macOS signing + notarization - #659
Conversation
|
Apparently this CI build is crashing for others, so I need to test the artifacts? The fully signed thing worked locally but I'll iron out the kinks here. |
|
OK these should run. Tested locally. |
|
Draft until I get time to review this in full. |
891c84d to
aa16d03
Compare
arch1t3cht
left a comment
arch1t3cht
left a comment
There was a problem hiding this comment.
Most of this seems fine to me, given that it's build-system wrangling that mainly has to work on the CI and the release build machine. Just a few notes.
| if: startsWith(matrix.config.os, 'macos-') && matrix.config.buildtype == 'release' | ||
| with: | ||
| name: ${{ matrix.config.name }} - installer | ||
| name: ${{ matrix.config.name }} - ad-hoc installer |
There was a problem hiding this comment.
If the mac debug jobs no longer upload their bundles as artifacts, is there a reason why they're still kept around at all? I guess to make sure that Aegisub still builds with homebrew's libraries and/or do document how to do so?
There was a problem hiding this comment.
Yes, it's to ensure homebrew keeps working. The artifacts were never very useful.
| target: 'wxmono') | ||
| endif | ||
|
|
||
| if libpng_dep.type_name() == 'internal' |
There was a problem hiding this comment.
FWIW, libpng is not actually needed as a dependency outside of wxWidgets. (It's an optional dependency for libass and freetype, but libass only needs it for its test program, and freetype is only required by libass which does not need it's libpng-dependent features.) So it could also be removed entirely, unless there's some reason why the wrap should be preferred to wxWidgets's builtin version, or libpng is likely to be needed by Aegisub itself in the future.
| codesign -s ${AEGISUB_BUNDLE_SIGNATURE:--} -vf "${PKG_DIR}/" | ||
| # Preserve the historical ability to request a Developer ID-signed bundle, | ||
| # while treating an unset identity as a development/ad-hoc operation. An | ||
| # explicitly set but empty identity is still rejected by osx-sign.sh. |
There was a problem hiding this comment.
Somewhat redundant comment. Also, if I understand the logic correctly, it can also be written more concisely as just
AEGISUB_BUNDLE_SIGNATURE=${AEGISUB_BUNDLE_SIGNATURE:--} "${SRC_DIR}/tools/osx-sign.sh" "${SRC_DIR}" "${PKG_DIR}"In fact, I'd also be fine with removing the fallback logic entirely, seeing as the CI and README already document that AEGISUB_BUNDLE_SIGNATURE should be explicitly set.
Keep Developer ID and notarization credentials off CI by uploading an ad-hoc-signed app handoff for tags and manual runs. Add local signing, DMG, and notarization targets and architecture-specific package names.
3872062 to
6242e3a
Compare
2 participants
In preparation for 3.5.0. Seems to work locally at least!