diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index b9ae34c..8535433 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -1,5 +1,4 @@ - -name: build-release +name: Release on: push: branches: [ "main" ] @@ -13,6 +12,7 @@ on: options: - latest - stable + - none env: CARGO_TERM_COLOR: always @@ -25,6 +25,7 @@ permissions: jobs: docker: + if: ${{ inputs.docker-tag-type != 'none' }} environment: Docker Hub runs-on: ubuntu-latest steps: @@ -92,21 +93,7 @@ jobs: uses: actions/attest-build-provenance@v1 with: subject-path: "target/release/${{ env.BUILD_FILE_NAME }}" - - name: mac installer - if: ${{ runner.os == 'macOS' }} - run: | - tmp_file="$(mktemp)" - cp scripts/installer.sh "$tmp_file" - base64 -b 72 -i target/release/mdq | sed 's/^/# /' >> "$tmp_file" - mv "$tmp_file" target/release/mdq-installer.sh - export BUILD_FILE_NAME=mdq-installer.sh - echo BUILD_FILE_NAME=mdq-installer.sh >> "$GITHUB_ENV" - - name: Attest Build Provenance (mac installer) - if: ${{ runner.os == 'macOS' }} - uses: actions/attest-build-provenance@v1 - with: - subject-path: "target/release/${{ env.BUILD_FILE_NAME }}" - - name: upload + - name: upload binary uses: actions/upload-artifact@v4 with: if-no-files-found: error diff --git a/README.md b/README.md index 9e7deff..d32aa8b 100644 --- a/README.md +++ b/README.md @@ -52,8 +52,12 @@ Any of these will work: ``` 4. Download binaries from [the latest release] (or any other release, of course). - You can also grab the binaries from the latest [build-release] workflow run. You must be logged into GitHub to do - that (this is GitHub's limitation, not mine). You'll have to `chmod +x` them before you can run them. + - Macs quarantine downloads from the internet by default. If you get an error saying that Apple cannot check the the binary for malicious software, you can remove this flag by running the following on the binary after extracting it from the artifact zip: + ```bash + xattr -d com.apple.quarantine mdq + ``` + - You can also grab the binaries from the latest [build-release] workflow run. You must be logged into GitHub to do + that (this is GitHub's limitation, not mine). You'll have to `chmod +x` them before you can run them.
Security concerns diff --git a/scripts/installer.sh b/scripts/installer.sh deleted file mode 100755 index 9de4fe4..0000000 --- a/scripts/installer.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/bash - -mdq_name=mdq -suffix=1 -while [[ -e "$mdq_name" ]]; do - mdq_name="mdq-$suffix" - suffix=$(( $suffix + 1 )) -done - -cat "$0" | awk 'f;/^## BASE64 START/{f=1}' | sed 's/^# *//' | base64 -d > "$mdq_name" -chmod +x "$mdq_name" - -## BASE64 START