Skip to content

Commit e35d84d

Browse files
DumbrisDumbris
authored
ci(release): retry notarization stapling on Apple network errors (#1654)
xcrun stapler staple failed with Apple CloudKit 'The network connection was lost' (exit 68) on the macOS amd64 build of v0.71.0-rc.1 and the arm64 build of v0.71.0 today; both passed on re-run. Wraps every stapler staple/validate call in release.yml and prerelease.yml in a 5-attempt retry with linear backoff (15-75 s). A genuine failure still fails the job after the last attempt.
1 parent c4af2ff commit e35d84d

2 files changed

Lines changed: 62 additions & 10 deletions

File tree

‎.github/workflows/prerelease.yml‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -733,8 +733,18 @@ jobs:
733733
echo "${SUBMISSION_ID}" > "${FILE_NAME}.submission_id"
734734
735735
echo "Stapling notarization ticket to ${FILE_LABEL}"
736-
xcrun stapler staple "${FILE_NAME}"
737-
xcrun stapler validate "${FILE_NAME}"
736+
# Apple ticket delivery (CloudKit) drops connections intermittently
737+
# ("network connection was lost", exit 68); retry with backoff.
738+
for attempt in 1 2 3 4 5; do
739+
xcrun stapler staple "${FILE_NAME}" && break
740+
if [ "$attempt" = 5 ]; then exit 1; fi
741+
echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
742+
done
743+
for attempt in 1 2 3 4 5; do
744+
xcrun stapler validate "${FILE_NAME}" && break
745+
if [ "$attempt" = 5 ]; then exit 1; fi
746+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
747+
done
738748
}
739749
740750
notarize_and_staple "${PKG_NAME}" "PKG installer"
@@ -794,16 +804,32 @@ jobs:
794804
exit 1
795805
fi
796806
797-
xcrun stapler staple "${APP_SRC}"
798-
xcrun stapler validate "${APP_SRC}"
807+
# Apple ticket delivery (CloudKit) drops connections intermittently
808+
# ("network connection was lost", exit 68); retry with backoff.
809+
for attempt in 1 2 3 4 5; do
810+
xcrun stapler staple "${APP_SRC}" && break
811+
if [ "$attempt" = 5 ]; then exit 1; fi
812+
echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
813+
done
814+
for attempt in 1 2 3 4 5; do
815+
xcrun stapler validate "${APP_SRC}" && break
816+
if [ "$attempt" = 5 ]; then exit 1; fi
817+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
818+
done
799819
800820
ditto -c -k --sequesterRsrc --keepParent "${APP_SRC}" "sparkle-enclosure/${ENCLOSURE}"
801821
rm -f "${NOTARIZE_ZIP}"
802822
803823
VERIFY_DIR=$(mktemp -d)
804824
ditto -x -k "sparkle-enclosure/${ENCLOSURE}" "${VERIFY_DIR}"
805825
codesign --verify --deep --strict --verbose=2 "${VERIFY_DIR}/mcpproxy.app"
806-
xcrun stapler validate "${VERIFY_DIR}/mcpproxy.app"
826+
# Apple ticket delivery (CloudKit) drops connections intermittently
827+
# ("network connection was lost", exit 68); retry with backoff.
828+
for attempt in 1 2 3 4 5; do
829+
xcrun stapler validate "${VERIFY_DIR}/mcpproxy.app" && break
830+
if [ "$attempt" = 5 ]; then exit 1; fi
831+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
832+
done
807833
rm -rf "${VERIFY_DIR}"
808834
809835
echo "✅ Sparkle enclosure ready: ${ENCLOSURE}"

‎.github/workflows/release.yml‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1005,8 +1005,18 @@ jobs:
10051005
echo "${SUBMISSION_ID}" > "${FILE_NAME}.submission_id"
10061006
10071007
echo "Stapling notarization ticket to ${FILE_LABEL}"
1008-
xcrun stapler staple "${FILE_NAME}"
1009-
xcrun stapler validate "${FILE_NAME}"
1008+
# Apple ticket delivery (CloudKit) drops connections intermittently
1009+
# ("network connection was lost", exit 68); retry with backoff.
1010+
for attempt in 1 2 3 4 5; do
1011+
xcrun stapler staple "${FILE_NAME}" && break
1012+
if [ "$attempt" = 5 ]; then exit 1; fi
1013+
echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
1014+
done
1015+
for attempt in 1 2 3 4 5; do
1016+
xcrun stapler validate "${FILE_NAME}" && break
1017+
if [ "$attempt" = 5 ]; then exit 1; fi
1018+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
1019+
done
10101020
}
10111021
10121022
notarize_and_staple "${PKG_NAME}" "PKG installer"
@@ -1083,8 +1093,18 @@ jobs:
10831093
10841094
# Staple the BUNDLE, then re-archive it: the ticket must travel inside
10851095
# the .app the user ends up running.
1086-
xcrun stapler staple "${APP_SRC}"
1087-
xcrun stapler validate "${APP_SRC}"
1096+
# Apple ticket delivery (CloudKit) drops connections intermittently
1097+
# ("network connection was lost", exit 68); retry with backoff.
1098+
for attempt in 1 2 3 4 5; do
1099+
xcrun stapler staple "${APP_SRC}" && break
1100+
if [ "$attempt" = 5 ]; then exit 1; fi
1101+
echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
1102+
done
1103+
for attempt in 1 2 3 4 5; do
1104+
xcrun stapler validate "${APP_SRC}" && break
1105+
if [ "$attempt" = 5 ]; then exit 1; fi
1106+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
1107+
done
10881108
10891109
echo "=== Creating the stapled enclosure ==="
10901110
ditto -c -k --sequesterRsrc --keepParent "${APP_SRC}" "sparkle-enclosure/${ENCLOSURE}"
@@ -1096,7 +1116,13 @@ jobs:
10961116
VERIFY_DIR=$(mktemp -d)
10971117
ditto -x -k "sparkle-enclosure/${ENCLOSURE}" "${VERIFY_DIR}"
10981118
codesign --verify --deep --strict --verbose=2 "${VERIFY_DIR}/mcpproxy.app"
1099-
xcrun stapler validate "${VERIFY_DIR}/mcpproxy.app"
1119+
# Apple ticket delivery (CloudKit) drops connections intermittently
1120+
# ("network connection was lost", exit 68); retry with backoff.
1121+
for attempt in 1 2 3 4 5; do
1122+
xcrun stapler validate "${VERIFY_DIR}/mcpproxy.app" && break
1123+
if [ "$attempt" = 5 ]; then exit 1; fi
1124+
echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
1125+
done
11001126
spctl -a -t exec -vv "${VERIFY_DIR}/MCPProxy.app"
11011127
rm -rf "${VERIFY_DIR}"
11021128

0 commit comments

Comments
 (0)