Skip to content

Build and sign macOS, try 206 #205

Build and sign macOS, try 206

Build and sign macOS, try 206 #205

# This workflow will build a Java project with Ant
#
# ===================================================================================================
# NB: 2025.05.16
# This was an attempt to build, sign, and notarize LingTree, a JavaFX app.
# While it does do all three, when invoked, it crashes as if the embedded Java runtime is corrupted.
# ===================================================================================================
#
name: macOS Build Installer with Version and sign
env:
NOTARIZE_PASSWORD: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }}
NOTARIZE_APPLE_ID: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }}
NOTARIZE_TEAM_ID: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }}
on:
push:
branches: [ "buildSignMacOS" ]
# tags:
# - 'v*' # Build the app for commits that are tagged starting with 'v' e.g. v1.2.3
# to tag a commit, use "git tag v1.2.3"
# when you then use "git push origin v1.2.3" this workflow will be invoked
# workflow_dispatch:
jobs:
build-installer:
runs-on: macos-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: '0'
- name: Set VERSION (e.g. 1.0.0) and FULL_VERSION (e.g. 1.0.0-abcdef4)
run: |
VERSION="1.6.3"
SHORT_SHA=$(git rev-parse --short HEAD)
FULL_VERSION="-macOS"
echo "VERSION=${VERSION}" >> $GITHUB_ENV
echo "FULL_VERSION=${FULL_VERSION}" >> $GITHUB_ENV
# VERSION="${GITHUB_REF#refs/tags/v}"
# SHORT_SHA=$(git rev-parse --short HEAD)
# FULL_VERSION="${VERSION}-${SHORT_SHA}"
shell: bash
- name: Validate version format
run: |
echo ${VERSION}
if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Error: Version format is incorrect. It should match N.N.N where N is an integer."
exit 1
fi
shell: bash
# - name: Build version ${{ env.VERSION }}
# - uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'zulu'
java-package: 'jdk+fx'
architecture: 'aarch64'
- name: Build with Ant
run: |
ant -noinput -buildfile build.xml
shell: bash
- name: Run the macOS installer script
run: |
cd installer/macos
chmod +x *.sh
./BuildMacOS.sh ${{ env.VERSION }}
shell: bash
- name: Rename dmg file with version and architecture
env:
PUBLISH_PATH: 'installer/macos'
run: |
ls -l ${{env.PUBLISH_PATH}}
mv ${{env.PUBLISH_PATH}}/LingTree-${{ env.VERSION }}.dmg LingTree-${{ env.VERSION }}.dmg
- uses: actions/upload-artifact@v4
with:
name: LingTree
path: LingTree-*.dmg
if-no-files-found: error
sign-installer:
name: Sign LingTree installer
needs: build-installer
runs-on: macos-latest
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v3
- uses: actions/download-artifact@v4
with:
name: LingTree
# If a notarization fails, uncomment the following and replace the GUID with the one from
# notarization output
# Get notarization log of last run
# - name: Get notarization log
# run: |
# echo Before trying to get notarization log of last run
# xcrun notarytool log 1445e26f-b7dc-409e-a4b5-a7ade66f6bef --apple-id ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} --team-id "3YE4W86L3G" --password ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }}
- name: Add certificate to Keychain
env:
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
MACOS_CERTIFICATE_PWD: ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }}
run: |
# Create a temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
# Import the certificate
curl -O ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_CERT_URL }}
security import sil_developer_id_application_cert.p12 -k build.keychain -P ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }} -T /usr/bin/codesign
# Allow codesign to access the certificate without prompts
#echo before allow codesign to access the certificate without prompts
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
#echo after allow codesign to access the certificate without prompts
- name: Attach dmg
run: |
yes | PAGER=cat hdiutil attach LingTree-*.dmg
echo
echo ls
ls /Volumes/LingTree
- name: Sign dmg and app
run: |
mkdir dmgContents
cp -R /Volumes/LingTree dmgContents
cd dmgContents/LingTree
cd LingTree.app/Contents/app/
jar xf lingtree.jar resources/Keyboards/macOS/xkbswitch org/sil/lingtree/resources/Keyboards/macOS/xkbswitch
chmod a+w resources/Keyboards/macOS/xkbswitch
chmod a+w org/sil/lingtree/resources/Keyboards/macOS/xkbswitch
#echo sign xkbswitch
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime resources/Keyboards/macOS/xkbswitch -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime org/sil/lingtree/resources/Keyboards/macOS/xkbswitch -v
#echo before updating xkbswitch in lingtree.jar
jar uf lingtree.jar resources/Keyboards/macOS/xkbswitch org/sil/lingtree/resources/Keyboards/macOS/xkbswitch
rm -r org
cd libs/jna/
jar xf jna-5.11.0.jar com/sun/jna/darwin-aarch64/libjnidispatch.jnilib com/sun/jna/darwin-x86-64/libjnidispatch.jnilib
#echo sign jna
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime com/sun/jna/darwin-aarch64/libjnidispatch.jnilib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime com/sun/jna/darwin-x86-64/libjnidispatch.jnilib -v
#echo update jna
jar uf jna-5.11.0.jar com/sun/jna/darwin-aarch64/libjnidispatch.jnilib com/sun/jna/darwin-x86-64/libjnidispatch.jnilib
rm -r com
cd ../../../../..
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/MacOS/LingTree -v
# ------------- sign all JavaFX runtime executables included in the app
# without this, the notarization fails.
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libnet.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libnio.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libinstrument.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavafx_iio.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libzip.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfreetype.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjli.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libsplashscreen.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement_ext.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libdt_socket.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2pkcs11.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjimage.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxmedia_avf.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxkrb5.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxui.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libglib-lite.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement_agent.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/librmi.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjdwp.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libawt_lwawt.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfxplugins.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libglass.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavajpeg.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmlib_image.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavafx_font.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libgstreamer-lite.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjsound.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxwebkit.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2pcsc.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjsig.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprefs.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libsyslookup.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjawt.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libattach.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_common.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_es2.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfontmanager.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/jspawnhelper -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxsecurity.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libextnet.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libdecora_sse.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjaas.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/liblcms.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libverify.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2gss.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjava.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libawt.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosx.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxmedia.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_sw.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxapp.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/server/libjvm.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/server/libjsig.dylib -v
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/MacOS/libjli.dylib -v
# ------------- sign the main app itself
echo sign LingTree.app
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime --deep LingTree.app -v
echo verify the app
codesign -vvv --deep --strict LingTree.app
cd ..
echo recreate dmg
pwd
#ln -s /Applications LingTree/Applications
#hdiutil create -volname LingTreeInstaller -srcfolder LingTree -fs HFS+ -format UDRW LingTreeSigned.dmg
hdiutil create -volname LingTreeInstaller -srcfolder LingTree -ov -format UDZO LingTree-1.6.2.dmg
mv LingTree-1.6.2.dmg ../LingTree-1.6.2.dmg
cd ..
echo sign dmg
codesign --deep --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree-1.6.2.dmg -v
#echo rename to include version number
#mv LingTreeSigned.dmg LingTree-${{ env.VERSION }}.dmg
#echo time stamp for signed dmg:
#ls -l LingTreeSigned.dmg
# Verify the signature
- name: Verify signature
run: |
codesign --verify --verbose LingTree-1.6.2.dmg
ls -l /Applications
# # Clean up keychain
# - name: Clean up keychain
# if: always()
# run: |
# security delete-keychain build.keychain || true
# Notarize the DMG
- name: Notarize DMG
uses: GuillaumeFalourd/notary-tools@v1
with:
product_path: LingTree-1.6.2.dmg
apple_id: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }}
password: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }}
team_id: "3YE4W86L3G"
# Not mandatory inputs
staple: 'false'
xcode_path: '/Applications/Xcode_26.app'
# uses: lando/notarize-action@v2
# with:
# product-path: LingTree-1.6.2.dmg
# appstore-connect-username: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }}
# appstore-connect-password: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }}
# appstore-connect-team-id: "3YE4W86L3G"
# verbose: true
# Staple the notarization ticket
- name: Staple Notarization Ticket
run: |
#echo time stamp for stapling
#ls -l LingTree-1.6.2.dmg
#echo before stapling
xcrun stapler staple LingTree-1.6.2.dmg
#echo after stapling
#ls -l LingTreeSigned.dmg
echo rename to include version number
#cp LingTreeSigned.dmg LingTree-${{ env.VERSION }}.dmg
# - name: Create Release
# uses: softprops/action-gh-release@v2
# with:
# files: LingTree-*.dmg
# body: |
# Release for version ${{ github.ref }}
# draft: true
- uses: actions/upload-artifact@v4
with:
name: LingTreeSigned
path: LingTree*.dmg
#path: LingTree-*.dmg
if-no-files-found: error
# - uses: actions/upload-artifact@v4
# with:
# name: LingTreeApp
# path: LingTree.App
# #path: LingTree-*.dmg
# if-no-files-found: error
create-release:
name: Create Release
needs: sign-installer
runs-on: macos-latest
steps:
- uses: actions/download-artifact@v4
with:
name: LingTreeSigned
- name: Create Release
uses: softprops/action-gh-release@v2
with:
files: LingTree*.dmg
#files: LingTree-*.dmg
body: |
Release for version ${{ github.ref }}
draft: true