Skip to content

Commit 3a72c74

Browse files
DBraunDBraun
authored
macos-arm64 and codesign (#22)
1 parent 18ec412 commit 3a72c74

File tree

6 files changed

+191
-263
lines changed

6 files changed

+191
-263
lines changed

‎.github/workflows/all.yml

+122-39
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
env:
2+
CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM: ${{ secrets.CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM }}
3+
MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
4+
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
5+
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
6+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
7+
NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }}
8+
NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }}
9+
NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
10+
111
name: Compile
212
on:
313
pull_request: {}
@@ -43,38 +53,92 @@ jobs:
4353
7z a ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}.zip ./ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}/* -r
4454
4555
- name: Upload artifact
46-
uses: actions/upload-artifact@v3
56+
uses: actions/upload-artifact@v4
4757
with:
4858
name: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
4959
path: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}.zip
60+
if-no-files-found: error
5061

5162
build-macos:
52-
runs-on: ${{ matrix.os }}
5363
strategy:
64+
fail-fast: false
5465
matrix:
5566
include:
56-
- { name: "macos-x86_64", os: "macos-11", python-version: "3.9", python-major: "39"}
57-
- { name: "macos-x86_64", os: "macos-11", python-version: "3.11", python-major: "311"}
67+
- name: macos-x86_64
68+
arch: x86_64
69+
os: macos-12
70+
python-version: "3.11"
71+
python-major: "311"
72+
- name: macos-arm64
73+
arch: arm64
74+
os: macos-12
75+
python-version: "3.11"
76+
python-major: "311"
77+
78+
runs-on: macos-12
79+
env:
80+
DEST_DIR: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
5881
steps:
5982
- uses: actions/checkout@v4
6083
with:
6184
submodules: true
6285

63-
- name: Setup Python 3.8
86+
- name: Install Certificate
87+
# https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development
88+
run: |
89+
# create variables
90+
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
91+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
92+
93+
# import certificate and provisioning profile from secrets
94+
echo -n "$MACOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
95+
96+
# create temporary keychain
97+
security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" $KEYCHAIN_PATH
98+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
99+
security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" $KEYCHAIN_PATH
100+
101+
# import certificate to keychain
102+
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
103+
security set-key-partition-list -S apple-tool:,apple: -k "$MACOS_CERTIFICATE_PASSWORD" $KEYCHAIN_PATH
104+
echo "list-keychain:\n"
105+
security list-keychain -d user -s $KEYCHAIN_PATH
106+
echo "find-identity:\n"
107+
security find-identity -v
108+
echo "find-identity codesigning:\n"
109+
security find-identity -p codesigning -v
110+
111+
- name: Setup Python
64112
uses: actions/setup-python@v5
65113
with:
66-
python-version: '3.8'
114+
python-version: ${{ matrix.python-version }}
67115

68-
- name: Setup Python
116+
- name: Brew install requirements (arm64)
117+
if: ${{ endsWith( matrix.name, 'macos-arm64') }}
69118
run: |
70-
which python
71-
python --version
72-
pip install --upgrade certifi
73-
cd install_script
74-
python macos_install_python.py
75-
76-
- name: Get CMake
77-
uses: lukka/get-cmake@latest
119+
brew update
120+
PACKAGES=(flac libogg libtool libvorbis opus mpg123 lame)
121+
DEPS=($(brew deps --union --topological $(echo $PACKAGES) | tr '\n' ' '))
122+
PACKAGES=("${DEPS[@]}" "${PACKAGES[@]}")
123+
export HOMEBREW_NO_INSTALL_CLEANUP=1
124+
export HOMEBREW_NO_INSTALL_UPGRADE=1
125+
export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
126+
for PACKAGE in "${PACKAGES[@]}"
127+
do
128+
echo "Fetching bottle: $PACKAGE"
129+
response=$(brew fetch --bottle-tag=arm64_monterey $PACKAGE 2>&1)
130+
package_path=$(echo $response | sed -n 's/.*\:\ \(.*\.tar\.gz\).*/\1/p')
131+
package_path=$(echo "$package_path" | xargs)
132+
echo "Package Path: $package_path"
133+
brew reinstall --verbose --force-bottle "$package_path" || true
134+
done
135+
136+
brew uninstall --ignore-dependencies curl git || true
137+
138+
- name: Install dependencies macOS
139+
if: ${{ endsWith( matrix.name, 'macos-x86_64') }}
140+
run: |
141+
brew install autoconf autogen automake flac libogg libtool libvorbis opus mpg123 pkg-config
78142
79143
- name: Some Setup
80144
run: |
@@ -84,40 +148,59 @@ jobs:
84148
85149
- name: Build MacOS (Release)
86150
run: |
87-
export PATH=/Library/Frameworks/Python.framework/Versions/${{ matrix.python-version }}:/Library/Frameworks/Python.framework/Versions/${{ matrix.python-version }}/bin:/Library/Frameworks/Python.framework/Versions/${{ matrix.python-version }}/lib:$PATH
88-
which python3
89-
python3 --version
90-
which python3
91-
python3 --version
92-
mkdir build && cd build
93-
cmake .. -G "Xcode" -DCMAKE_OSX_ARCHITECTURES="x86_64" -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0
94-
xcodebuild -configuration Release -project ChucKDesignerCHOP.xcodeproj
95-
ls -r *
96-
install_name_tool -change @rpath/libChucKDesignerShared.dylib @loader_path/../../../libChucKDesignerShared.dylib Release/ChucKDesignerCHOP.plugin/Contents/MacOS/ChucKDesignerCHOP
97-
install_name_tool -change @rpath/libChucKDesignerShared.dylib @loader_path/../../../libChucKDesignerShared.dylib Release/ChucKListenerCHOP.plugin/Contents/MacOS/ChucKListenerCHOP
151+
cmake -Bbuild -G "Xcode" -DCMAKE_OSX_ARCHITECTURES=${{matrix.arch}} -DCMAKE_OSX_DEPLOYMENT_TARGET=12.0 -DPYTHONVER="${{matrix.python-version}}" -DPython_ROOT_DIR=$pythonLocation
152+
cmake --build build --config Release
153+
codesign --entitlements "mac/miniAudicle.entitlements" --force --deep --timestamp --verify --verbose=2 --options=runtime --sign "Developer ID Application: David Braun (${{secrets.CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM}})" build/Release/ChucKDesignerCHOP.plugin
154+
codesign --entitlements "mac/miniAudicle.entitlements" --force --deep --timestamp --verify --verbose=2 --options=runtime --sign "Developer ID Application: David Braun (${{secrets.CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM}})" build/Release/ChucKListenerCHOP.plugin
155+
codesign --entitlements "mac/miniAudicle.entitlements" --force --deep --timestamp --verify --verbose=2 --options=runtime --sign "Developer ID Application: David Braun (${{secrets.CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM}})" build/Release/libChucKDesignerShared.dylib
156+
codesign --verify --deep --strict --verbose=2 build/Release/ChucKDesignerCHOP.plugin
157+
codesign --verify --deep --strict --verbose=2 build/Release/ChucKListenerCHOP.plugin
158+
codesign --verify --deep --strict --verbose=2 build/Release/libChucKDesignerShared.dylib
98159
99160
- name: Make distribution
100161
run: |
101-
mkdir ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
102-
cp ${{ github.workspace }}/build/Release/libChucKDesignerShared.dylib ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
103-
mv ${{ github.workspace }}/build/Release/ChucKDesignerCHOP.plugin ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
104-
mv ${{ github.workspace }}/build/Release/ChucKListenerCHOP.plugin ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
105-
zip -r ChucKDesigner-${{ matrix.os }}-Python${{ matrix.python-major }}.zip ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
106-
107-
# Don't upload until we figure out codesigning.
108-
# - name: Upload artifact
109-
# uses: actions/upload-artifact@v3
110-
# with:
111-
# name: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
112-
# path: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}.zip
162+
mkdir $DEST_DIR
163+
cp ${{ github.workspace }}/build/Release/libChucKDesignerShared.dylib $DEST_DIR
164+
mv ${{ github.workspace }}/build/Release/ChucKDesignerCHOP.plugin $DEST_DIR
165+
mv ${{ github.workspace }}/build/Release/ChucKListenerCHOP.plugin $DEST_DIR
166+
zip -r $DEST_DIR.zip $DEST_DIR
167+
168+
- name: Notarize
169+
run: |
170+
xcrun notarytool submit "$DEST_DIR.zip" \
171+
--team-id "$NOTARIZATION_TEAM_ID" \
172+
--apple-id "$NOTARIZATION_USERNAME" \
173+
--password "$NOTARIZATION_PASSWORD" \
174+
--wait
175+
176+
- name: Staple
177+
# While you can notarize a ZIP archive, you can’t staple to it directly.
178+
# Instead, run stapler against each item that you added to the archive.
179+
# Then create a new ZIP file containing the stapled items for distribution.
180+
# Although tickets are created for standalone binaries, it’s not currently possible to staple tickets to them.
181+
run: |
182+
xcrun stapler staple $DEST_DIR/ChucKDesignerCHOP.plugin
183+
xcrun stapler staple $DEST_DIR/ChucKListenerCHOP.plugin
184+
185+
- name: Make stapled distribution
186+
run: |
187+
rm $DEST_DIR.zip
188+
zip -r $DEST_DIR.zip $DEST_DIR
189+
190+
- name: Upload artifact
191+
uses: actions/upload-artifact@v4
192+
with:
193+
name: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}
194+
path: ChucKDesigner-${{ matrix.name }}-Python${{ matrix.python-major }}.zip
195+
if-no-files-found: error
113196

114197
create-release:
115198
if: startsWith(github.ref, 'refs/tags/v')
116199
needs: [build-windows, build-macos]
117200
runs-on: ubuntu-latest
118201
name: "Create Release on GitHub"
119202
steps:
120-
- uses: actions/download-artifact@v3
203+
- uses: actions/download-artifact@v4
121204
with:
122205
path: "dist"
123206

0 commit comments

Comments
 (0)