Skip to content

Repository navigation

feat: build, sign and notarize macOS app bundle in CI #2614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ansgarbecker merged 6 commits into from
Sep 28, 2026
Merged

feat: build, sign and notarize macOS app bundle in CI #2614

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b2f44f0
feat: build, sign and notarize macOS app bundle in CI
mistral-vibe Sep 27, 2026
e5076e6
fix: move secrets check from step if: into script (secrets context no…
mistral-vibe Sep 27, 2026
a2b588a
fix: use plain string for codesign flags instead of empty array (set …
mistral-vibe Sep 27, 2026
60e48f3
chore: trigger CI with signing secrets configured
mistral-vibe Sep 28, 2026
0b09691
fix: correct argument order for security set-keychain-settings
mistral-vibe Sep 28, 2026
fe5f5bb
fix: remove invalid -s flag from security set-key-partition-list
mistral-vibe Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: use plain string for codesign flags instead of empty array (set … 
…-u unbound variable)

Co-authored-by: ansgarbecker <ansgarbecker@users.noreply.github.com>
  • Loading branch information
@mistral-vibe @ansgarbecker
mistral-vibe and ansgarbecker committed Sep 27, 2026
commit a2b588a03f4c642397811410da1e4ee696cd4b57
10 changes: 5 additions & 5 deletions create-macos-app.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,9 @@ NOTARY_PROFILE="${MACOS_NOTARY_PROFILE:-notarytool-profile}"

# codesign flags: hardened runtime + secure timestamp only make sense with a real identity
if $DO_ADHOC; then
SIGN_OPTS=()
SIGN_OPTS=""
else
SIGN_OPTS=(--options runtime --timestamp)
SIGN_OPTS="--options runtime --timestamp"
fi

LOCALES_ZIP_URL="https://www.heidisql.com/downloads/locale/HeidiSQL-locale.zip"
Expand Down Expand Up @@ -118,7 +118,7 @@ mkdir -p "${APP_DIR}/Contents/Frameworks" # where we will put .dylib and .so f
# Copy main executable
cp "${EXECUTABLE_SRC}" "${EXECUTABLE_TRG}"
chmod +x "${EXECUTABLE_TRG}"
codesign --force "${SIGN_OPTS[@]}" --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"
codesign --force ${SIGN_OPTS} --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"

# Minimal Info.plist (adjust identifiers/versions as needed)
cat > "${APP_DIR}/Contents/Info.plist" <<EOF
Expand Down Expand Up @@ -343,11 +343,11 @@ echo "Done. Bundled app is at: ${APP_DIR}"
echo "Signing embedded libraries..."
find "${APP_DIR}/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) | while read -r f; do
echo " Signing ${f}"
codesign --force "${SIGN_OPTS[@]}" --sign "${CODESIGN_IDENTITY}" "${f}"
codesign --force ${SIGN_OPTS} --sign "${CODESIGN_IDENTITY}" "${f}"
done

echo "Signing main app bundle..."
codesign --force "${SIGN_OPTS[@]}" --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"
codesign --force ${SIGN_OPTS} --sign --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"

echo "Verifying code signature..."
codesign --verify --deep --strict --verbose=2 "${APP_DIR}"
Expand Down
Loading