From 5c696694282f6164ec2c19f76c3efc7a4ac43ba8 Mon Sep 17 00:00:00 2001 From: DecDuck Date: Sat, 2 Aug 2025 15:01:53 +1000 Subject: [PATCH] macOS app signing (#95) * feat: add macos signing args * fix: update all versions to -mac specific * fix: fetch signing identity * feat: add signing pre-steps like the docs say * fix: remove apple requirement from signing * fix: add drop cert to keychain when signing * fix: add drop.pem to add-trusted-cert * fix: re-order and specify import operation * fix: let's try the user store * fix: password required to update trust * fix: try another non-interactive fix * fix: try sudo * fix: revert attempt fix * fix: add cert id debug * fix: attempt to use id rather than name * fix: revert code id to name --- desktop/.github/workflows/release.yml | 34 +++++++++++++++++++++++++++ desktop/package.json | 2 +- desktop/src-tauri/Cargo.lock | 2 +- desktop/src-tauri/Cargo.toml | 2 +- desktop/src-tauri/tauri.conf.json | 2 +- 5 files changed, 38 insertions(+), 4 deletions(-) diff --git a/desktop/.github/workflows/release.yml b/desktop/.github/workflows/release.yml index 129f754a..9e604614 100644 --- a/desktop/.github/workflows/release.yml +++ b/desktop/.github/workflows/release.yml @@ -54,12 +54,46 @@ jobs: sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf # webkitgtk 4.0 is for Tauri v1 - webkitgtk 4.1 is for Tauri v2. + + - name: Import Apple Developer Certificate + if: matrix.platform == 'macos-latest' + env: + APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + run: | + echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12 + security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain + security default-keychain -s build.keychain + security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain + security set-keychain-settings -t 3600 -u build.keychain + + curl https://droposs.org/drop.crt --output drop.pem + sudo security authorizationdb write com.apple.trust-settings.admin allow + sudo security add-trusted-cert -d -r trustRoot -k build.keychain -p codeSign -u -1 drop.pem + sudo security authorizationdb remove com.apple.trust-settings.admin + + security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign + security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain + security find-identity -v -p codesigning build.keychain + + - name: Verify Certificate + if: matrix.platform == 'macos-latest' + run: | + CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Drop OSS") + CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}') + echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV + echo "Certificate imported. Using identity: $CERT_ID" + - name: install frontend dependencies run: yarn install # change this to npm, pnpm or bun depending on which one you use. - uses: tauri-apps/tauri-action@v0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }} with: tagName: v__VERSION__ # the action automatically replaces \_\_VERSION\_\_ with the app version. releaseName: 'Auto-release v__VERSION__' diff --git a/desktop/package.json b/desktop/package.json index 0d1f6fce..d905e7ab 100644 --- a/desktop/package.json +++ b/desktop/package.json @@ -1,7 +1,7 @@ { "name": "drop-app", "private": true, - "version": "0.3.1", + "version": "0.3.1-mac", "type": "module", "scripts": { "build": "nuxt build", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 653b9029..52f115c8 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1284,7 +1284,7 @@ dependencies = [ [[package]] name = "drop-app" -version = "0.3.1" +version = "0.3.1-mac" dependencies = [ "atomic-instant-full", "bitcode", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 637ec890..bd30de6f 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "drop-app" -version = "0.3.1" +version = "0.3.1-mac" description = "The client application for the open-source, self-hosted game distribution platform Drop" authors = ["Drop OSS"] edition = "2024" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index d03f9eac..2d9b6e71 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2.0.0", "productName": "Drop Desktop Client", - "version": "0.3.1", + "version": "0.3.1-mac", "identifier": "dev.drop.app", "build": { "beforeDevCommand": "yarn dev --port 1432",