Skip to content

Commit e115204

Browse files
StephenNnejiStephenNneji
authored
Adds signing and notarising of macOS installer (#168)
1 parent c37d13c commit e115204

File tree

8 files changed

+102
-29
lines changed

8 files changed

+102
-29
lines changed

‎.github/workflows/build_installer.yml‎

Lines changed: 37 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,22 +60,51 @@ jobs:
6060
- uses: actions/checkout@v4
6161
- uses: conda-incubator/setup-miniconda@v3
6262
with:
63-
activate-environment: sscanss
64-
environment-file: environment.yaml
65-
auto-activate-base: false
66-
- name: Make installer
63+
activate-environment: sscanss
64+
environment-file: environment.yaml
65+
auto-activate-base: false
66+
- name: Build executable
6767
shell: bash -el {0}
6868
run: |
6969
conda init bash
7070
conda activate sscanss
7171
python make.py --build-sscanss --build-editor
72-
brew install create-dmg
72+
- name: Build and Sign Installer
73+
run: |
7374
cd installer/macos
74-
chmod +x build_dmg.sh
75-
./build_dmg.sh
75+
# create variables
76+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
77+
78+
# create temporary keychain
79+
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
80+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
81+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
82+
83+
# import certificate to keychain
84+
echo -n $CODE_SIGNING_CERTIFICATE_BASE64 | base64 -d -o ./dev_id_app_certificate.p12
85+
security import dev_id_app_certificate.p12 -A -t cert -f pkcs12 -k $KEYCHAIN_PATH -P "$CODE_SIGNING_PASSWORD" -T /usr/bin/codesign
86+
echo -n $PKG_SIGNING_CERTIFICATE_BASE64 | base64 -d -o ./dev_id_install_certificate.p12
87+
security import dev_id_install_certificate.p12 -A -t cert -f pkcs12 -k $KEYCHAIN_PATH -P "$PKG_SIGNING_PASSWORD" -T /usr/bin/codesign
88+
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
89+
security list-keychain -d user -s $KEYCHAIN_PATH
90+
91+
echo -n $API_CONNECT_KEY | base64 -d -o ./auth_key.p8
92+
chmod 777 make.sh
93+
./make.sh $GITHUB_REF_NAME $DEV_TEAM_ID $API_CONNECT_ISSUER $API_CONNECT_KEY_ID
94+
env:
95+
CODE_SIGNING_CERTIFICATE_BASE64: ${{ secrets.CODE_SIGNING_CERTIFICATE_BASE64 }}
96+
CODE_SIGNING_PASSWORD: ${{ secrets.CODE_SIGNING_PASSWORD }}
97+
PKG_SIGNING_CERTIFICATE_BASE64: ${{ secrets.PKG_SIGNING_CERTIFICATE_BASE64 }}
98+
PKG_SIGNING_PASSWORD: ${{ secrets.PKG_SIGNING_PASSWORD }}
99+
API_CONNECT_KEY_ID: ${{ secrets.API_CONNECT_KEY_ID }}
100+
API_CONNECT_KEY: ${{ secrets.API_CONNECT_KEY }}
101+
API_CONNECT_ISSUER: ${{ secrets.API_CONNECT_ISSUER }}
102+
DEV_TEAM_ID: ${{ secrets.DEV_TEAM_ID }}
103+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
104+
76105
- name: Upload installer
77106
uses: actions/upload-artifact@v4
78107
with:
79108
name: macos installer
80-
path: installer/macos/*.dmg
109+
path: installer/macos/sscanss2.pkg
81110
if-no-files-found: error

‎docs/calibration.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ Positioning Table Example
113113
This example will be showing calibration of positioning table. The table has z stage, rotation stage, y stage and
114114
x stage arranged in the given order. The measurements proceed similar to the previous example, starting at the z stage
115115
and ending at the x stage. The measured data is available in a calibration file "table.txt" which can be found in the
116-
examples/calibration folder of the install directory (can also be download from the github repository).
116+
examples/calibration folder of the install directory (can also be download from the GitHub repository).
117117
The calibration file can be loaded and model generated in the calibration tool as described above.
118118

119119
.. image:: images/calib_result_table.png

‎docs/introduction.rst‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,21 @@ requirements (lower specification than minimum might still work but higher is ty
7676
Issues
7777
******
7878
After a new version of SScanSS 2 has been released, feedback is necessary to improve performance if you experience
79-
any crashes or unexpected behaviours, do not hesitate to |issues| on the github.
79+
any crashes or unexpected behaviours, do not hesitate to |issues| on the GitHub.
8080

8181
****************
8282
Citing SScanSS 2
8383
****************
8484
1. J.A. James, J. R. Santisteban, L. Edwards and M. R. Daymond, “A virtual laboratory for neutron and synchrotron
8585
strain scanning,” Physica B: Condensed Matter, vol. 350, no. 1-3, p. 743–746, 2004.
86+
8687
2. Nneji Stephen, Buchanan Rob, Farooq Rabiya, Sharp Paul, Zavileiskii Timofei, & Cooper Joshaniel FK. (2024).
8788
SScanSS 2—a redesigned strain scanning simulation software (Version 2.2.0). |doi|.
8889

8990

9091
.. |github| raw:: html
9192

92-
<a href="https://github.com/ISISNeutronMuon/SScanSS-2/" target="_blank">github</a>
93+
<a href="https://github.com/ISISNeutronMuon/SScanSS-2/" target="_blank">GitHub</a>
9394

9495
.. |release| raw:: html
9596

‎installer/macos/build_dmg.sh‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎installer/macos/distribution.xml.in‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<installer-gui-script minSpecVersion="2">
3+
<title>SScanSS-2 @VERSION_NAME@</title>
4+
<license file="LICENSE" mime-type="text/plain"/>
5+
<pkg-ref id="com.sscanss2.pkg.sscanss"/>
6+
<pkg-ref id="com.sscanss2.pkg.editor"/>
7+
<options customize="allow" require-scripts="false" rootVolumeOnly="true" hostArchitectures="arm64,x86_64"/>
8+
<choices-outline>
9+
<line choice="com.sscanss2.pkg.sscanss"/>
10+
<line choice="com.sscanss2.pkg.editor"/>
11+
</choices-outline>
12+
<choice id="com.sscanss2.pkg.sscanss" title="SScanSS 2" enabled="false" start_selected="true">
13+
<pkg-ref id="com.sscanss2.pkg.sscanss" version="@VERSION@" onConclusion="none">sscanss.pkg</pkg-ref>
14+
</choice>
15+
<choice id="com.sscanss2.pkg.editor" title="Instrument Editor" start_selected="false">
16+
<pkg-ref id="com.sscanss2.pkg.editor" version="@VERSION@" onConclusion="none">editor.pkg</pkg-ref>
17+
</choice>
18+
</installer-gui-script>

‎installer/macos/entitlements.plist‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<!-- These are required for binaries built by PyInstaller -->
6+
<key>com.apple.security.cs.allow-jit</key>
7+
<true/>
8+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
9+
<true/>
10+
<key>com.apple.security.cs.disable-library-validation</key>
11+
<true/>
12+
</dict>
13+
</plist>

‎installer/macos/make.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/bash
2+
3+
SSCANSS_PATH="../bundle/app/sscanss.app"
4+
EDITOR_PATH="../bundle/editor.app"
5+
VER_NAME=$1
6+
VER=$VER_NAME
7+
DEV_TEAM_ID=$2
8+
API_CONNECT_ISSUER=$3
9+
API_CONNECT_KEY_ID=$4
10+
11+
if [[ ${VER_NAME:0:1} == 'v' ]]; then
12+
VER=${VER:1}
13+
fi
14+
15+
# Sign code
16+
codesign -v --deep --force --options=runtime --entitlements ./entitlements.plist --sign ${DEV_TEAM_ID} --timestamp ${EDITOR_PATH}/Contents/Resources/*.dylib
17+
codesign -v --deep --force --options=runtime --entitlements ./entitlements.plist --sign ${DEV_TEAM_ID} --timestamp ${EDITOR_PATH}
18+
codesign -v --deep --force --options=runtime --entitlements ./entitlements.plist --sign ${DEV_TEAM_ID} --timestamp ${SSCANSS_PATH}/Contents/Resources/*.dylib
19+
codesign -v --deep --force --options=runtime --entitlements ./entitlements.plist --sign ${DEV_TEAM_ID} --timestamp ${SSCANSS_PATH}
20+
21+
# Build Pkg
22+
sed -e "s/@VERSION_NAME@/${VER_NAME}/g" -e "s/@VERSION@/${VER}/g" distribution.xml.in > distribution.xml
23+
pkgbuild --root ${EDITOR_PATH} --identifier com.sscanss2.editor.pkg --version ${VER} --install-location "/Applications/sscanss-editor.app" editor.pkg
24+
pkgbuild --root ${SSCANSS_PATH} --identifier com.sscanss2.sscanss.pkg --version ${VER} --install-location "/Applications/sscanss.app" sscanss.pkg
25+
productbuild --sign ${DEV_TEAM_ID} --timestamp --distribution distribution.xml --resources . sscanss2.pkg
26+
27+
# Notarise and staple
28+
xcrun notarytool submit --issuer ${API_CONNECT_ISSUER} --key-id ${API_CONNECT_KEY_ID} --key ./auth_key.p8 --wait sscanss2.pkg
29+
xcrun stapler staple sscanss2.pkg

‎sscanss/app/commands/insert.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ def onImportFailed(self, exception):
115115

116116

117117
class InsertVolumeFromFile(QtGui.QUndoCommand):
118-
"""Creates command to load volume data from an nexus file or stack of TIFF files to the project
118+
"""Creates command to load volume data from a nexus file or stack of TIFF files to the project
119119
120120
:param presenter: main window presenter instance
121121
:type presenter: MainWindowPresenter

0 commit comments

Comments
 (0)