-
Notifications
You must be signed in to change notification settings - Fork 27
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #380 from christofmuc/features/code_signing
Add embedded Python and code signing for MacOS
- Loading branch information
Showing
9 changed files
with
299 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| # MAC OS ONLY! | ||
| # | ||
| # This Makefile is only there to help building the MacOS DMG files, codesign them, notarize and staple | ||
| # and verify all of this. If you are using a normal, sane OS, you can ignore this Makefile | ||
| # and do the regular CMake process. Checkout the .github/workflows files for the authoritative way to build | ||
| # for your platform | ||
| # | ||
|
|
||
| BUILD_DIR?=.builds/universal_again | ||
| BUILD_TYPE?=Debug | ||
|
|
||
| # Determine the version the same way cmake does | ||
| VERSION=$(shell cmake -P The-Orm/gitversion.cmake 2>&1 >/dev/null) | ||
|
|
||
| # Make sure to setup a Python that matches the universal build/fat binary or the architecture build | ||
| # This can be really messy if you have - like me - multiple versions of Python installed on the Mac. | ||
| # Closely watch the build output to detect and inconsistencies during configuration, linking, or bundle fixing! | ||
| # Worst case, uninstall all Pythons except the one you want to use. | ||
| PYTHON_SOURCE=/Library/Frameworks/Python.framework/Versions/3.12 | ||
|
|
||
| # Setup variables for the various build artifacts and their names | ||
| KNOBKRAFT=KnobKraft_Orm-$(VERSION)-Darwin | ||
| KNOBKRAFT_APP=$(BUILD_DIR)/The-Orm/KnobKraftOrm.app | ||
| KNOBKRAFT_DMG=$(BUILD_DIR)/$(KNOBKRAFT).dmg | ||
| KNOBKRAFT_MOUNT=/Volumes/$(KNOBKRAFT) | ||
| KNOBKRAFT_MOUNTED_APP=$(KNOBKRAFT_MOUNT)/KnobKraftOrm.app | ||
|
|
||
| # Some more paths | ||
| PYTHON_TO_USE=$(PYTHON_SOURCE)/bin/python3 | ||
|
|
||
|
|
||
| all: configure build sign-dmg verify-signed | ||
|
|
||
| apple: notarize staple verify-notarization | ||
|
|
||
| configure: | ||
| @echo "Configuring build for type $(BUILD_TYPE) in directory $(BUILD_DIR), using Python from $(PYTHON_TO_USE)" | ||
| cmake -S . -B $(BUILD_DIR) -DCMAKE_BUILD_TYPE=$(BUILD_TYPE) -DPYTHON_EXECUTABLE=$(PYTHON_TO_USE) -DCODESIGN_CERTIFICATE_NAME="$(APPLE_DEVELOPER_IDENTITY)" | ||
|
|
||
| .PHONY: build | ||
| build $(KNOBKRAFT_DMG): | ||
| cmake --build $(BUILD_DIR) --target package --parallel $(shell sysctl -n hw.ncpu) | ||
|
|
||
| $(KNOBKRAFT_MOUNT): $(KNOBKRAFT_DMG) | ||
| hdiutil detach $@ ; true | ||
| yes | PAGER=cat hdiutil attach $< | ||
|
|
||
| attach: $(KNOBKRAFT_MOUNT) | ||
|
|
||
| detach: $(KNOBKRAFT_MOUNT)/KnobKraftOrm.app | ||
| hdiutil detach $(KNOBKRAFT_MOUNT) | ||
|
|
||
| app-signed: attach | ||
| codesign --verify -v --strict $(KNOBKRAFT_MOUNTED_APP) | ||
|
|
||
| binary-signed: $(KNOBKRAFT_APP) | ||
| codesign --verify -v --strict $(KNOBKRAFT_APP) | ||
|
|
||
| dmg-signed: $(KNOBKRAFT_DMG) | ||
| codesign --verify -v --strict $< | ||
|
|
||
| verify-signed: binary-signed app-signed dmg-signed | ||
|
|
||
| sign-dmg: $(KNOBKRAFT_DMG) | ||
| codesign --force --verbose=2 --sign "$(TEAM_ID)" $< | ||
|
|
||
| show-dmg-signature: $(KNOBKRAFT_DMG) | ||
| codesign -dvvv $< | ||
|
|
||
| .PHONY: notarize | ||
| # https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution?language=objc | ||
| # https://scriptingosx.com/2021/07/notarize-a-command-line-tool-with-notarytool/ | ||
| # https://melatonin.dev/blog/how-to-code-sign-and-notarize-macos-audio-plugins-in-ci/ (https://github.com/sudara/pamplejuce/tree/main) | ||
| notarize: $(KNOBKRAFT_DMG) | ||
| @xcrun notarytool submit $< \ | ||
| --team-id $(TEAM_ID) \ | ||
| --apple-id $(APPLE_ID) \ | ||
| --password $(APPLE_APP_SPECIFIC_PASSWORD) \ | ||
| --wait | ||
|
|
||
| staple: $(KNOBKRAFT_DMG) | ||
| xcrun stapler staple $< | ||
|
|
||
| verify-notarization: $(KNOBKRAFT_DMG) | ||
| xcrun spctl --assess --type open --context context:primary-signature --ignore-cache --verbose=2 $< | ||
| xcrun spctl --assess --type install --ignore-cache --verbose=2 $< | ||
|
|
||
| run-app: $(KNOBKRAFT_APP) | ||
| open $< | ||
|
|
||
| run-dmg: attach | ||
| open $(KNOBKRAFT_MOUNTED_APP) | ||
|
|
||
| debug-codesign: | ||
| cmake -DPYTHON_SOURCE=$(PYTHON_SOURCE) -DSIGN_DIRECTORY=`pwd`/$(KNOBKRAFT_APP) -DENTITLEMENTS_FILE=./The-Orm/Codesign.entitlements -DCODESIGN_CERTIFICATE_NAME="$(CODESIGN_CERTIFICATE_NAME)" -P cmake/codesign.cmake | ||
|
|
||
|
|
||
| kill: | ||
| killall KnobKraftOrm | ||
|
|
||
| realclean: | ||
| rm -rf $(BUILD_DIR) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
| <dict> | ||
| <!--key>com.apple.security.app-sandbox</key><true/--> | ||
| </dict> | ||
| </plist> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
| <dict> | ||
| <!-- Application Identifier --> | ||
| <key>CFBundleIdentifier</key> | ||
| <string>com.knobkraft.orm</string> | ||
|
|
||
| <!-- Application Name --> | ||
| <key>CFBundleName</key> | ||
| <string>KnobKraftOrm</string> | ||
|
|
||
| <!-- Minimum System Version (macOS version) --> | ||
| <key>LSMinimumSystemVersion</key> | ||
| <string>10.12</string> | ||
| </dict> | ||
| </plist> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
|
|
||
| find_package(Git) | ||
| if(GIT_FOUND) | ||
| execute_process( | ||
| COMMAND ${GIT_EXECUTABLE} describe --tags --dirty=-dev --long | ||
| WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" | ||
| OUTPUT_VARIABLE "PROJECT_VERSION_FULL" | ||
| ERROR_QUIET | ||
| OUTPUT_STRIP_TRAILING_WHITESPACE | ||
| ) | ||
| else() | ||
| set(PROJECT_VERSION_FULL "unknown") | ||
| endif() | ||
|
|
||
| # Break up the version, number of commits, and the dev tag into parts | ||
| string(REGEX REPLACE "^([0-9]+\\.[0-9]+\\.[0-9]+).*" "\\1" PROJECT_VERSION ${PROJECT_VERSION_FULL}) | ||
| string(REGEX REPLACE "^[0-9]+\\.[0-9]+\\.[0-9]+-([0-9]+).*" "\\1" PROJECT_TWEAK_VERSION ${PROJECT_VERSION_FULL}) | ||
| string(REGEX REPLACE "^[0-9]+\\.[0-9]+\\.[0-9]+-[0-9]+-g[0-9a-f]+(.*)" "\\1" PROJECT_DEV_TAG ${PROJECT_VERSION_FULL}) | ||
|
|
||
| # If there were no new commits, PROJECT_TWEAK_VERSION will contain a hash or "-dev", so we need to set it to 0 in that case. | ||
| if(PROJECT_TWEAK_VERSION MATCHES "-g[0-9a-f]+.*") | ||
| set(PROJECT_TWEAK_VERSION 0) | ||
| endif() | ||
|
|
||
| # Append the tweak version if it's not 0 | ||
| if(NOT PROJECT_TWEAK_VERSION EQUAL 0) | ||
| set(PROJECT_VERSION ${PROJECT_VERSION}.${PROJECT_TWEAK_VERSION}) | ||
| endif() | ||
| cmake_policy(SET CMP0140 NEW) | ||
| message(${PROJECT_VERSION}) | ||
| #return(PROPAGATE ${PROJECT_VERSION}) |
Oops, something went wrong.