From 7db25cfff3eb429501f11a43a4686c161bfb0781 Mon Sep 17 00:00:00 2001
From: "Chris (SPG) McGee" <christie_mcgee@apple.com>
Date: Sat, 19 Oct 2024 20:32:22 -0400
Subject: [PATCH 1/2] Add signature cert and package identifier parameters to
 package script

When building macOS packages with pkgbuild, a signing certificate
needs to be provided up-front, as is the package identifier. Change
the package script so that it can accept the location of the certificate
and override the package identifier.
---
 .../BuildSwiftlyRelease.swift                 | 57 ++++++++++++++-----
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/Tools/build-swiftly-release/BuildSwiftlyRelease.swift b/Tools/build-swiftly-release/BuildSwiftlyRelease.swift
index d5bc7efb..5ac8aaa2 100644
--- a/Tools/build-swiftly-release/BuildSwiftlyRelease.swift
+++ b/Tools/build-swiftly-release/BuildSwiftlyRelease.swift
@@ -182,6 +182,14 @@ struct BuildSwiftlyRelease: AsyncParsableCommand {
     @Flag(name: .long, help: "Skip the git repo checks and proceed.")
     var skip: Bool = false
 
+#if os(macOS)
+    @Option(help: "Installation certificate to use when building the macOS package")
+    var cert: String?
+
+    @Option(help: "Package identifier of macOS package")
+    var identifier: String = "org.swift.swiftly"
+#endif
+
     @Argument(help: "Version of swiftly to build the release.")
     var version: String
 
@@ -191,7 +199,7 @@ struct BuildSwiftlyRelease: AsyncParsableCommand {
 #if os(Linux)
         try await self.buildLinuxRelease()
 #elseif os(macOS)
-        try await self.buildMacOSRelease()
+        try await self.buildMacOSRelease(cert: self.cert, identifier: self.identifier)
 #else
         #error("Unsupported OS")
 #endif
@@ -234,6 +242,10 @@ struct BuildSwiftlyRelease: AsyncParsableCommand {
     }
 
     func checkSwiftRequirement() async throws -> String {
+        guard !self.skip else {
+            return try await self.assertTool("swift", message: "Please install swift and make sure that it is added to your path.")
+        }
+
         guard let requiredSwiftVersion = try? self.findSwiftVersion() else {
             throw Error(message: "Unable to determine the required swift version for this version of swiftly. Please make sure that you `cd <swiftly_git_dir>` and there is a .swift-version file there.")
         }
@@ -361,7 +373,7 @@ struct BuildSwiftlyRelease: AsyncParsableCommand {
         print(releaseArchive)
     }
 
-    func buildMacOSRelease() async throws {
+    func buildMacOSRelease(cert: String?, identifier: String) async throws {
         // Check system requirements
         let git = try await self.assertTool("git", message: "Please install git with either `xcode-select --install` or `brew install git`")
 
@@ -389,17 +401,34 @@ struct BuildSwiftlyRelease: AsyncParsableCommand {
         try? FileManager.default.createDirectory(atPath: swiftlyLicenseDir, withIntermediateDirectories: true)
         try await self.collectLicenses(swiftlyLicenseDir)
 
-        try runProgram(
-            pkgbuild,
-            "--root",
-            swiftlyBinDir + "/..",
-            "--install-location",
-            "usr/local",
-            "--version",
-            self.version,
-            "--identifier",
-            "org.swift.swiftly",
-            ".build/release/swiftly-\(self.version).pkg"
-        )
+        if let cert {
+            try runProgram(
+                pkgbuild,
+                "--root",
+                swiftlyBinDir + "/..",
+                "--install-location",
+                "usr/local",
+                "--version",
+                self.version,
+                "--identifier",
+                identifier,
+                "--sign",
+                cert,
+                ".build/release/swiftly-\(self.version).pkg"
+            )
+        } else {
+            try runProgram(
+                pkgbuild,
+                "--root",
+                swiftlyBinDir + "/..",
+                "--install-location",
+                "usr/local",
+                "--version",
+                self.version,
+                "--identifier",
+                identifier,
+                ".build/release/swiftly-\(self.version).pkg"
+            )
+        }
     }
 }

From e023e5caa4bd31ba63ae1804d66b4a01179be9a0 Mon Sep 17 00:00:00 2001
From: "Chris (SPG) McGee" <christie_mcgee@apple.com>
Date: Sun, 20 Oct 2024 11:16:39 -0400
Subject: [PATCH 2/2] Add a note in the RELEASING.md about the --cert option
 for the release builder

---
 RELEASING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RELEASING.md b/RELEASING.md
index b09f729c..8818055d 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -13,7 +13,7 @@ Swift has a tool for producing final product packages, suitable for distribution
 5. Create a tag on that commit with the format "x.y.z". Do not omit "z", even if its value is 0.
 
 6. Build the executables for the release by running `swift run build-swiftly-release <version>` from the root of the swiftly repository
-  * Build on a Apple silicon macOS machine to produce a universal package for x86_64 and arm64
+  * Build on an Apple macOS machine to produce a universal package for x86_64 and arm64 (add the --cert option to provide a signing certificate file for the .pkg)
   * Build on an Amazon Linux 2 image for x86_64
   * Build on an Amazon Linux 2 image for arm64