Skip to content

Commit 905ce63

Browse files
rmpowell77rmpowell77
authored
Issue #582: Why does CalChart still say it's from an unknown developer when launch on Mac? (#647)
Adding the notorization process to our release process.
1 parent 315c65f commit 905ce63

File tree

2 files changed

+98
-16
lines changed

2 files changed

+98
-16
lines changed

‎.github/workflows/cmake.yml‎

Lines changed: 97 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,6 @@ jobs:
8383
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-14 100 --slave /usr/bin/g++ g++ /usr/bin/g++-14 --slave /usr/bin/gcov gcov /usr/bin/gcov-14
8484
sudo update-alternatives --set gcc /usr/bin/gcc-14
8585
86-
8786
- name: Configure CMake
8887
# Configure CMake in a 'build' subdirectory. `CMAKE_BUILD_TYPE` is only required if you are using a single-configuration generator such as make.
8988
# See https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html?highlight=cmake_build_type
@@ -93,27 +92,109 @@ jobs:
9392
# Build your program with the given configuration
9493
run: cmake --build ${{github.workspace}}/build --config ${{matrix.build_type}}
9594

96-
# Codesigning for mac involves:
97-
# 1. Creating a signing cert in p12 form (https://help.apple.com/xcode/mac/current/#/dev154b28f09)
98-
# 2. Uploading the p12 as github secrets (https://docs.github.com/en/actions/use-cases-and-examples/deploying/installing-an-apple-certificate-on-macos-runners-for-xcode-development)
99-
# 3. Generating the p12 file on the github action server
100-
# 4. using indygreg/apple-code-sign-action@v1 to sign the app
101-
- name: Gen p12 (macOS)
95+
- name: Run tests
96+
run: ctest --verbose --test-dir ${{github.workspace}}/build
97+
98+
# Codesigning and Notorizing for Mac:
99+
# These are the steps you need to do before we run CI to Codesign and Notorize
100+
# prerequisites: You need an Apple Developer Account (Apple ID)
101+
# ✅ Step 1: Generate a Certificate Signing Request (CSR)
102+
# On your Mac, open Keychain Access
103+
# In the menu bar, select:
104+
# Keychain Access → Certificate Assistant → Request a Certificate From a Certificate Authority…
105+
# Fill in:
106+
# User Email Address: your Apple ID
107+
# Common Name: something like Developer ID for CalChart
108+
# CA Email: leave blank
109+
# Request is: ✔ Save to disk
110+
# Click Continue, and save the .certSigningRequest file
111+
# ✅ Step 2: Create a Developer ID Application Certificate
112+
# Go to https://developer.apple.com/account/
113+
# Navigate to Certificates, Identifiers & Profiles
114+
# Under Certificates, click the ➕ button
115+
# Choose:
116+
# Type: Developer ID Application
117+
# Click Continue
118+
# Upload your .certSigningRequest
119+
# Click Continue, then Download the .cer file
120+
# ✅ Step 3: Import the Certificate to Keychain
121+
# Double-click the downloaded .cer file
122+
# It will appear in your login keychain
123+
# Make sure the certificate appears with a private key (expand the triangle in Keychain)
124+
# 🔒 If there's no private key: Something went wrong during CSR generation. Try again from Step 1.
125+
# ✅ Step 4: Export as .p12 for GitHub Use
126+
# In Keychain Access, right-click the certificate → Export
127+
# Choose .p12 format
128+
# Set a strong password (you’ll store this in GitHub Secrets as MACOS_CERTIFICATE_PASSWORD)
129+
# Save the file as DeveloperID.p12
130+
# ✅ Step 5: App-Specific Password for notarytool
131+
# notarytool is going to access the server as you, so create an app-specific password
132+
# If you haven’t already, create an App-Specific Password for your Apple ID .
133+
# https://account.apple.com/account/manage
134+
# Create a password for notarytool (you’ll store this in GitHub Secrets as APP_SPECIFIC_PASSWORD)
135+
# ✅ Step 5: Base64 Encode and Store in GitHub
136+
# Run:
137+
# base64 DeveloperID.p12 | pbcopy
138+
# Then in GitHub, Go to Settings → Secrets and variables → Actions
139+
# Add these secrets:
140+
# MACOS_CERTIFICATE (Paste base64 contents)
141+
# MACOS_CERTIFICATE_PASSWORD (The password you set for export)
142+
# DEVELOPER_ID_APP "Developer ID Application: Your Name (TEAMID)"
143+
# APPLE_ID (Your developer Apple ID)
144+
# APPLE_TEAM_ID (Your developer team (usually 10 alphanumeric digits))
145+
# APP_SPECIFIC_PASSWORD (The notarytool password)
146+
# To get the full identity name, run:
147+
# security find-identity -p codesigning -v
148+
# You'll see:
149+
#
150+
# 1) XXXXXXXX "Developer ID Application: Richard Powell (ABCDE12345)"
151+
# Use that full quoted string in DEVELOPER_ID_APP.
152+
153+
- name: Setup keychain with cert p12 (macOS)
102154
if: matrix.config.os == 'macos-14'
103155
env:
104156
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
105-
run: echo $MACOS_CERTIFICATE | base64 --decode > ${{github.workspace}}/certificate.p12
157+
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
158+
run: |
159+
echo $MACOS_CERTIFICATE | base64 --decode > ${{github.workspace}}/certificate.p12
160+
security create-keychain -p "CalChart" build.keychain
161+
security default-keychain -s build.keychain
162+
security unlock-keychain -p "CalChart" build.keychain
163+
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
164+
security set-key-partition-list -S apple-tool:,apple: -s -k "CalChart" build.keychain
165+
166+
- name: Code sign the app
167+
if: matrix.config.os == 'macos-14'
168+
env:
169+
DEVELOPER_ID_APP: ${{ secrets.DEVELOPER_ID_APP }}
170+
run: |
171+
codesign --deep --force --verify --verbose --timestamp --options runtime \
172+
--sign "$DEVELOPER_ID_APP" \
173+
${{github.workspace}}/build/src/CalChart.app
174+
175+
# Notarizing involves
176+
# 1. Zip the file up
177+
# 2. Notarize using the password and IDs for notarytool
178+
- name: Zip for notarization (macOS)
179+
if: matrix.config.os == 'macos-14'
180+
run: ditto -c -k --keepParent ${{github.workspace}}/build/src/CalChart.app ${{github.workspace}}/build/src/CalChart.zip
106181

107-
- name: Codesign (macOS)
182+
- name: Notarize (macOS)
108183
if: matrix.config.os == 'macos-14'
109-
uses: indygreg/apple-code-sign-action@v1
110-
with:
111-
input_path: ${{github.workspace}}/build/src/CalChart.app
112-
p12_file: ${{github.workspace}}/certificate.p12
113-
p12_password: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
184+
run: |
185+
xcrun notarytool submit ${{github.workspace}}/build/src/CalChart.zip \
186+
--apple-id "$APPLE_ID" \
187+
--team-id "$APPLE_TEAM_ID" \
188+
--password "$APP_SPECIFIC_PASSWORD" \
189+
--wait
190+
env:
191+
APPLE_ID: ${{ secrets.APPLE_ID }}
192+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
193+
APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
114194

115-
- name: Run tests
116-
run: ctest --verbose --test-dir ${{github.workspace}}/build
195+
- name: Staple notarization ticket
196+
if: matrix.config.os == 'macos-14'
197+
run: xcrun stapler staple ${{github.workspace}}/build/src/CalChart.app
117198

118199
- name: Pack (macOS)
119200
if: matrix.config.os == 'macos-14'

‎LATEST_RELEASE_NOTES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
Bugs addressed in this release:
44

5+
* [#582](../../issues/582) Why does CalChart still say it's from an unknown developer when launch on Mac?
56
* [#593](../../issues/593) Are the draw colors for selected and reference inverted on the drawing setup
67
* [#596](../../issues/596) Did flip labels break?
78
* [#598](../../issues/598) ASAN crashes when drawing sprites

0 commit comments

Comments
 (0)