fix: macos bin siging

Author: dylanhitt

.github/workflows/publish.yml

@@ -9,11 +9,11 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     env:
-      QUILL_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
-      QUILL_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
-      QUILL_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
-      QUILL_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
-      QUILL_NOTARY_ISSUER: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+      MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+      MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+      MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+      MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+      MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
     steps:
       - uses: actions/checkout@v6
 
@@ -22,10 +22,6 @@ jobs:
         with:
           go-version-file: "./go.mod"
 
-      - name: Install quill
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /usr/local/bin
-
       - name: GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.goreleaser.yaml

@@ -38,16 +38,18 @@ nfpms:
       - deb
       - rpm
 
-signs:
-  - cmd: quill
-    args:
-      - sign-and-notarize
-      - "${artifact}"
-      - --dry-run={{ .IsSnapshot }}
-      - --ad-hoc={{ .IsSnapshot }}
-      - -vv
-    artifacts: binary
-    output: true
+notarize:
+  macos:
+    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
+      sign:
+        certificate: "{{.Env.MACOS_SIGN_P12}}"
+        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
+      notarize:
+        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
+        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
+        key: "{{.Env.MACOS_NOTARY_KEY}}"
+        wait: true
+        timeout: 20m
 
 changelog:
   sort: asc