WEBDIENSTE/openswarm
1
0
Fork 0
mirror of https://github.com/openswarm-ai/openswarm.git synced 2026-09-08 02:37:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

[aidan] fix/spotify-drm: VMP-sign packaged builds so Widevine playback works

Browse Source
This commit is contained in:
abccodes
2026-07-01 18:28:53 -07:00
parent ab982afcea
commit fe52665193
7 changed files with 99 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-macos.yml
+12
View File
@@ -13,6 +13,8 @@ name: Release (macOS)
# APPLE_TEAM_ID Apple Developer Team ID
# CSC_LINK base64-encoded Developer ID Application .p12
# CSC_KEY_PASSWORD password for that .p12
# EVS_ACCOUNT_NAME castlabs EVS account name (Widevine VMP signing; free signup)
# EVS_PASSWD password for that EVS account
# GOOGLE_OAUTH_CLIENT_ID shipped in production .env (Google OAuth)
# GOOGLE_OAUTH_CLIENT_SECRET shipped in production .env (Google OAuth)
#
@@ -70,6 +72,8 @@ jobs:
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
CSC_LINK: ${{ secrets.CSC_LINK }}
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
EVS_ACCOUNT_NAME: ${{ secrets.EVS_ACCOUNT_NAME }}
EVS_PASSWD: ${{ secrets.EVS_PASSWD }}
PUBLISH_INPUT: ${{ github.event.inputs.publish }}
steps:
@@ -87,6 +91,14 @@ jobs:
with:
python-version: '3.13'
# Widevine VMP signing tool. The afterPack hook invokes `castlabs_evs.vmp
# sign-pkg` with the EVS_* secrets; without this the build aborts (publish
# path sets VMP_REQUIRE_SIGN=1) rather than ship a DMG with dead Spotify DRM.
- name: Install castlabs-evs (Widevine VMP signing)
if: ${{ env.APPLE_ID != '' }}
shell: bash
run: python3 -m pip install --upgrade castlabs-evs
- name: Build app
# Skip (green) when Apple signing secrets aren't in CI: Mac ships via local
# publish.sh, so a secret-less CI run should no-op, not fail red.
.github/workflows/release-windows.yml
+12
View File
@@ -17,6 +17,8 @@ name: Release (Windows)
# AZURE_SIGNING_ENDPOINT e.g. https://wus2.codesigning.azure.net/
# AZURE_SIGNING_ACCOUNT mist-code-signing
# AZURE_SIGNING_CERT_PROFILE Mist-Windows-Signing
# EVS_ACCOUNT_NAME castlabs EVS account name (Widevine VMP signing; free signup)
# EVS_PASSWD password for that EVS account
# GOOGLE_OAUTH_CLIENT_ID shipped in production .env (Google OAuth)
# GOOGLE_OAUTH_CLIENT_SECRET shipped in production .env (Google OAuth)
# v1.0.29 cloud-proxied the OAuth flow itself,
@@ -77,6 +79,8 @@ jobs:
AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
AZURE_SIGNING_CERT_PROFILE: ${{ secrets.AZURE_SIGNING_CERT_PROFILE }}
EVS_ACCOUNT_NAME: ${{ secrets.EVS_ACCOUNT_NAME }}
EVS_PASSWD: ${{ secrets.EVS_PASSWD }}
PUBLISH_INPUT: ${{ github.event.inputs.publish }}
steps:
@@ -96,6 +100,14 @@ jobs:
with:
python-version: '3.13'
# Widevine VMP signing tool. The afterPack hook invokes `castlabs_evs.vmp
# sign-pkg` with the EVS_* secrets; the -Sign path sets VMP_REQUIRE_SIGN=1 so
# a missing/failed signature aborts the build rather than ship an installer
# whose Spotify/Netflix audio is silently dead.
- name: Install castlabs-evs (Widevine VMP signing)
shell: pwsh
run: python -m pip install --upgrade castlabs-evs
# The signing hook calls `signtool.exe` directly. signtool ships in the
# Windows 10 SDK, preinstalled on windows-latest runners — we just need
# the dlib for Azure Trusted Signing, pulled via NuGet.