Switch to use JPDFium v1.0.2, which signs the Mac binaries (#6521)

# Description of Changes
Currently, it's not possible to develop the backend on Mac without
manually signing the JPDFium binaries yourself since macOS will reject
running the unsigned binaries. [We've now updated JPDFium to sign the
Mac binaries in
v1.0.2](https://github.com/Stirling-Tools/JPDFium/releases/tag/v1.0.2),
so update to use that version.

.github/workflows/multiOSReleases.yml

@@ -442,10 +442,6 @@ jobs:
           echo "Generated tauri.windows.conf.json (alias masked):"
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
       - name: Import release GPG signing key (Linux)
         if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |

.github/workflows/tauri-build.yml

@@ -271,10 +271,6 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
       - name: Check DMG creation dependencies (macOS only)
         if: matrix.platform == 'macos-15'
         run: |

app/common/build.gradle

@@ -60,7 +60,7 @@ dependencies {
         exclude group: 'com.google.code.gson', module: 'gson'
     }
 
-    api 'com.stirling:jpdfium:1.0.1'
+    api 'com.stirling:jpdfium:1.0.2'
 
     // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -75,7 +75,7 @@ dependencies {
     }
     logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
     }
 
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)

frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# Sign every .dylib inside the bootJar's JPDFium native jars.
-# Requires APPLE_SIGNING_IDENTITY set to a Developer ID identity in the keychain.
-#
-# Usage: sign-jpdfium-dylibs-in-bootjar.sh [path/to/stirling-pdf-*.jar]
-
-set -u
-
-echo "sign-jpdfium-dylibs-in-bootjar.sh: start  ($(uname -s) $(uname -m))"
-
-case "$(uname -s)" in
-    Darwin*) ;;
-    *) echo "Not macOS, skipping"; exit 0;;
-esac
-
-if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then
-    echo "APPLE_SIGNING_IDENTITY not set; skipping"
-    exit 0
-fi
-if ! command -v codesign >/dev/null 2>&1; then
-    echo "codesign not on PATH; skipping"
-    exit 0
-fi
-if ! command -v jar >/dev/null 2>&1; then
-    echo "jar not on PATH (need a JDK setup-action earlier); skipping"
-    exit 0
-fi
-
-BOOTJARS=()
-if [ -n "${1:-}" ]; then
-    BOOTJARS+=("$1")
-else
-    for cand in app/core/build/libs/stirling-pdf-*.jar \
-                frontend/editor/src-tauri/libs/stirling-pdf-*.jar; do
-        [ -f "$cand" ] || continue
-        BOOTJARS+=("$cand")
-    done
-fi
-if [ "${#BOOTJARS[@]:-0}" = 0 ]; then
-    echo "bootJar not found (expected app/core/build/libs/stirling-pdf-*.jar" \
-         "or frontend/editor/src-tauri/libs/stirling-pdf-*.jar)"
-    exit 0
-fi
-
-for BOOTJAR in "${BOOTJARS[@]}"; do
-    BOOTJAR=$(cd "$(dirname "$BOOTJAR")" && pwd)/$(basename "$BOOTJAR")
-    echo ""
-    echo "=== Target bootJar: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1)) ==="
-
-    WORK=$(mktemp -d)
-    # shellcheck disable=SC2064
-    trap "rm -rf '$WORK'" EXIT
-
-    NATIVE_JAR_PATHS=()
-    while IFS= read -r line; do
-        [ -n "$line" ] || continue
-        NATIVE_JAR_PATHS+=("$line")
-    done < <(jar tf "$BOOTJAR" \
-        | grep -E '^BOOT-INF/lib/jpdfium-natives-darwin-(x64|arm64)-.*\.jar$' || true)
-
-    if [ "${#NATIVE_JAR_PATHS[@]:-0}" = 0 ]; then
-        echo "  No JPDFium darwin natives in this bootJar; skipping"
-        rm -rf "$WORK"
-        continue
-    fi
-
-    ( cd "$WORK" && jar xf "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \
-        || { echo "jar xf failed to extract natives jars" >&2; exit 1; }
-
-    ANY_SIGNED=0
-    for nat_jar in "$WORK/BOOT-INF/lib"/jpdfium-natives-darwin-*.jar; do
-        [ -f "$nat_jar" ] || continue
-        base=$(basename "$nat_jar")
-        echo "  Processing $base"
-
-        exp_dir="$WORK/${base%.jar}.expanded"
-        mkdir -p "$exp_dir"
-        ( cd "$exp_dir" && jar xf "$nat_jar" )
-
-        signed=0
-        while IFS= read -r dylib; do
-            codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
-                     --options runtime --timestamp "$dylib" 2>&1 | sed 's/^/      /'
-            signed=$((signed + 1))
-        done < <(find "$exp_dir" -name '*.dylib' -type f)
-
-        if [ "$signed" = 0 ]; then
-            echo "    (no .dylibs found)"
-            continue
-        fi
-        echo "    signed $signed dylib(s)"
-
-        rm -f "$nat_jar"
-        ( cd "$exp_dir" && jar cfM0 "$nat_jar" . )
-        ANY_SIGNED=1
-    done
-
-    if [ "$ANY_SIGNED" = 0 ]; then
-        echo "  No .dylibs signed; skipping update"
-        rm -rf "$WORK"
-        continue
-    fi
-
-    # `jar uf` always DEFLATEs; Spring Boot's nested-jar loader only reads
-    # STORED entries. Use `zip -0` to update in place with no compression.
-    ( cd "$WORK" && zip -q0 "$BOOTJAR" ${NATIVE_JAR_PATHS[@]+"${NATIVE_JAR_PATHS[@]}"} ) \
-        || { echo "zip update failed" >&2; exit 1; }
-
-    echo "  Updated: $BOOTJAR ($(du -h "$BOOTJAR" | cut -f1))"
-    rm -rf "$WORK"
-done