@KirillOsenkov I can help with sign and notarize scripts for this task. But it requires some preparation from you with apple dev account.
Previously I did that for self-hosted macOS virtual machines, but it should work on public github machines too (need to deal with certificate export).

More or less comprehensive list of what needs to be prepared on macOS machine owned by you:

Create Apple Developer account.
Create "Developer ID Application" certificate on https://developer.apple.com/account/resources/certificates/list page.
2.1. It will ask you to create a Certificate Signing Request, this page explains how https://developer.apple.com/help/account/create-certificates/create-a-certificate-signing-request/
2.2. Download and install created certificate.
2.3. Note, this also will bound this certificate to your machine. We will need workaround that later.
Create app identifier on https://developer.apple.com/account/resources/identifiers/list
3.1. Right now, you have "structuredlogviewer" as an app identifier. I am not sure if it's a valid one, probably "com.MSBuildStructuredLog" will be necessary. Either way, apple dashboard should let you know if ID is invalid or not.
(Optional) With certificate and id it's possible to create Provisioning Profile on the same page. It doesn't seem to be necessary now (I had signing and notarizing done successfully without it), but it likely will be soon.
Export certificate from your machine and protect it with password: https://stackoverflow.com/questions/14954074/export-development-certificate-as-p12.
Copy p12 certificate and provisioning profile to the git. Note: it might be a good idea to additionally encrypt p12 cert.
Prepare CI secrets:
7.1. p12 password(s)
7.2. Your apple dev-account email and password. Password needs to be an app-specific password https://support.apple.com/en-us/102654

And changes to the build script that needs to be made (can be done by anybody, as it doesn't require apple dev account access at this point). All of these steps below can be automated in the script for each build:

Install p12 certificate using certificate file and secrets.
Include provisioning profile with app bundle.
Sign binaries with Apple cert and proper identity.
Zip bundle, upload it for notarization, wait (can be couple of minutes, but can be days, especially for the first run and JIT apps).
Done. Creating a "dmg" file would be a nice addition.

Hopefully I am not missing anything.

Uh oh!

Please sign and notarize macOS app #686

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions