[CMake] Attempt to fix code signing on macOS

Signed-off-by: Christian Parpart <christian@parpart.family>

Author: christianparpart

.github/workflows/build.yml

@@ -410,7 +410,7 @@ jobs:
           ./scripts/ci-set-vars.sh
           # Please read the following link on how to use MacOS code signing on Github CI:
           # https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development
-          echo "CODE_SIGN_CERTIFICATE_ID=Developer ID Application: Christian Parpart (6T525MU9UR)" >> "$GITHUB_OUTPUT"
+          echo "CODE_SIGN_CERTIFICATE_ID=8E5F2A99BDA77EC0A0DE747F29D0BD42A25725F3" >> "$GITHUB_OUTPUT"
         env:
           REPOSITORY: ${{ github.event.repository.name }}
       - name: Install the Apple certificate and provisioning profile
@@ -514,7 +514,7 @@ jobs:
           echo QTVER=6 >> "$GITHUB_OUTPUT"
           # Please read the following link on how to use MacOS code signing on Github CI:
           # https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development
-          echo "CODE_SIGN_CERTIFICATE_ID=Developer ID Application: Christian Parpart (6T525MU9UR)" >> "$GITHUB_OUTPUT"
+          echo "CODE_SIGN_CERTIFICATE_ID=8E5F2A99BDA77EC0A0DE747F29D0BD42A25725F3" >> "$GITHUB_OUTPUT"
         env:
           REPOSITORY: ${{ github.event.repository.name }}
       - name: Install the Apple certificate and provisioning profile

src/contour/CMakeLists.txt

@@ -395,7 +395,17 @@ elseif(APPLE)
                     -verbose=1
                     -no-strip
                     -qmldir=${CMAKE_CURRENT_SOURCE_DIR}/ui
-                    \"-codesign=${CODE_SIGN_CERTIFICATE_ID}\"
+        )
+        execute_process(
+            COMMAND codesign
+                --force
+                --verbose
+                --deep
+                --options=runtime
+                --timestamp
+                --entitlements \"${PROJECT_SOURCE_DIR}/support/macOS/entitlements.plist\"
+                --sign \"${CODE_SIGN_CERTIFICATE_ID}\"
+                \"\${CMAKE_INSTALL_PREFIX}/contour.app\"
         )
     ")
 else()

support/macOS/entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>