ci: verify that installers we build function and are signed (#3432)

Signed-off-by: Jared Van Bortel <jared@nomic.ai>
2025-04-28 03:41:58 +00:00 · 2025-01-29 11:29:20 -05:00 · 2025-01-29 11:29:20 -05:00 · adafa17c37
commit adafa17c37
parent 343a4b6b6a
1 changed files with 72 additions and 0 deletions
--- a/.circleci/continue_config.yml
+++ b/.circleci/continue_config.yml
@ -186,6 +186,21 @@ jobs:
            xcrun stapler staple build/upload/gpt4all-installer-darwin-signed.dmg
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Install Rosetta
+          command: softwareupdate --install-rosetta --agree-to-license  # needed for QtIFW
+      - run:
+          name: Test installation and verify that it is signed
+          command: |
+            set -e
+            hdiutil attach build/upload/gpt4all-installer-darwin-signed.dmg
+            codesign --verify --deep --verbose /Volumes/gpt4all-installer-darwin/gpt4all-installer-darwin.app
+            /Volumes/gpt4all-installer-darwin/gpt4all-installer-darwin.app/Contents/MacOS/gpt4all-installer-darwin \
+              --no-size-checking --default-answer --accept-licenses --confirm-command \
+              install gpt4all
+            codesign --verify --deep --verbose /Applications/gpt4all/bin/gpt4all.app
+            codesign --verify --deep --verbose /Applications/gpt4all/maintenancetool.app
+            hdiutil detach /Volumes/gpt4all-installer-darwin

  build-online-chat-installer-macos:
    macos:
@ -333,6 +348,22 @@ jobs:
            xcrun stapler staple build/upload/gpt4all-installer-darwin-signed.dmg
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Install Rosetta
+          command: softwareupdate --install-rosetta --agree-to-license  # needed for QtIFW
+      - run:
+          name: Test installation and verify that it is signed
+          command: |
+            set -e
+            hdiutil attach build/upload/gpt4all-installer-darwin-signed.dmg
+            codesign --verify --deep --verbose /Volumes/gpt4all-installer-darwin/gpt4all-installer-darwin.app
+            tar -xf build/upload/repository.tar.gz
+            /Volumes/gpt4all-installer-darwin/gpt4all-installer-darwin.app/Contents/MacOS/gpt4all-installer-darwin \
+              --no-size-checking --default-answer --accept-licenses --confirm-command --set-temp-repository repository \
+              install gpt4all
+            codesign --verify --deep --verbose /Applications/gpt4all/bin/gpt4all.app
+            codesign --verify --deep --verbose /Applications/gpt4all/maintenancetool.app
+            hdiutil detach /Volumes/gpt4all-installer-darwin

  build-offline-chat-installer-linux:
    machine:
@ -415,6 +446,13 @@ jobs:
          when: always
          paths:
            - ../.ccache
+      - run:
+          name: Test installation
+          command: |
+            mkdir ~/Desktop
+            build/upload/gpt4all-installer-linux.run --no-size-checking --default-answer --accept-licenses \
+              --confirm-command \
+              install gpt4all

  build-online-chat-installer-linux:
    machine:
@ -498,6 +536,14 @@ jobs:
          when: always
          paths:
            - ../.ccache
+      - run:
+          name: Test installation
+          command: |
+            mkdir ~/Desktop
+            build/upload/gpt4all-installer-linux.run --no-size-checking --default-answer --accept-licenses \
+              --confirm-command \
+              --set-temp-repository build/_CPack_Packages/Linux/IFW/gpt4all-installer-linux/repository \
+              install gpt4all

  build-offline-chat-installer-windows:
    machine:
@ -627,6 +673,12 @@ jobs:
            AzureSignTool.exe sign -du "https://gpt4all.io/index.html" -kvu https://gpt4all.vault.azure.net -kvi "$Env:AZSignGUID" -kvs "$Env:AZSignPWD" -kvc "$Env:AZSignCertName" -kvt "$Env:AZSignTID" -tr http://timestamp.digicert.com -v "$($(Get-Location).Path)\build\upload\gpt4all-installer-win64.exe"
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Test installation
+          command: |
+            build\upload\gpt4all-installer-win64.exe --no-size-checking --default-answer --accept-licenses `
+              --confirm-command `
+              install gpt4all

  build-online-chat-installer-windows:
    machine:
@ -767,6 +819,13 @@ jobs:
            AzureSignTool.exe sign -du "https://gpt4all.io/index.html" -kvu https://gpt4all.vault.azure.net -kvi "$Env:AZSignGUID" -kvs "$Env:AZSignPWD" -kvc "$Env:AZSignCertName" -kvt "$Env:AZSignTID" -tr http://timestamp.digicert.com -v "$($(Get-Location).Path)/build/upload/gpt4all-installer-win64.exe"
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Test installation
+          command: |
+            Expand-Archive -LiteralPath build\upload\repository.zip -DestinationPath .
+            build\upload\gpt4all-installer-win64.exe --no-size-checking --default-answer --accept-licenses `
+              --confirm-command --set-temp-repository repository `
+              install gpt4all

  build-offline-chat-installer-windows-arm:
    machine:
@ -889,6 +948,12 @@ jobs:
            AzureSignTool.exe sign -du "https://gpt4all.io/index.html" -kvu https://gpt4all.vault.azure.net -kvi "$Env:AZSignGUID" -kvs "$Env:AZSignPWD" -kvc "$Env:AZSignCertName" -kvt "$Env:AZSignTID" -tr http://timestamp.digicert.com -v "$($(Get-Location).Path)\build\upload\gpt4all-installer-win64-arm.exe"
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Test installation
+          command: |
+            build\upload\gpt4all-installer-win64-arm.exe --no-size-checking --default-answer --accept-licenses `
+              --confirm-command `
+              install gpt4all

  build-online-chat-installer-windows-arm:
    machine:
@ -1022,6 +1087,13 @@ jobs:
            AzureSignTool.exe sign -du "https://gpt4all.io/index.html" -kvu https://gpt4all.vault.azure.net -kvi "$Env:AZSignGUID" -kvs "$Env:AZSignPWD" -kvc "$Env:AZSignCertName" -kvt "$Env:AZSignTID" -tr http://timestamp.digicert.com -v "$($(Get-Location).Path)/build/upload/gpt4all-installer-win64-arm.exe"
      - store_artifacts:
          path: build/upload
+      - run:
+          name: Test installation
+          command: |
+            Expand-Archive -LiteralPath build\upload\repository.zip -DestinationPath .
+            build\upload\gpt4all-installer-win64-arm.exe --no-size-checking --default-answer --accept-licenses `
+              --confirm-command --set-temp-repository repository `
+              install gpt4all

  build-gpt4all-chat-linux:
    machine: