6 +72,14 @@ Check that the released files, library and symbols, are available at the followi
   - Release build
     - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/ubuntu2204/${release_version}/release/libatsql.so`  
     - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/ubuntu2204/${release_version}/release/mongoodbc.tar.gz`
+- Macos
+  - Release build
+    - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/macos/${release_version}/mongoodbc.dmg`
+    - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/macos/${release_version}/libatsql.dylib`
+- Macos-ARM
+  - Release build
+    - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/macos-arm/${release_version}/mongoodbc.dmg`
+    - `https://translators-connectors-releases.s3.us-east-1.amazonaws.com/mongosql-odbc-driver/macos-arm/${release_version}/libatsql.dylib`
 
 ##### Verify that the driver works with PowerBI
 Download and install the driver file.

evergreen.yml

@@ -40,6 +40,22 @@ functions:
         local_file: mongosql-odbc-driver/installer/tgz/mongoodbc.tar.gz
         bucket: mciuploads
 
+  "fetch for macos sign":
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/${build_variant}/release/mongoodbc.dmg
+        local_file: mongosql-odbc-driver/installer/dmg/mongoodbc.dmg
+        bucket: mciuploads
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/${build_variant}/release/libatsql.dylib
+        local_file: mongosql-odbc-driver/target/release/libatsql.dylib
+        bucket: mciuploads
+
   "fetch source":
     - command: git.get_project
       params:
@@ -69,11 +85,15 @@ functions:
           RELEASE_VERSION: "$RELEASE_VERSION"
           WINDOWS_INSTALLER_PATH: "mongosql-odbc-driver/windows/$RELEASE_VERSION/release/mongoodbc.msi"
           UBUNTU2204_INSTALLER_PATH: "mongosql-odbc-driver/ubuntu2204/$RELEASE_VERSION/release/mongoodbc.tar.gz"
+          MACOS_INSTALLER_PATH: "mongosql-odbc-driver/macos/$RELEASE_VERSION/release/mongoodbc.dmg"
+          MACOS_ARM_INSTALLER_PATH: "mongosql-odbc-driver/macos-arm/$RELEASE_VERSION/release/mongoodbc.dmg"
           prepare_shell: |
             set -o errexit
             export RELEASE_VERSION="$RELEASE_VERSION"
             export WINDOWS_INSTALLER_PATH="$WINDOWS_INSTALLER_PATH"
             export UBUNTU2204_INSTALLER_PATH="$UBUNTU2204_INSTALLER_PATH"
+            export MACOS_INSTALLER_PATH="$MACOS_INSTALLER_PATH"
+            export MACOS_ARM_INSTALLER_PATH="$MACOS_ARM_INSTALLER_PATH"
             export PATH="$PATH"
             export CARGO_NET_GIT_FETCH_WITH_CLI="$CARGO_NET_GIT_FETCH_WITH_CLI"
             git config --global url."ssh://[email protected]/".insteadOf "https://github.com/"
@@ -237,6 +257,52 @@ functions:
               --notary-url "${notary_client_url}" \
               mongoodbc.tar.gz
 
+  "install macnotary":
+    - command: shell.exec
+      type: test
+      params:
+        shell: bash
+        working_dir: mongosql-odbc-driver
+        script: |
+          ${prepare_shell}
+          MACNOTARY_VERSION=3.8.1
+          curl -LO https://macos-notary-1628249594.s3.amazonaws.com/releases/client/v$MACNOTARY_VERSION/darwin_amd64.zip
+          unzip -o darwin_amd64.zip
+          chmod 0755 ./darwin_amd64/macnotary
+          ./darwin_amd64/macnotary -v  
+
+  "sign macos":
+    - command: shell.exec
+      type: test
+      params:
+        shell: bash
+        working_dir: mongosql-odbc-driver
+        script: |
+          ${prepare_shell}
+          zip macos-mongo-odbc.zip installer/dmg/mongoodbc.dmg target/release/libatsql.dylib
+    - command: mac.sign
+      params:
+        key_id: ${key_id}
+        secret: ${secret}
+        service_url: ${service_url}
+        client_binary: mongosql-odbc-driver/darwin_amd64/macnotary
+        local_zip_file: mongosql-odbc-driver/macos-mongo-odbc.zip
+        output_zip_file: mongosql-odbc-driver/macos-mongo-odbc-signed.zip
+        artifact_type: binary
+        verify: true
+        notarize: true
+        bundle_id: com.mongodb.mongoodbc
+    - command: shell.exec
+      type: test
+      params:
+        shell: bash
+        working_dir: mongosql-odbc-driver
+        script: |
+          ${prepare_shell}
+          unzip -o macos-mongo-odbc-signed.zip
+          mv installer/dmg/mongoodbc.dmg mongoodbc-signed.dmg
+          mv target/release/libatsql.dylib libatsql-signed.dylib
+
   "compile release":
     - command: shell.exec
       type: test
@@ -362,16 +428,58 @@ functions:
         working_dir: mongosql-odbc-driver
         script: |
           ${prepare_shell}
-          cp target/release/*.dylib installer/dmg
-          cp target/release/macos_postinstall installer/dmg
-          cd installer/dmg
+          # Sign the postinstall executable prior to creating dmg, needed for notarizing
+          zip -r unsigned-target.zip target/release/macos_postinstall \
+                              target/release/libatsql.dylib
+    - command: mac.sign
+      params:
+        key_id: ${key_id}
+        secret: ${secret}
+        service_url: ${service_url}
+        client_binary: mongosql-odbc-driver/darwin_amd64/macnotary
+        local_zip_file: mongosql-odbc-driver/unsigned-target.zip
+        output_zip_file: mongosql-odbc-driver/signed-target.zip
+        artifact_type: binary
+        verify: true
+        notarize: false
+    - command: shell.exec
+      params:
+        add_expansions_to_env: true
+        shell: bash
+        working_dir: mongosql-odbc-driver
+        script: |
+          ${prepare_shell}  
           if [ "$RELEASE_VERSION" == "snapshot" ]; then
               MINOR_VERSION="0.1"
           else
               MINOR_VERSION=$(echo "$RELEASE_VERSION" | sed 's|\([0-9]\+[.][0-9]\+\)[.][0-9]\+|\1|')
           fi
+
+          ditto -x -k $PWD/signed-target.zip .
+          cp target/release/*.dylib installer/dmg
+          cp target/release/macos_postinstall installer/dmg
+          cd installer/dmg
           ./build-dmg.sh "$MINOR_VERSION"
-
+          zip -rv ../../mongoodbc-pkg-unsigned.zip mongoodbc.pkg
+          cd ../..
+
+          # pkg file needs to be signed separately before packaged in dmg file
+          # mac.sign evergreen task does not yet support the ArtifactType `pkg`
+          # Working around that by calling via command line
+          ./darwin_amd64/macnotary -o mongoodbc-pkg-signed.zip -f mongoodbc-pkg-unsigned.zip -m sign  \
+             -u https://dev.macos-notary.build.10gen.cc/api -t pkg -o mongoodbc-pkg-signed.zip \
+             -k $key_id -s $secret
+    - command: shell.exec
+      params:
+        add_expansions_to_env: true
+        shell: bash
+        working_dir: mongosql-odbc-driver
+        script: |
+          ${prepare_shell}   
+          ditto -x -k mongoodbc-pkg-signed.zip installer/dmg/dmg-contents/ 
+          cd installer/dmg
+
+          hdiutil create -fs HFS+ -srcfolder dmg-contents -volname mongoodbc mongoodbc.dmg
 
   "mciuploads release artifacts":
     - command: s3.put
@@ -444,6 +552,7 @@ functions:
       params:
         build_variants:
           - macos
+          - macos-arm
         aws_key: ${aws_key}
         aws_secret: ${aws_secret}
         local_file: mongosql-odbc-driver/target/release/libatsql.dylib
@@ -455,6 +564,7 @@ functions:
       params:
         build_variants:
           - macos
+          - macos-arm
         aws_key: ${aws_key}
         aws_secret: ${aws_secret}
         local_file: mongosql-odbc-driver/installer/dmg/mongoodbc.dmg
@@ -531,6 +641,26 @@ functions:
         permissions: public-read
         content_type: application/octet-stream
 
+  "upload signed macos artifacts":
+    - command: s3.put
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/{buildvariant}/release/mongoodbc-signed.dmg
+        local_file: mongosql-odbc-driver/mongoodbc-signed.dmg
+        bucket: mciuploads
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.put
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/{buildvariant}/release/libatsql-signed.dylib
+        local_file: mongosql-odbc-driver/libatsql-signed.dylib
+        bucket: mciuploads
+        permissions: public-read
+        content_type: application/octet-stream
+
   "upload release":
     - command: s3.get
       params:
@@ -650,6 +780,74 @@ functions:
         bucket: translators-connectors-releases
         permissions: public-read
         content_type: application/octet-stream
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/macos/release/libatsql-signed.dylib
+        local_file: mongosql-odbc-driver/target/release/libatsql-signed.dylib
+        bucket: mciuploads
+    - command: s3.put
+      params:
+        aws_key: ${release_aws_key}
+        aws_secret: ${release_aws_secret}
+        local_file: mongosql-odbc-driver/target/release/libatsql-signed.dylib
+        remote_file: mongosql-odbc-driver/macos/${RELEASE_VERSION}/libatsql.dylib
+        bucket: translators-connectors-releases
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/macos/release/mongoodbc-signed.dmg
+        local_file: mongosql-odbc-driver/target/release/mongoodbc-signed.dmg
+        bucket: mciuploads
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.put
+      params:
+        aws_key: ${release_aws_key}
+        aws_secret: ${release_aws_secret}
+        local_file: mongosql-odbc-driver/target/release/mongoodbc-signed.dmg
+        remote_file: ${MACOS_INSTALLER_PATH}
+        bucket: translators-connectors-releases
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/macos-arm/release/libatsql-signed.dylib
+        local_file: mongosql-odbc-driver/target/release/libatsql-signed.dylib
+        bucket: mciuploads
+    - command: s3.put
+      params:
+        aws_key: ${release_aws_key}
+        aws_secret: ${release_aws_secret}
+        local_file: mongosql-odbc-driver/target/release/libatsql-signed.dylib
+        remote_file: mongosql-odbc-driver/macos-arm/${RELEASE_VERSION}/libatsql.dylib
+        bucket: translators-connectors-releases
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.get
+      params:
+        aws_key: ${aws_key}
+        aws_secret: ${aws_secret}
+        remote_file: mongosql-odbc-driver/artifacts/${version_id}/macos-arm/release/mongoodbc-signed.dmg
+        local_file: mongosql-odbc-driver/target/release/mongoodbc-signed.dmg
+        bucket: mciuploads
+        permissions: public-read
+        content_type: application/octet-stream
+    - command: s3.put
+      params:
+        aws_key: ${release_aws_key}
+        aws_secret: ${release_aws_secret}
+        local_file: mongosql-odbc-driver/target/release/mongoodbc-signed.dmg
+        remote_file: ${MACOS_ARM_INSTALLER_PATH}
+        bucket: translators-connectors-releases
+        permissions: public-read
+        content_type: application/octet-stream
 
   "upload debug":
     - command: s3.get
@@ -1310,6 +1508,8 @@ functions:
           sed -i 's@{RELEASE_VERSION}@'${RELEASE_VERSION}'@' mongo-odbc-downloads_template.json
           sed -i 's@{WINDOWS_INSTALLER_PATH}@'${WINDOWS_INSTALLER_PATH}'@' mongo-odbc-downloads_template.json
           sed -i 's@{UBUNTU2204_INSTALLER_PATH}@'${UBUNTU2204_INSTALLER_PATH}'@' mongo-odbc-downloads_template.json
+          sed -i 's@{MACOS_INSTALLER_PATH}@'${MACOS_INSTALLER_PATH}'@' mongo-odbc-downloads_template.json
+          sed -i 's@{MACOS_ARM_INSTALLER_PATH}@'${MACOS_ARM_INSTALLER_PATH}'@' mongo-odbc-downloads_template.json
           echo "--------- New release object ----------------"
           cat mongo-odbc-downloads_template.json
           echo "---------------------------------------------"
@@ -1381,6 +1581,7 @@ tasks:
       - func: "set packages version"
       - func: "check packages version"
       - func: "compile macos release"
+      - func: "install macnotary"
       - func: "build dmg"
       - func: "mciuploads release artifacts"
 
@@ -1459,6 +1660,15 @@ tasks:
       - func: "sign ubuntu"
       - func: "upload ubuntu sig file"
 
+  - name: macos-sign
+    depends_on:
+      - name: compile-macos
+    commands:
+      - func: "fetch for macos sign"
+      - func: "install macnotary"
+      - func: "sign macos"
+      - func: "upload signed macos artifacts"
+
   - name: macos-unit-test
     commands:
       - func: "install iODBC"
@@ -1640,6 +1850,7 @@ buildvariants:
       - name: macos-unit-test
       - name: macos-integration-test
       - name: macos-result-set-test
+      - name: macos-sign
 
   - name: macos-arm
     display_name: "macOS 11.0 ARM 64"
@@ -1650,6 +1861,7 @@ buildvariants:
       - name: macos-unit-test
       - name: macos-integration-test
       - name: macos-result-set-test
+      - name: macos-sign
 
   - name: release
     display_name: "Release"

installer/dmg/build-dmg.sh

@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 
 rm ./*.dmg || true
 rm dmg-contents/*.pkg || true
@@ -26,6 +27,3 @@ productbuild --distribution distribution.xml \
 	--package-path . \
 	"$PRODUCT"
 
-mv "$PRODUCT" dmg-contents/
-
-hdiutil create -fs HFS+ -srcfolder dmg-contents -volname mongoodbc mongoodbc.dmg

resources/download-center/mongo-odbc-downloads_template.json

@@ -8,6 +8,14 @@
         {
           "name": "Ubuntu 22.04 (x86_64)",
           "download_link": "https://translators-connectors-releases.s3.amazonaws.com/{UBUNTU2204_INSTALLER_PATH}"
+        },
+        {
+          "name": "MacOS",
+          "download_link": "https://translators-connectors-releases.s3.amazonaws.com/{MACOS_INSTALLER_PATH}"
+        },
+        {
+          "name": "MacOS ARM",
+          "download_link": "https://translators-connectors-releases.s3.amazonaws.com/{MACOS_ARM_INSTALLER_PATH}"
         }
       ]
     }