33#
44
55# Change to your own Apple Developer ID, if you want to code-sign the resultant .app
6+
7+
6879TEAMID ?= ZD8TVTCXDS
10+ # The unique App ID assigned by App Store Connect, under App Information (NOT your Apple ID!!)
11+ APPID ?= 1608360813
812# DEVID ?= 3rd Party Mac Developer Application: Perry Kundert ($(TEAMID))
913DEVID ?= Developer ID Application: Perry Kundert ($(TEAMID ) )
1014PKGID ?= 3rd Party Mac Developer Installer: Perry Kundert ($(TEAMID ) )
15+ # PKGID ?= Developer ID Installer: Perry Kundert ($(TEAMID))
16+ DSTID ?= Apple Distribution: Perry Kundert ($(TEAMID ) )
1117BUNDLEID ?= ca.kundert.perry.SLIP39
1218APIISSUER ?= 5f3b4519-83ae-4e01-8d31-f7db26f68290
1319APIKEY ?= 5H98J7LKPC
@@ -65,19 +71,23 @@ dist/slip39-$(VERSION)-py3-none-any.whl: build-check FORCE
6571install : dist/slip39-$(VERSION ) -py3-none-any.whl FORCE
6672 $(PY3 ) -m pip install --force-reinstall $< [gui,serial,json]
6773
68- # Building a macOS App
69-
70-
74+ # Building / Upload a macOS App
7175app : dist/SLIP39.app
72-
73- app-upload : dist/SLIP39-$(VERSION ) .dmg.uploaded
74-
76+ app-upload : app-pkg-upload
7577
7678# Generate, Sign and Package the macOS SLIP39.app GUI for App Store or local/manual installation
79+ # o Try all the approaches of packaging a macOS App for App Store upload
7780app-dmg : dist/SLIP39-$(VERSION ) .dmg
7881app-zip : dist/SLIP39-$(VERSION ) .zip
7982app-pkg : dist/SLIP39-$(VERSION ) .pkg
8083
84+ app-dmg-valid : dist/SLIP39-$(VERSION ) .dmg.valid
85+ app-zip-valid : dist/SLIP39-$(VERSION ) .zip.valid
86+ app-pkg-valid : dist/SLIP39-$(VERSION ) .pkg.valid
87+
88+ app-dmg-upload : dist/SLIP39-$(VERSION ) .dmg.upload-package
89+ app-zip-upload : dist/SLIP39-$(VERSION ) .zip.upload-package
90+ app-pkg-upload : dist/SLIP39-$(VERSION ) .pkg.upload-package
8191
8292#
8393# Build the macOS App, and create and sign the .dmg file
@@ -93,7 +103,21 @@ dist/SLIP39-$(VERSION).dmg: dist/SLIP39.app
93103 mv " SLIP39 $( VERSION) .dmg" " $@ "
94104 @echo " Checking signature..." ; ./SLIP39.metadata/check-signature $@
95105
96- # Upload the .dmg, unless we've already uploaded it and have a RequestUUID
106+ .PHONY : dist/SLIP39-$(VERSION ) .dmg-verify
107+ dist/SLIP39-$(VERSION ) .dmg-verify : dist/SLIP39-$(VERSION ) .dmg
108+ @echo " \n\n*** Verifying signing of $<..."
109+ # codesign --verify -v $< \
110+ # || ( echo "!!! Unable to verify codesign: "; codesign --verify -vv $<; false )
111+ spctl --assess --type install --context context:primary-signature -vvv $< || \
112+ spctl --assess --type execute --context context:primary-signature -vvv $< || \
113+ spctl --assess --type open --context context:primary-signature -vvv $< || \
114+ spctl --assess --type install -vvv $< || \
115+ spctl --assess --type execute -vvv $< || \
116+ spctl --assess --type open -vvv $<
117+
118+
119+
120+ # Notarize the .dmg, unless we've already uploaded it and have a RequestUUID
97121dist/SLIP39-$(VERSION ) .dmg.notarization : dist/SLIP39-$(VERSION ) .dmg
98122 jq -r ' .["notarization-upload"]["RequestUUID"]' $@ 2> /dev/null \
99123 || xcrun altool --notarize-app -f $< \
@@ -107,14 +131,14 @@ dist/SLIP39-$(VERSION).dmg.notarization: dist/SLIP39-$(VERSION).dmg
107131dist/SLIP39-$(VERSION ) .dmg.notarization-status : dist/SLIP39-$(VERSION ) .dmg.notarization FORCE
108132 [ -s $@ ] && grep " Status: success" $@ \
109133 || xcrun altool \
110- --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
111- --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
112- | tee -a $@
134+ --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
135+ --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
136+ | tee -a $@
113137
114- # Check notarization status 'til Status: success, then staple it to ...dmg, and create ...dmg.final marker file
138+ # Check notarization status 'til Status: success, then staple it to ...dmg, and create ...dmg.valid marker file
115139dist/SLIP39-$(VERSION ) .dmg.valid : dist/SLIP39-$(VERSION ) .dmg.notarization-status FORCE
116- grep " Status: success" $< || \
117- ( tail -10 $< ; echo " \n\n!!! App not yet notarized; cannot produce $@ " ; false )
140+ @ grep " Status: success" $< || \
141+ ( tail -10 $< ; echo " \n\n!!! App not yet notarized; try again in a few seconds... " ; false )
118142 ( [ -r $@ ] ) \
119143 && ( echo " \n\n*** Notarization complete; refreshing $@ " && touch $@ ) \
120144 || ( \
@@ -124,8 +148,11 @@ dist/SLIP39-$(VERSION).dmg.valid: dist/SLIP39-$(VERSION).dmg.notarization-status
124148 touch $@ \
125149 )
126150
127- # macOS ...dmg App Upload: Unless the ...dmg.upload file exists and is non-empty
128- dist/SLIP39-$(VERSION ) .dmg.uploaded : dist/SLIP39-$(VERSION ) .dmg dist/SLIP39-$(VERSION ) .dmg.valid FORCE
151+ # macOS ...dmg App Upload: Unless the ...dmg.upload file exists and is non-empty.
152+ # o Try either upload-package and upload-app approach
153+ # o NOTE that --apple-id is NOT your "Apple ID", it is the unique App ID
154+ # See: https://github.com/fastlane/fastlane/issues/14783
155+ dist/SLIP39-$(VERSION ) .dmg.upload-package : dist/SLIP39-$(VERSION ) .dmg dist/SLIP39-$(VERSION ) .dmg.valid FORCE
129156 [ -s $@ ] || ( \
130157 echo " \n\n*** Uploading the signed DMG file: $<..." && \
131158 echo " *** Verifying notarization stapling..." && xcrun stapler validate $< && \
@@ -134,7 +161,20 @@ dist/SLIP39-$(VERSION).dmg.uploaded: dist/SLIP39-$(VERSION).dmg dist/SLIP39-$(VE
134161 xcrun altool --upload-package $< \
135162 --type macos \
136163 --bundle-id $(BUNDLEID ) --bundle-version $(VERSION ) --bundle-short-version-string $(VERSION ) \
137- --apple-id $(APPLEID ) --team $(TEAMID ) \
164+ --apple-id $(APPID ) --team $(TEAMID ) \
165+ --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
166+ | tee -a $@ \
167+ )
168+
169+ dist/SLIP39-$(VERSION ) .dmg.upload-app : dist/SLIP39-$(VERSION ) .dmg dist/SLIP39-$(VERSION ) .dmg.valid FORCE
170+ [ -s $@ ] || ( \
171+ echo " \n\n*** Uploading the signed DMG file: $<..." && \
172+ echo " *** Verifying notarization stapling..." && xcrun stapler validate $< && \
173+ echo " *** Checking signature..." && ./SLIP39.metadata/check-signature $< && \
174+ echo " *** Upload starting for $<..." && \
175+ xcrun altool --upload-app -f $< \
176+ --type macos \
177+ --primary-bundle-id $(BUNDLEID ) \
138178 --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
139179 | tee -a $@ \
140180 )
@@ -145,57 +185,42 @@ dist/SLIP39-$(VERSION).dmg.uploaded: dist/SLIP39-$(VERSION).dmg dist/SLIP39-$(VE
145185# - Nope: "...An installer signing identity (not an application signing identity) is required for signing flat-style products."
146186# See: https://lessons.livecode.com/m/4071/l/876834-signing-and-uploading-apps-to-the-mac-app-store
147187# o Need ... --product <path-to-app-bundle-Info.plist>
188+ # According to this article, a "Developer ID Installer:..." signing key is required:
189+ # See: https://forums.ivanti.com/s/article/Obtaining-an-Apple-Developer-ID-Certificate-for-macOS-Provisioning?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1
148190#
149- dist/SLIP39-$(VERSION ) .pkg : dist/SLIP39.app \
150- dist/SLIP39.app-signed
191+ dist/SLIP39-$(VERSION ) .pkg : dist/SLIP39.app
151192 productbuild --sign " $( PKGID) " --timestamp \
152193 --identifier " $( BUNDLEID) .pkg" \
153194 --version $(VERSION ) \
154195 --component $< /Applications \
155196 $@
156- xcrun altool --validate-app -f $@ -t osx --apiKey $(APIKEY ) --apiIssuer $(APIISSUER )
157197
158- dist/SLIP39.pkg : dist/SLIP39.app # dist/SLIP39.app-signed
159- @echo " Checking signature..." ; ./SLIP39.metadata/check-signature $<
160- productbuild --sign " $( PKGID) " --timestamp \
161- --identifier " $( BUNDLEID) .pkg" \
162- --version $(VERSION ) \
163- --component $< /Applications \
164- $@
165- xcrun altool --validate-app -f $@ -t osx --apiKey $(APIKEY ) --apiIssuer $(APIISSUER )
166198
167- .PHONY : dist/SLIP39.pkg-verify
168- dist/SLIP39.pkg-verify : dist/SLIP39.pkg
199+ # Confirm that the .pkg is signed w/ the correct certificates.
200+ # See: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues
201+ # Not these:
202+ # spctl --assess --type install --context context:primary-signature -vvv $< || \
203+ # spctl --assess --type execute --context context:primary-signature -vvv $< || \
204+ # spctl --assess --type open --context context:primary-signature -vvv $< || \
205+ # spctl --assess --type install -vvv $< || \
206+ # spctl --assess --type execute -vvv $< || \
207+ # spctl --assess --type open -vvv $< || true
208+
209+ # Wrong:
210+ # o The developer.apple.com/documentation is wrong; it is directly in conflict with the error
211+ # messages returned, demanding the 3rd Party Installer signing key
212+
213+ .PHONY : dist/SLIP39-$(VERSION ) .pkg-verify
214+ dist/SLIP39-$(VERSION ) .pkg-verify : dist/SLIP39-$(VERSION ) .pkg
169215 @echo " \n\n*** Verifying signing of $<..."
170- # codesign --verify -v $< \
171- # || ( echo "!!! Unable to verify codesign: "; codesign --verify -vv $<; false )
172- spctl --assess --type install --context context:primary-signature -vvv $< || \
173- spctl --assess --type execute --context context:primary-signature -vvv $< || \
174- spctl --assess --type open --context context:primary-signature -vvv $< || \
175- spctl --assess --type install -vvv $< || \
176- spctl --assess --type execute -vvv $< || \
177- spctl --assess --type open -vvv $<
178-
179-
180- #
181- # Sign the pkg with the Installer ID, if not already done.
182- #
183- # o doesn't work -- notarization complains: "The binary is not signed with a valid Developer ID certificate."
184- #
185- dist/SLIP39-signed.pkg : dist/SLIP39.pkg FORCE
186- @echo " \n\n*** Signing $<..."
187- productsign --timestamp --sign " $( PKGID) " $< $@
188-
216+ pkgutil --check-signature $< | grep " Signed with a trusted timestamp"
217+ # pkgutil --check-signature $< | grep "1. Developer ID Installer:"
189218
190219#
191220# macOS Package Notarization
192- # See: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues
193221# See: https://oozou.com/blog/scripting-notarization-for-macos-app-distribution-38
194222# o The .pkg version doesn't work due to incorrect signing keys for the .pkg (unknown reason)
195- # o The .zip version works, but the notarization cannot be stapled to the zip;
196- # - We have to receive notification that the SLIP39.zip.notarization-status Status: success
197- # - Then, re-package the zip and
198- dist/SLIP39.pkg.notarization : dist/SLIP39.pkg
223+ dist/SLIP39-$(VERSION ) .pkg.notarization : dist/SLIP39-$(VERSION ) .pkg dist/SLIP39-$(VERSION ) .pkg-verify
199224 jq -r ' .["notarization-upload"]["RequestUUID"]' $@ 2> /dev/null \
200225 || xcrun altool --notarize-app -f $< \
201226 --primary-bundle-id $(BUNDLEID ) \
@@ -204,13 +229,63 @@ dist/SLIP39.pkg.notarization: dist/SLIP39.pkg
204229 --output-format json \
205230 > $@
206231
207- dist/SLIP39.pkg.notarization-status : dist/SLIP39.pkg.notarization FORCE
208- xcrun altool \
209- --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
210- --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
211- | tee -a $@
232+ dist/SLIP39-$(VERSION ) .pkg.notarization-status : dist/SLIP39-$(VERSION ) .pkg.notarization FORCE
233+ [ -s $@ ] && grep " Status: success" $@ \
234+ || xcrun altool \
235+ --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
236+ --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
237+ | tee -a $@
238+
239+ # Check notarization status 'til Status: success, then staple it to ...pkg, and create ...pkg.valid marker file
240+ dist/SLIP39-$(VERSION ) .pkg.valid : dist/SLIP39-$(VERSION ) .pkg.notarization-status FORCE
241+ @grep " Status: success" $< || \
242+ ( tail -10 $< ; echo " \n\n!!! App not yet notarized; try again in a few seconds..." ; false )
243+ ( [ -r $@ ] ) \
244+ && ( echo " \n\n*** Notarization complete; refreshing $@ " && touch $@ ) \
245+ || ( \
246+ xcrun stapler staple dist/SLIP39-$(VERSION ) .pkg && \
247+ xcrun stapler validate dist/SLIP39-$(VERSION ) .pkg && \
248+ echo " \n\n*** Notarization attached to $@ " && \
249+ touch $@ \
250+ )
251+
252+ # macOS ...pkg App Upload: Unless the ...dmg.upload file exists and is non-empty.
253+ # o Could also use Transporter
254+ # o Try either upload-package and upload-app approach
255+ # o NOTE that --apple-id is NOT your "Apple ID", it is the unique App ID (see above)
256+ dist/SLIP39-$(VERSION ) .pkg.upload-package : dist/SLIP39-$(VERSION ) .pkg dist/SLIP39-$(VERSION ) .pkg.valid FORCE
257+ [ -s $@ ] || ( \
258+ echo " \n\n*** Uploading the signed PKG file: $<..." && \
259+ echo " *** Verifying notarization stapling..." && xcrun stapler validate $< && \
260+ echo " *** Checking signature..." && ./SLIP39.metadata/check-signature $< && \
261+ echo " *** Upload starting for $<..." && \
262+ xcrun altool --upload-package $< \
263+ --type macos \
264+ --bundle-id $(BUNDLEID ) --bundle-version $(VERSION ) --bundle-short-version-string $(VERSION ) \
265+ --apple-id $(APPID ) --team $(TEAMID ) \
266+ --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
267+ | tee -a $@ \
268+ )
269+
212270
213- dist/SLIP39.zip.notarization : dist/SLIP39.zip
271+
272+ #
273+ # Build the macOS App, and Package the macOS App as a Zip file for Notarization
274+ #
275+ # o Create a ZIP archive suitable for notarization.
276+ #
277+ dist/SLIP39-$(VERSION ) .zip : dist/SLIP39.app
278+ @echo " \n\n*** Creating and signing DMG $@ ..."
279+ @echo " Checking signature..." && ./SLIP39.metadata/check-signature $<
280+ codesign --verify $<
281+ codesign -dv -r- $<
282+ codesign -vv $<
283+ rm -f $@
284+ /usr/bin/ditto -c -k --keepParent " $<" " $@ "
285+ @ls -last dist
286+
287+ # Upload and notarize the .zip, unless we've already uploaded it and have a RequestUUID
288+ dist/SLIP39-$(VERSION ) .zip.notarization : dist/SLIP39-$(VERSION ) .zip
214289 jq -r ' .["notarization-upload"]["RequestUUID"]' $@ 2> /dev/null \
215290 || xcrun altool --notarize-app -f $< \
216291 --primary-bundle-id $(BUNDLEID ) \
@@ -219,48 +294,63 @@ dist/SLIP39.zip.notarization: dist/SLIP39.zip
219294 --output-format json \
220295 > $@
221296
222- dist/SLIP39.zip.notarization-status : dist/SLIP39.zip.notarization FORCE
297+ # Refresh the ...zip.notariation-status, unless it is already "Status: success"
298+ dist/SLIP39-$(VERSION ) .zip.notarization-status : dist/SLIP39-$(VERSION ) .zip.notarization FORCE
299+ [ -s $@ ] && grep " Status: success" $@ \
300+ || xcrun altool \
301+ --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
302+ --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
303+ | tee -a $@
304+
223305
224- xcrun altool \
306+ # Check notarization status 'til Status: success, then mark the ...zip.valid
307+ # o We can't staple anything to a zip, but the contained app will now pass Gateway
308+ # on the client system, b/c it will check w/ Apple's servers that the app was notarized.
309+ dist/SLIP39-$(VERSION ) .zip.valid : dist/SLIP39-$(VERSION ) .zip.notarization-status FORCE
310+ @grep " Status: success" $< || \
311+ ( tail -10 $< ; echo " \n\n!!! App not yet notarized; try again in a few seconds..." ; false )
312+ @echo " \n\n*** Notarization complete; refreshing $@ " \
313+ && touch $@
314+
315+ # Submit App Zip w/o notarization stapled.
316+ # o Doesn't work; same "Unsupported toolchain." error as ...-notarized.zip.upload
317+ dist/SLIP39-$(VERSION ) .zip.upload-package : dist/SLIP39-$(VERSION ) .zip dist/SLIP39-$(VERSION ) .zip.valid FORCE
318+ [ -s $@ ] || xcrun altool --upload-package $< \
319+ --type macos \
320+ --bundle-id $(BUNDLEID ) --bundle-version $(VERSION ) --bundle-short-version-string $(VERSION ) \
321+ --apple-id $(APPID ) \
225322 --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
226- --notarization-info $$( jq -r '.["notarization-upload"]["RequestUUID"]' $< ) \
227323 | tee -a $@
228324
229- dist/SLIP39-$(VERSION ) -final.zip : dist/SLIP39.zip.notarization-status
230- grep " Status: success" $< || \
231- ( tail -10 $< ; echo " \n\n!!! App not yet notarized; cannot produce $@ " ; false )
325+ # Check notarization status 'til Status: success, then staple it to ...app, and create ...-notarized.zip
326+ # o The .zip version works, but the notarization cannot be stapled to the zip;
327+ # - It should usually be checked via Gatekeeper, by the recipient of the App in the .zip
328+ # - We have to receive notification that the SLIP39.zip.notarization-status Status: success
329+ # - So, once we confirm notarization, just submit/publish the original .zip file
330+ # o For other purposes (eg. just for manual installation), we can package the Notarized app
331+ dist/SLIP39-$(VERSION ) -notarized.zip : dist/SLIP39-$(VERSION ) .app dist/SLIP39-$(VERSION ) .zip.valid
232332 ( [ -r $@ ] ) \
233333 && ( echo " \n\n*** Notarization compete; not re-generating $@ " ; true ) \
234334 || ( \
235- xcrun stapler staple dist/SLIP39.app ; \
236- xcrun stapler validate dist/SLIP39.app ; \
237- echo " \n\n*** Notarization attached; creating $@ " ; \
238- /usr/bin/ditto -c -k --keepParent " dist/SLIP39.app " " $@ " ; \
335+ xcrun stapler staple $< ; \
336+ xcrun stapler validate $< ; \
337+ echo " \n\n*** Notarization attached to $< ; creating $@ " ; \
338+ /usr/bin/ditto -c -k --keepParent " $< " " $@ " ; \
239339 ls -last dist; \
240340 )
241- #
242- # macOS App Upload: Unless the ...zip.upload file exists and is non-zero
243- #
244- dist/SLIP39-$(VERSION ) -final.zip.upload : dist/SLIP39-$(VERSION ) -final.zip FORCE
341+
342+ # macOS ...zip App Upload: Unless the ...zip.upload file exists and is non-zero
343+ # o I don't think it is possible to construct, notarize and submit an App for the macOS store via Zip
344+ # - We can't staple the notarization onto it. Must use a .pkg or .dmg...
345+ # *** Error: Error uploading 'dist/SLIP39-6.6.4-notarized.zip'.
346+ # *** Error: Unsupported toolchain. Packages submitted to the App Store must be created either through Xcode, or using the productbuild[1] tool, as described in "Submitting your Mac apps to the App Store." Packages created by other tools, including PackageMaker, are not acceptable. [SIS] With error code STATE_ERROR.VALIDATION_ERROR.90270 for id 39784451-3843-428b-97ec-37c1b196ca35 Asset validation failed (-19208)
347+ dist/SLIP39-$(VERSION ) -notarized.zip.upload : dist/SLIP39-$(VERSION ) -notarized.zip FORCE
245348 [ -s $@ ] || xcrun altool --upload-package $< \
246349 --type macos \
247350 --bundle-id $(BUNDLEID ) --bundle-version $(VERSION ) --bundle-short-version-string $(VERSION ) \
248- --apple-id $(APPLEID ) \
351+ --apple-id $(APPID ) \
249352 --apiKey $(APIKEY ) --apiIssuer $(APIISSUER ) \
250353 | tee -a $@
251- #
252- # Package the macOS App as a Zip file for Notarization
253- #
254- # o Create a ZIP archive suitable for notarization.
255- #
256- dist/SLIP39.zip : dist/SLIP39.app
257- echo " Checking signature..." ; ./SLIP39.metadata/check-signature $<
258- codesign --verify $<
259- codesign -dv -r- $<
260- codesign -vv $<
261- rm -f $@
262- /usr/bin/ditto -c -k --keepParent " $<" " $@ "
263- @ls -last dist
264354
265355
266356#
@@ -346,6 +436,7 @@ dist/SLIP39.app: SLIP39.spec \
346436# + version='6.4.1',
347437# + info_plist={
348438# + 'CFBundleVersion':'6.4.1',
439+ # + 'CFBundlePackageType':'APPL',
349440# + 'LSApplicationCategoryType':'public.app-category.utilities',
350441# + 'LSMinimumSystemVersion':'10.15.0',
351442# + })
0 commit comments