Build and sign macOS, try 206 #205
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# This workflow will build a Java project with Ant | |
# | |
# =================================================================================================== | |
# NB: 2025.05.16 | |
# This was an attempt to build, sign, and notarize LingTree, a JavaFX app. | |
# While it does do all three, when invoked, it crashes as if the embedded Java runtime is corrupted. | |
# =================================================================================================== | |
# | |
name: macOS Build Installer with Version and sign | |
env: | |
NOTARIZE_PASSWORD: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }} | |
NOTARIZE_APPLE_ID: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} | |
NOTARIZE_TEAM_ID: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} | |
on: | |
push: | |
branches: [ "buildSignMacOS" ] | |
# tags: | |
# - 'v*' # Build the app for commits that are tagged starting with 'v' e.g. v1.2.3 | |
# to tag a commit, use "git tag v1.2.3" | |
# when you then use "git push origin v1.2.3" this workflow will be invoked | |
# workflow_dispatch: | |
jobs: | |
build-installer: | |
runs-on: macos-latest | |
steps: | |
- name: Checkout | |
uses: actions/checkout@v4 | |
with: | |
fetch-depth: '0' | |
- name: Set VERSION (e.g. 1.0.0) and FULL_VERSION (e.g. 1.0.0-abcdef4) | |
run: | | |
VERSION="1.6.3" | |
SHORT_SHA=$(git rev-parse --short HEAD) | |
FULL_VERSION="-macOS" | |
echo "VERSION=${VERSION}" >> $GITHUB_ENV | |
echo "FULL_VERSION=${FULL_VERSION}" >> $GITHUB_ENV | |
# VERSION="${GITHUB_REF#refs/tags/v}" | |
# SHORT_SHA=$(git rev-parse --short HEAD) | |
# FULL_VERSION="${VERSION}-${SHORT_SHA}" | |
shell: bash | |
- name: Validate version format | |
run: | | |
echo ${VERSION} | |
if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
echo "Error: Version format is incorrect. It should match N.N.N where N is an integer." | |
exit 1 | |
fi | |
shell: bash | |
# - name: Build version ${{ env.VERSION }} | |
# - uses: actions/checkout@v4 | |
- name: Set up JDK 17 | |
uses: actions/setup-java@v4 | |
with: | |
java-version: '17' | |
distribution: 'zulu' | |
java-package: 'jdk+fx' | |
architecture: 'aarch64' | |
- name: Build with Ant | |
run: | | |
ant -noinput -buildfile build.xml | |
shell: bash | |
- name: Run the macOS installer script | |
run: | | |
cd installer/macos | |
chmod +x *.sh | |
./BuildMacOS.sh ${{ env.VERSION }} | |
shell: bash | |
- name: Rename dmg file with version and architecture | |
env: | |
PUBLISH_PATH: 'installer/macos' | |
run: | | |
ls -l ${{env.PUBLISH_PATH}} | |
mv ${{env.PUBLISH_PATH}}/LingTree-${{ env.VERSION }}.dmg LingTree-${{ env.VERSION }}.dmg | |
- uses: actions/upload-artifact@v4 | |
with: | |
name: LingTree | |
path: LingTree-*.dmg | |
if-no-files-found: error | |
sign-installer: | |
name: Sign LingTree installer | |
needs: build-installer | |
runs-on: macos-latest | |
steps: | |
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
- uses: actions/checkout@v3 | |
- uses: actions/download-artifact@v4 | |
with: | |
name: LingTree | |
# If a notarization fails, uncomment the following and replace the GUID with the one from | |
# notarization output | |
# Get notarization log of last run | |
# - name: Get notarization log | |
# run: | | |
# echo Before trying to get notarization log of last run | |
# xcrun notarytool log 1445e26f-b7dc-409e-a4b5-a7ade66f6bef --apple-id ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} --team-id "3YE4W86L3G" --password ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }} | |
- name: Add certificate to Keychain | |
env: | |
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
MACOS_CERTIFICATE_PWD: ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }} | |
KEYCHAIN_PASSWORD: ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }} | |
run: | | |
# Create a temporary keychain | |
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
security default-keychain -s build.keychain | |
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
# Import the certificate | |
curl -O ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_CERT_URL }} | |
security import sil_developer_id_application_cert.p12 -k build.keychain -P ${{ secrets.SIL_APPLE_DEVELOPER_ID_APPLICATION_PASSWORD }} -T /usr/bin/codesign | |
# Allow codesign to access the certificate without prompts | |
#echo before allow codesign to access the certificate without prompts | |
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain | |
#echo after allow codesign to access the certificate without prompts | |
- name: Attach dmg | |
run: | | |
yes | PAGER=cat hdiutil attach LingTree-*.dmg | |
echo | |
echo ls | |
ls /Volumes/LingTree | |
- name: Sign dmg and app | |
run: | | |
mkdir dmgContents | |
cp -R /Volumes/LingTree dmgContents | |
cd dmgContents/LingTree | |
cd LingTree.app/Contents/app/ | |
jar xf lingtree.jar resources/Keyboards/macOS/xkbswitch org/sil/lingtree/resources/Keyboards/macOS/xkbswitch | |
chmod a+w resources/Keyboards/macOS/xkbswitch | |
chmod a+w org/sil/lingtree/resources/Keyboards/macOS/xkbswitch | |
#echo sign xkbswitch | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime resources/Keyboards/macOS/xkbswitch -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime org/sil/lingtree/resources/Keyboards/macOS/xkbswitch -v | |
#echo before updating xkbswitch in lingtree.jar | |
jar uf lingtree.jar resources/Keyboards/macOS/xkbswitch org/sil/lingtree/resources/Keyboards/macOS/xkbswitch | |
rm -r org | |
cd libs/jna/ | |
jar xf jna-5.11.0.jar com/sun/jna/darwin-aarch64/libjnidispatch.jnilib com/sun/jna/darwin-x86-64/libjnidispatch.jnilib | |
#echo sign jna | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime com/sun/jna/darwin-aarch64/libjnidispatch.jnilib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime com/sun/jna/darwin-x86-64/libjnidispatch.jnilib -v | |
#echo update jna | |
jar uf jna-5.11.0.jar com/sun/jna/darwin-aarch64/libjnidispatch.jnilib com/sun/jna/darwin-x86-64/libjnidispatch.jnilib | |
rm -r com | |
cd ../../../../.. | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/MacOS/LingTree -v | |
# ------------- sign all JavaFX runtime executables included in the app | |
# without this, the notarization fails. | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libnet.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libnio.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libinstrument.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavafx_iio.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libzip.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfreetype.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjli.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libsplashscreen.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement_ext.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libdt_socket.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2pkcs11.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjimage.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxmedia_avf.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxkrb5.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxui.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libglib-lite.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement_agent.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/librmi.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjdwp.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libawt_lwawt.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfxplugins.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libglass.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavajpeg.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmlib_image.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjavafx_font.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libmanagement.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libgstreamer-lite.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjsound.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxwebkit.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2pcsc.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjsig.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprefs.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libsyslookup.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjawt.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libattach.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_common.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_es2.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libfontmanager.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/jspawnhelper -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxsecurity.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libextnet.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libdecora_sse.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjaas.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/liblcms.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libverify.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libj2gss.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjava.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libawt.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosx.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libjfxmedia.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libprism_sw.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/libosxapp.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/server/libjvm.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/Home/lib/server/libjsig.dylib -v | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree.app/Contents/runtime/Contents/MacOS/libjli.dylib -v | |
# ------------- sign the main app itself | |
echo sign LingTree.app | |
codesign --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime --deep LingTree.app -v | |
echo verify the app | |
codesign -vvv --deep --strict LingTree.app | |
cd .. | |
echo recreate dmg | |
pwd | |
#ln -s /Applications LingTree/Applications | |
#hdiutil create -volname LingTreeInstaller -srcfolder LingTree -fs HFS+ -format UDRW LingTreeSigned.dmg | |
hdiutil create -volname LingTreeInstaller -srcfolder LingTree -ov -format UDZO LingTree-1.6.2.dmg | |
mv LingTree-1.6.2.dmg ../LingTree-1.6.2.dmg | |
cd .. | |
echo sign dmg | |
codesign --deep --force --sign "${{ vars.SIL_APPLE_CODESIGN_IDENTITY }}" --timestamp --options runtime LingTree-1.6.2.dmg -v | |
#echo rename to include version number | |
#mv LingTreeSigned.dmg LingTree-${{ env.VERSION }}.dmg | |
#echo time stamp for signed dmg: | |
#ls -l LingTreeSigned.dmg | |
# Verify the signature | |
- name: Verify signature | |
run: | | |
codesign --verify --verbose LingTree-1.6.2.dmg | |
ls -l /Applications | |
# # Clean up keychain | |
# - name: Clean up keychain | |
# if: always() | |
# run: | | |
# security delete-keychain build.keychain || true | |
# Notarize the DMG | |
- name: Notarize DMG | |
uses: GuillaumeFalourd/notary-tools@v1 | |
with: | |
product_path: LingTree-1.6.2.dmg | |
apple_id: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} | |
password: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }} | |
team_id: "3YE4W86L3G" | |
# Not mandatory inputs | |
staple: 'false' | |
xcode_path: '/Applications/Xcode_26.app' | |
# uses: lando/notarize-action@v2 | |
# with: | |
# product-path: LingTree-1.6.2.dmg | |
# appstore-connect-username: ${{ secrets.SIL_APPLE_NOTARIZATION_USERNAME }} | |
# appstore-connect-password: ${{ secrets.SIL_APPLE_NOTARIZATION_PASSWORD }} | |
# appstore-connect-team-id: "3YE4W86L3G" | |
# verbose: true | |
# Staple the notarization ticket | |
- name: Staple Notarization Ticket | |
run: | | |
#echo time stamp for stapling | |
#ls -l LingTree-1.6.2.dmg | |
#echo before stapling | |
xcrun stapler staple LingTree-1.6.2.dmg | |
#echo after stapling | |
#ls -l LingTreeSigned.dmg | |
echo rename to include version number | |
#cp LingTreeSigned.dmg LingTree-${{ env.VERSION }}.dmg | |
# - name: Create Release | |
# uses: softprops/action-gh-release@v2 | |
# with: | |
# files: LingTree-*.dmg | |
# body: | | |
# Release for version ${{ github.ref }} | |
# draft: true | |
- uses: actions/upload-artifact@v4 | |
with: | |
name: LingTreeSigned | |
path: LingTree*.dmg | |
#path: LingTree-*.dmg | |
if-no-files-found: error | |
# - uses: actions/upload-artifact@v4 | |
# with: | |
# name: LingTreeApp | |
# path: LingTree.App | |
# #path: LingTree-*.dmg | |
# if-no-files-found: error | |
create-release: | |
name: Create Release | |
needs: sign-installer | |
runs-on: macos-latest | |
steps: | |
- uses: actions/download-artifact@v4 | |
with: | |
name: LingTreeSigned | |
- name: Create Release | |
uses: softprops/action-gh-release@v2 | |
with: | |
files: LingTree*.dmg | |
#files: LingTree-*.dmg | |
body: | | |
Release for version ${{ github.ref }} | |
draft: true |