arsvendg/Stirling-PDF
1
0
Fork 0
mirror of https://github.com/arsvendg/Stirling-PDF.git synced 2026-07-16 19:33:11 +02:00
Code Issues Actions 3 Packages Projects Releases 1 Wiki Activity

Redesign and enable macOS signing (#4883)

Browse Source 
# Description of Changes
Re-enable macOS signing and tweak so it runs successfully through CI.
Also changes the runner to use macOS 15 instead of 13, which was
throwing a deprecation warning in GitHub. Note that the runner doesn't
affect the minimum target, which I've still got set to 10.15 (no idea if
it actually works on 10.15 but let's assume that if it builds it works
until someone can test it)
This commit is contained in:
James Brunton
2025-11-13 12:11:59 +00:00
committed by GitHub
parent 3ae2946d57
commit d06391a927
2 changed files with 86 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/tauri-build.yml
+80 -67
View File
@@ -47,21 +47,19 @@ jobs:
"windows") "windows")
echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
;; ;;
# "macos") "macos")
# echo 'matrix={"include":[{"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
# ;; ;;
"linux") "linux")
echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
;; ;;
*) *)
echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
# Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
;; ;;
esac esac
else else
# For PR/push events, build all platforms # For PR/push events, build all platforms
echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
# Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
fi fi
build: build:
@@ -96,7 +94,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@stable
with: with:
toolchain: stable toolchain: stable
targets: ${{ (matrix.platform == 'macos-latest' || matrix.platform == 'macos-13') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }} targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
@@ -183,80 +181,96 @@ jobs:
working-directory: ./frontend working-directory: ./frontend
run: npm install run: npm install
# Disabled Mac builds - Import Apple Developer Certificate - name: Import Apple Developer Certificate
# - name: Import Apple Developer Certificate if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
# if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13' env:
# env: APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
# APPLE_ID: ${{ secrets.APPLE_ID }} APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
# APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} run: |
# APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} echo "Importing Apple Developer Certificate..."
# APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
# KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} # Create temporary keychain
# run: | KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# echo "Importing Apple Developer Certificate..." KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
# echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12 security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
# security default-keychain -s build.keychain security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain # Import certificate
# security set-keychain-settings -t 3600 -u build.keychain security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
# security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign security list-keychain -d user -s $KEYCHAIN_PATH
# security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# security find-identity -v -p codesigning build.keychain # Clean up
# - name: Verify Certificate rm certificate.p12
# if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
# run: |
# echo "Verifying Apple Developer Certificate..."
# CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
# echo "Certificate Info: $CERT_INFO"
# CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
# echo "Certificate ID: $CERT_ID"
# echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
# echo "Certificate imported."
# - name: Check DMG creation dependencies (macOS only) - name: Verify Certificate
# if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13' if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
# run: | run: |
# echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..." echo "Verifying Apple Developer Certificate..."
# echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')" KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')" CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
# echo "Available disk space: $(df -h /tmp | tail -1)" echo "Certificate Info: $CERT_INFO"
# echo "macOS version: $(sw_vers -productVersion)" CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
# echo "Available tools:" echo "Certificate ID: $CERT_ID"
# ls -la /usr/bin/hd* || echo "No hd* tools found" echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
echo "Certificate imported successfully."
- name: Build Tauri app - name: Check DMG creation dependencies (macOS only)
if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
run: |
echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
echo "Available disk space: $(df -h /tmp | tail -1)"
echo "macOS version: $(sw_vers -productVersion)"
echo "Available tools:"
ls -la /usr/bin/hd* || echo "No hd* tools found"
- name: Build Tauri app
uses: tauri-apps/tauri-action@v0 uses: tauri-apps/tauri-action@v0
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }} APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
APPLE_ID: ${{ secrets.APPLE_ID }} APPLE_ID: ${{ secrets.APPLE_ID }}
APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }} APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
SIGN: 1 SIGN: 1
CI: true CI: true
with: with:
projectPath: ./frontend projectPath: ./frontend
tauriScript: npx tauri tauriScript: npx tauri
args: ${{ matrix.args }} args: ${{ matrix.args }}
- name: Verify notarization (macOS only)
if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
run: |
echo "🔍 Verifying notarization status..."
cd ./frontend/src-tauri/target
DMG_FILE=$(find . -name "*.dmg" | head -1)
if [ -n "$DMG_FILE" ]; then
echo "Found DMG: $DMG_FILE"
echo "Checking notarization ticket..."
spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
else
echo "⚠️ No DMG file found to verify"
fi
- name: Rename artifacts - name: Rename artifacts
shell: bash shell: bash
run: | run: |
mkdir -p ./dist mkdir -p ./dist
cd ./frontend/src-tauri/target cd ./frontend/src-tauri/target
# Find and rename artifacts based on platform # Find and rename artifacts based on platform
if [ "${{ matrix.platform }}" = "windows-latest" ]; then if [ "${{ matrix.platform }}" = "windows-latest" ]; then
find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \; find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \; find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
# Disabled Mac builds elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
# elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
# find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \; find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
# find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
else else
find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \; find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \; find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
@@ -273,7 +287,7 @@ jobs:
shell: bash shell: bash
run: | run: |
cd ./frontend/src-tauri/target cd ./frontend/src-tauri/target
# Check for expected artifacts based on platform # Check for expected artifacts based on platform
if [ "${{ matrix.platform }}" = "windows-latest" ]; then if [ "${{ matrix.platform }}" = "windows-latest" ]; then
echo "Checking for Windows artifacts..." echo "Checking for Windows artifacts..."
@@ -282,14 +296,13 @@ jobs:
echo "❌ No Windows executable found" echo "❌ No Windows executable found"
exit 1 exit 1
fi fi
# Disabled Mac builds elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
# elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then echo "Checking for macOS artifacts..."
# echo "Checking for macOS artifacts..." find . -name "*.dmg" -o -name "*.app" | head -5
# find . -name "*.dmg" -o -name "*.app" | head -5 if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
# if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then echo "❌ No macOS artifacts found"
# echo "❌ No macOS artifacts found" exit 1
# exit 1 fi
# fi
else else
echo "Checking for Linux artifacts..." echo "Checking for Linux artifacts..."
find . -name "*.deb" -o -name "*.AppImage" | head -5 find . -name "*.deb" -o -name "*.AppImage" | head -5
@@ -298,7 +311,7 @@ jobs:
exit 1 exit 1
fi fi
fi fi
echo "✅ Build artifacts found for ${{ matrix.name }}" echo "✅ Build artifacts found for ${{ matrix.name }}"
- name: Test artifact sizes - name: Test artifact sizes
frontend/src-tauri/tauri.conf.json
+6
View File
@@ -50,6 +50,12 @@
"deb": { "deb": {
"desktopTemplate": "stirling-pdf.desktop" "desktopTemplate": "stirling-pdf.desktop"
} }
},
"macOS": {
"minimumSystemVersion": "10.15",
"signingIdentity": null,
"entitlements": null,
"providerShortName": null
} }
}, },
"plugins": { "plugins": {