generate macos app bundles (#74)

* generate macos app bundles

* remove unused nix files

* update README

* provide entitlements and disable library verification

* scripts: add example of sign and notarize script

Tested and its working but up to step with signing and repackaging .lgx
files can be done when creating the bundle.

* bump nix-bundle-macos-app, remove duplicate steps from notarization script

---------

Co-authored-by: markoburcul <marko@status.im>

Author: dlipicar

.github/workflows/appimage.yml .github/workflows/build.yml.github/workflows/appimage.yml renamed to .github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: AppImage Build & Release
+name: Build & Release
 
 on:
   push:
@@ -40,9 +40,30 @@ jobs:
           name: appimage-${{ matrix.arch }}
           path: logos-app-*.AppImage
 
+  build-macos-app:
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Build bin-macos-app
+        run: nix build .#bin-macos-app
+
+      - name: Package app bundle as tarball
+        run: |
+          app=$(find result/ -name '*.app' -maxdepth 1 -print -quit)
+          tar -czf logos-app-aarch64-unsigned.app.tar.gz -C result "$(basename "$app")"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: macos-app-aarch64-darwin
+          path: logos-app-aarch64-unsigned.app.tar.gz
+
   release:
     if: github.event_name == 'push'
-    needs: build-appimage
+    needs: [build-appimage, build-macos-app]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -58,6 +79,11 @@ jobs:
           name: appimage-aarch64-linux
           path: artifacts/
 
+      - uses: actions/download-artifact@v4
+        with:
+          name: macos-app-aarch64-darwin
+          path: artifacts/
+
       - name: Generate tag
         id: tag
         run: echo "tag=pre-release-${GITHUB_SHA::7}-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
@@ -67,4 +93,6 @@ jobs:
           tag_name: ${{ steps.tag.outputs.tag }}
           name: Pre-release ${{ steps.tag.outputs.tag }}
           prerelease: true
-          files: artifacts/*.AppImage
+          files: |
+            artifacts/*.AppImage
+            artifacts/*.app.tar.gz

README.md

@@ -4,90 +4,75 @@
 
 ### Using Nix (Recommended)
 
-#### Build Complete Application
+#### Local Build
 
-```bash
-# Build everything (default)
-nix build
+The local build produces a standard Nix derivation whose dependencies live in `/nix/store`. It is the fastest way to iterate during development but is **not portable** — it only runs on the machine that built it.
 
-# Or explicitly
-nix build '.#default'
+```bash
+nix build '.#app'
+./result/bin/logos-app
 ```
 
-The result will include:
-- `/bin/logos-app` - The main Logos application executable
-- All required modules and dependencies
-
-#### Build Individual Components
+Local builds require **local** `.lgx` packages, generated with:
 
 ```bash
-# Build only the main application
-nix build '.#app'
+nix bundle --bundler github:logos-co/nix-bundle-lgx github:your-user/your-module#lib
 ```
 
-#### Development Shell
+#### Portable Builds
 
+Portable builds are fully self-contained — no `/nix/store` references at runtime. They work with **portable** `.lgx` packages. That is, releases from [logos-modules](https://github.com/logos-co/logos-modules), downloads from the Package Manager UI, or generated with:
 ```bash
-# Enter development shell with all dependencies
-nix develop
+nix bundle --bundler github:logos-co/nix-bundle-lgx#portable github:your-user/your-module#lib
 ```
 
-**Note:** In zsh, you need to quote the target (e.g., `'.#default'`) to prevent glob expansion.
-
-If you don't have flakes enabled globally, add experimental flags:
+| Output | Platform | Format |
+|---|---|---|
+| `bin-bundle-dir` | Linux, macOS | Flat directory with `bin/` and `lib/` |
+| `bin-appimage` | Linux | Single-file `.AppImage` executable |
+| `bin-macos-app` | macOS | `.app` bundle (ad-hoc signed, unsigned for distribution) |
 
+##### Self-contained directory bundle (all platforms)
 ```bash
-nix build --extra-experimental-features 'nix-command flakes'
+nix build '.#bin-bundle-dir'
+./result/bin/LogosApp
 ```
 
-The compiled artifacts can be found at `result/`
+##### Linux AppImage (Linux only)
+```bash
+nix build '.#bin-appimage'
+./result/logos-app.AppImage
+```
 
-#### Running the Application
 
-After building with `nix build`, you can run the application:
+##### MacOS App bundle (macOS only)
 
 ```bash
-# Run the main Logos application
-./result/bin/logos-app
+nix build '.#bin-macos-app'
+open result/LogosApp.app
 ```
 
-The application will automatically load all required modules and dependencies. All components are bundled in the Nix store layout.
 
-#### macOS Distribution (Experimental)
-
-Build a standalone `.app` bundle or DMG installer for macOS. This is experimental and intended for testing purposes.
+#### Development Shell
 
 ```bash
-# Build .app bundle
-nix build '.#app-bundle'
-
-# Build DMG installer
-nix build '.#dmg'
+nix develop
 ```
 
-The outputs will be at:
-- `result/LogosApp.app/` - Application bundle
-- `result/LogosApp.dmg` - DMG installer
-
-#### Linux AppImage (Experimental)
+**Note:** In zsh, quote the target (e.g., `'.#app'`) to prevent glob expansion.
 
-Build a self-contained AppImage on Linux hosts:
+If you don't have flakes enabled globally:
 
 ```bash
-nix build '.#appimage'
+nix build --extra-experimental-features 'nix-command flakes'
 ```
 
-The output will be at `result/LogosApp-<version>.AppImage`.
-
 #### Nix Organization
 
 The nix build system is organized into modular files in the `/nix` directory:
 - `nix/default.nix` - Common configuration and main application build
 - `nix/app.nix` - Application-specific compilation settings
 - `nix/main-ui.nix` - UI components compilation
-- `nix/counter.nix` - Counter module compilation
-- `nix/macos-bundle.nix` - macOS .app bundle (darwin only)
-- `nix/macos-dmg.nix` - macOS DMG installer (darwin only)
 
 ## Modules
 

app/macos/LogosApp.entitlements

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>

flake.lock

@@ -17,9 +17,14 @@
     nix-bundle-lgx.url = "github:logos-co/nix-bundle-lgx";
     nix-bundle-dir.url = "github:logos-co/nix-bundle-dir";
     nix-bundle-appimage.url = "github:logos-co/nix-bundle-appimage";
+    nix-bundle-macos-app = {
+      url = "github:logos-co/nix-bundle-macos-app";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nix-bundle-dir.follows = "nix-bundle-dir";
+    };
   };
 
-  outputs = { self, nixpkgs, logos-cpp-sdk, logos-liblogos, logos-package-manager, logos-capability-module, logos-package, logos-package-manager-ui, logos-webview-app, logos-design-system, logos-counter-qml, logos-counter, nix-bundle-lgx, nix-bundle-dir, nix-bundle-appimage }:
+  outputs = { self, nixpkgs, logos-cpp-sdk, logos-liblogos, logos-package-manager, logos-capability-module, logos-package, logos-package-manager-ui, logos-webview-app, logos-design-system, logos-counter-qml, logos-counter, nix-bundle-lgx, nix-bundle-dir, nix-bundle-appimage, nix-bundle-macos-app }:
     let
       systems = [ "aarch64-darwin" "x86_64-darwin" "aarch64-linux" "x86_64-linux" ];
       forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f {
@@ -153,6 +158,15 @@
             desktopFile = ./assets/logos-app.desktop;
             icon = ./app/icons/logos.png;
           };
+        } // pkgs.lib.optionalAttrs pkgs.stdenv.isDarwin {
+          bin-macos-app = nix-bundle-macos-app.lib.${system}.mkMacOSApp {
+            drv = appDistributed;
+            name = "LogosApp";
+            bundle = dirBundler appDistributed;
+            icon = ./app/macos/logos.icns;
+            infoPlist = ./app/macos/Info.plist.in;
+            entitlements = ./app/macos/LogosApp.entitlements;
+          };
         } // (if pkgs.stdenv.isDarwin then {
           # macOS distribution outputs
           app-bundle = appBundle;