macadmins/munki-builds

(Low priority) Additionally offer signed _component_ pkgs

Open

#11 opened on Mar 5, 2024

View on GitHub
 (2 comments) (0 reactions) (0 assignees) (3 forks)github user discovery
help wanted

Repository metrics

Stars
 (31 stars)
PR merge metrics
 (PR metrics pending)

Description

Unpacking the distribution package like the autopkg recipe (somewhat intuitively) breaks the pkg signing, adding distribution overhead when e.g. only a single component has been updated or orgs are rebranding the Managed Software Center app. Offering signed pkgs for each component would just be a nice-to-have, the signed/notarized contained executables are way more important, but I would use e.g. the python flavor if available

Contributor guide

Research direction
Investigate how munki builds currently signs distribution packages and explore methods to sign individual component pkgs. Look into autopkg recipes for component creation and leverage macOS signing tools like `productsign` and `codesign`. Consider adding a command line option to enable per component signing in the build process.
Tech stack
pythonshell
Domain
desktopdevopsbuild system
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GitmacOS development environmentXcode
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30