From f49af428bf07eb63410aa3f1c0b317e766bdf508 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 28 Feb 2026 02:38:46 +0800 Subject: [PATCH 01/12] ci(releaser): sign macOS artifacts --- .github/releasers/macos/Info.plist | 2 +- .github/releasers/releaser_gui_macos.sh | 30 +++++++++++-- .github/workflows/releaser.yml | 11 +++++ .github/workflows/test-macos-signing.yml | 57 ++++++++++++++++++++++++ 4 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/test-macos-signing.yml diff --git a/.github/releasers/macos/Info.plist b/.github/releasers/macos/Info.plist index 30fb8745a..812fd4ab6 100644 --- a/.github/releasers/macos/Info.plist +++ b/.github/releasers/macos/Info.plist @@ -5,7 +5,7 @@ CFBundlePackageType APPL CFBundleIdentifier - com.github.pactus-project.pactus.pactus-gui + org.pactus.pacgui CFBundleExecutable pactus-gui CFBundleName diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index 2b953f048..c91b527e3 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -36,6 +36,14 @@ CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath -o ${BUILD_DIR}/pactus-wallet CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath -o ${BUILD_DIR}/pactus-shell ./cmd/shell CGO_ENABLED=1 go build -ldflags "-s -w -extldflags -headerpad_max_install_names" -trimpath -tags gtk -o ${BUILD_DIR}/pactus-gui ./cmd/gtk +if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then + echo "Signing binaries..." + codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon + codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet + codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell + codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui +fi + echo "Installing gtk-mac-bundler" git clone https://gitlab.gnome.org/GNOME/gtk-mac-bundler.git @@ -77,17 +85,33 @@ ${BUNDLER} ${GUI_BUNDLE}/gui.bundle # Removing Cellar as workaround rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar +if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then + echo "Signing app bundle..." + codesign --force --options runtime --deep --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app +fi + echo "Creating dmg" # https://github.com/create-dmg/create-dmg - create-dmg --version - create-dmg --skip-jenkins \ --volname "Pactus GUI" \ "${FILE_NAME}.dmg" \ "${ROOT_DIR}/pactus-gui.app" -echo "Creating archive" +if [ ! -z "${APPLE_ID}" ]; then + echo "Submitting for notarization..." + xcrun notarytool submit "${FILE_NAME}.dmg" \ + --apple-id "${APPLE_ID}" \ + --password "${APPLE_PASSWORD}" \ + --team-id "${APPLE_TEAM_ID}" \ + --wait + + echo "Stapling..." + xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" + xcrun stapler staple "${FILE_NAME}.dmg" +fi + +echo "Creating tar.gz archive" cp ${BUILD_DIR}/pactus-daemon ${PACKAGE_DIR} cp ${BUILD_DIR}/pactus-wallet ${PACKAGE_DIR} cp ${BUILD_DIR}/pactus-shell ${PACKAGE_DIR} diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml index de1a87fd9..9b13ccaff 100644 --- a/.github/workflows/releaser.yml +++ b/.github/workflows/releaser.yml @@ -121,8 +121,19 @@ jobs: with: go-version: "1.26.2" + - name: Import macOS Certificates + uses: apple-actions/import-codesign-certs@v1 + with: + p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }} + p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }} + - name: Create release files run: bash ./.github/releasers/releaser_gui_macos.sh + env: + MACOS_CERT_IDENTITY: ${{ secrets.MACOS_CERT_IDENTITY }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - name: Calculate sha256sum run: sha256sum pactus-*.dmg pactus-*.tar.gz > checksum-${{ matrix.name }}.txt diff --git a/.github/workflows/test-macos-signing.yml b/.github/workflows/test-macos-signing.yml new file mode 100644 index 000000000..267f9e9da --- /dev/null +++ b/.github/workflows/test-macos-signing.yml @@ -0,0 +1,57 @@ +name: Test macOS Signing + +on: + pull_request: + +jobs: + test-gui-macos: + runs-on: ${{ matrix.runner }} + strategy: + matrix: + name: [macos-amd64, macos-arm64] + include: + - name: macos-amd64 + runner: macos-15-intel + lib_home: /usr/local + - name: macos-arm64 + runner: macos-15 + lib_home: /opt/homebrew + + env: + LIB_HOME: ${{ matrix.lib_home }} + + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 # Required for git describe + + - name: Install Dependencies + run: brew install gtk+3 librsvg create-dmg coreutils gdk-pixbuf glib-networking pkg-config + + - name: Install Go + uses: actions/setup-go@v6 + with: + go-version: "1.26.0" + + - name: Import macOS Certificates + if: ${{ secrets.MACOS_CERTIFICATE != '' }} + uses: apple-actions/import-codesign-certs@v1 + with: + p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }} + p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }} + + - name: Create release files + run: bash ./.github/releasers/releaser_gui_macos.sh + env: + MACOS_CERT_IDENTITY: ${{ secrets.MACOS_CERT_IDENTITY }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + + - name: Upload Artifacts + uses: actions/upload-artifact@v6 + with: + name: pactus-gui-test-${{ matrix.name }} + path: | + pactus-*.dmg + pactus-*.tar.gz From 4e80a10c811cf184a656eb60acef0083a2fd0b3c Mon Sep 17 00:00:00 2001 From: Mostafa Date: Wed, 1 Apr 2026 15:36:38 +0800 Subject: [PATCH 02/12] ci(releaser): sign macOS artifacts --- .github/releasers/releaser_gui_macos.sh | 13 ++++++------- .github/workflows/test-macos-signing.yml | 7 +++++-- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index c91b527e3..708f6bd84 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -37,14 +37,13 @@ CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath -o ${BUILD_DIR}/pactus-shell . CGO_ENABLED=1 go build -ldflags "-s -w -extldflags -headerpad_max_install_names" -trimpath -tags gtk -o ${BUILD_DIR}/pactus-gui ./cmd/gtk if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "Signing binaries..." - codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon - codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet - codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell - codesign --force --options runtime --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui + echo "Signing binaries... ${MACOS_CERT_IDENTITY}" + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui fi - echo "Installing gtk-mac-bundler" git clone https://gitlab.gnome.org/GNOME/gtk-mac-bundler.git cd gtk-mac-bundler @@ -87,7 +86,7 @@ rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then echo "Signing app bundle..." - codesign --force --options runtime --deep --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + codesign --force --options runtime --timestamp --deep --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi echo "Creating dmg" diff --git a/.github/workflows/test-macos-signing.yml b/.github/workflows/test-macos-signing.yml index 267f9e9da..72b0bce62 100644 --- a/.github/workflows/test-macos-signing.yml +++ b/.github/workflows/test-macos-signing.yml @@ -2,6 +2,7 @@ name: Test macOS Signing on: pull_request: + workflow_dispatch: jobs: test-gui-macos: @@ -34,12 +35,14 @@ jobs: go-version: "1.26.0" - name: Import macOS Certificates - if: ${{ secrets.MACOS_CERTIFICATE != '' }} - uses: apple-actions/import-codesign-certs@v1 + uses: apple-actions/import-codesign-certs@v6 with: p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }} p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }} + - name: List Identities + run: security find-identity -v -p codesigning + - name: Create release files run: bash ./.github/releasers/releaser_gui_macos.sh env: From beba37993feffb8191209abf333d8c54eb93623a Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 12:15:50 +0800 Subject: [PATCH 03/12] temp signing --- .github/workflows/test-macos-signing.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test-macos-signing.yml b/.github/workflows/test-macos-signing.yml index 72b0bce62..9ea079fb3 100644 --- a/.github/workflows/test-macos-signing.yml +++ b/.github/workflows/test-macos-signing.yml @@ -14,9 +14,9 @@ jobs: - name: macos-amd64 runner: macos-15-intel lib_home: /usr/local - - name: macos-arm64 - runner: macos-15 - lib_home: /opt/homebrew + # - name: macos-arm64 + # runner: macos-15 + # lib_home: /opt/homebrew env: LIB_HOME: ${{ matrix.lib_home }} @@ -32,7 +32,7 @@ jobs: - name: Install Go uses: actions/setup-go@v6 with: - go-version: "1.26.0" + go-version: "1.26.2" - name: Import macOS Certificates uses: apple-actions/import-codesign-certs@v6 From 1275e995d59f3b521fb5091076b75b0fcf767089 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 12:17:41 +0800 Subject: [PATCH 04/12] temp signing --- .github/workflows/test-macos-signing.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test-macos-signing.yml b/.github/workflows/test-macos-signing.yml index 9ea079fb3..c0b06bf4b 100644 --- a/.github/workflows/test-macos-signing.yml +++ b/.github/workflows/test-macos-signing.yml @@ -9,14 +9,12 @@ jobs: runs-on: ${{ matrix.runner }} strategy: matrix: - name: [macos-amd64, macos-arm64] + name: [macos-amd64] include: - name: macos-amd64 runner: macos-15-intel lib_home: /usr/local - # - name: macos-arm64 - # runner: macos-15 - # lib_home: /opt/homebrew + env: LIB_HOME: ${{ matrix.lib_home }} From 89b63866397157d5b5ff74c1d4308f6515ff2fd5 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 14:09:30 +0800 Subject: [PATCH 05/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 13 +++++-------- .github/workflows/releaser.yml | 3 +++ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index 708f6bd84..1df7f81e9 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -36,13 +36,6 @@ CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath -o ${BUILD_DIR}/pactus-wallet CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath -o ${BUILD_DIR}/pactus-shell ./cmd/shell CGO_ENABLED=1 go build -ldflags "-s -w -extldflags -headerpad_max_install_names" -trimpath -tags gtk -o ${BUILD_DIR}/pactus-gui ./cmd/gtk -if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "Signing binaries... ${MACOS_CERT_IDENTITY}" - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui -fi echo "Installing gtk-mac-bundler" git clone https://gitlab.gnome.org/GNOME/gtk-mac-bundler.git @@ -86,7 +79,11 @@ rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then echo "Signing app bundle..." - codesign --force --options runtime --timestamp --deep --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui + codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi echo "Creating dmg" diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml index 9b13ccaff..1d85ea6c2 100644 --- a/.github/workflows/releaser.yml +++ b/.github/workflows/releaser.yml @@ -127,6 +127,9 @@ jobs: p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }} p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }} + - name: List Identities + run: security find-identity -v -p codesigning + - name: Create release files run: bash ./.github/releasers/releaser_gui_macos.sh env: From 06771c41fe9ef9ca96eae8fee0b6b7cd54821994 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 14:25:46 +0800 Subject: [PATCH 06/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 4 +++- .github/workflows/test-macos-signing.yml | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index 1df7f81e9..a648ce3c4 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -78,11 +78,13 @@ ${BUNDLER} ${GUI_BUNDLE}/gui.bundle rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "Signing app bundle..." + echo "Signing artifacts..." codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui + + echo "Signing app bundle..." codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi diff --git a/.github/workflows/test-macos-signing.yml b/.github/workflows/test-macos-signing.yml index c0b06bf4b..6f6789c56 100644 --- a/.github/workflows/test-macos-signing.yml +++ b/.github/workflows/test-macos-signing.yml @@ -9,12 +9,14 @@ jobs: runs-on: ${{ matrix.runner }} strategy: matrix: - name: [macos-amd64] + name: [macos-amd64, macos-arm64] include: - name: macos-amd64 runner: macos-15-intel lib_home: /usr/local - + - name: macos-arm64 + runner: macos-15 + lib_home: /opt/homebrew env: LIB_HOME: ${{ matrix.lib_home }} From 0722a232b5a8065f80e06e1cc89595ae9e0c20a7 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 14:37:52 +0800 Subject: [PATCH 07/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index a648ce3c4..e2629125f 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -78,13 +78,13 @@ ${BUNDLER} ${GUI_BUNDLE}/gui.bundle rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "Signing artifacts..." + echo "=== Signing artifacts..." codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui - echo "Signing app bundle..." + echo "=== Signing app bundle..." codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi @@ -105,8 +105,8 @@ if [ ! -z "${APPLE_ID}" ]; then --wait echo "Stapling..." - xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" xcrun stapler staple "${FILE_NAME}.dmg" + xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" fi echo "Creating tar.gz archive" From cf9321adfd601bb7c1a2873e93ebf09045c1d616 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 14:43:34 +0800 Subject: [PATCH 08/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index e2629125f..f83ff21c4 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -97,16 +97,16 @@ create-dmg --skip-jenkins \ "${ROOT_DIR}/pactus-gui.app" if [ ! -z "${APPLE_ID}" ]; then - echo "Submitting for notarization..." + echo "=== Submitting for notarization..." xcrun notarytool submit "${FILE_NAME}.dmg" \ --apple-id "${APPLE_ID}" \ --password "${APPLE_PASSWORD}" \ --team-id "${APPLE_TEAM_ID}" \ --wait - echo "Stapling..." - xcrun stapler staple "${FILE_NAME}.dmg" + echo "=== Stapling..." xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" + xcrun stapler staple "${FILE_NAME}.dmg" fi echo "Creating tar.gz archive" From da02d7af07ef64ac5c810528d65fac49ed790d40 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 14:48:28 +0800 Subject: [PATCH 09/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 32 +++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index f83ff21c4..d5f9a5730 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -96,6 +96,31 @@ create-dmg --skip-jenkins \ "${FILE_NAME}.dmg" \ "${ROOT_DIR}/pactus-gui.app" + + # Capture submission ID and check final status + SUBMISSION_ID=$(xcrun notarytool submit "${FILE_NAME}.dmg" \ + --apple-id "${APPLE_ID}" \ + --password "${APPLE_PASSWORD}" \ + --team-id "${APPLE_TEAM_ID}" \ + --wait --output-format json | jq -r '.id') + + STATUS=$(xcrun notarytool info "$SUBMISSION_ID" \ + --apple-id "${APPLE_ID}" \ + --password "${APPLE_PASSWORD}" \ + --team-id "${APPLE_TEAM_ID}" \ + --output-format json | jq -r '.status') + + if [ "$STATUS" != "Accepted" ]; then + echo "Notarization failed with status: $STATUS" + xcrun notarytool log "$SUBMISSION_ID" \ + --apple-id "${APPLE_ID}" \ + --password "${APPLE_PASSWORD}" \ + --team-id "${APPLE_TEAM_ID}" \ + notarization.log + cat notarization.log + exit 1 + fi + if [ ! -z "${APPLE_ID}" ]; then echo "=== Submitting for notarization..." xcrun notarytool submit "${FILE_NAME}.dmg" \ @@ -104,9 +129,12 @@ if [ ! -z "${APPLE_ID}" ]; then --team-id "${APPLE_TEAM_ID}" \ --wait - echo "=== Stapling..." - xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" + echo "Stapling DMG only (the app inside gets the ticket automatically)..." + # ✅ FIX: Only staple the DMG – the .app was not notarized separately, so stapling it would cause error 65. xcrun stapler staple "${FILE_NAME}.dmg" + + # ❌ REMOVED: Stapling the standalone .app + # xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" fi echo "Creating tar.gz archive" From c20b8898438413f78dd5be3fea4923bca742c4fe Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 15:04:15 +0800 Subject: [PATCH 10/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 65 +++++++++++++++++-------- 1 file changed, 45 insertions(+), 20 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index d5f9a5730..e0ba8c58e 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -77,17 +77,38 @@ ${BUNDLER} ${GUI_BUNDLE}/gui.bundle # Removing Cellar as workaround rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar + +# After gtk-mac-bundler and your fix-install-names script... + if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "=== Signing artifacts..." - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui - - echo "=== Signing app bundle..." - codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + echo "=== Signing all Mach-O files inside the app bundle (dylibs, .so, executables)..." + find ${ROOT_DIR}/pactus-gui.app/Contents -type f -perm +111 -exec file {} \; | grep "Mach-O" | cut -d: -f1 | while read binary; do + echo "Signing: $binary" + codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" "$binary" + done + + # Also sign standalone binaries outside the bundle (if any) + for bin in pactus-daemon pactus-wallet pactus-shell pactus-gui; do + if [ -f "${BUILD_DIR}/${bin}" ]; then + codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" "${BUILD_DIR}/${bin}" + fi + done + + echo "=== Signing the whole app bundle..." + codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi +# if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then +# echo "=== Signing artifacts..." +# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon +# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet +# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell +# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui + +# echo "=== Signing app bundle..." +# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app +# fi + echo "Creating dmg" # https://github.com/create-dmg/create-dmg create-dmg --version @@ -97,6 +118,10 @@ create-dmg --skip-jenkins \ "${ROOT_DIR}/pactus-gui.app" + +if [ ! -z "${APPLE_ID}" ]; then + echo "=== Submitting for notarization..." + # Capture submission ID and check final status SUBMISSION_ID=$(xcrun notarytool submit "${FILE_NAME}.dmg" \ --apple-id "${APPLE_ID}" \ @@ -121,20 +146,20 @@ create-dmg --skip-jenkins \ exit 1 fi -if [ ! -z "${APPLE_ID}" ]; then - echo "=== Submitting for notarization..." - xcrun notarytool submit "${FILE_NAME}.dmg" \ - --apple-id "${APPLE_ID}" \ - --password "${APPLE_PASSWORD}" \ - --team-id "${APPLE_TEAM_ID}" \ - --wait - echo "Stapling DMG only (the app inside gets the ticket automatically)..." - # ✅ FIX: Only staple the DMG – the .app was not notarized separately, so stapling it would cause error 65. - xcrun stapler staple "${FILE_NAME}.dmg" - # ❌ REMOVED: Stapling the standalone .app - # xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" + # xcrun notarytool submit "${FILE_NAME}.dmg" \ + # --apple-id "${APPLE_ID}" \ + # --password "${APPLE_PASSWORD}" \ + # --team-id "${APPLE_TEAM_ID}" \ + # --wait + + # echo "Stapling DMG only (the app inside gets the ticket automatically)..." + # # ✅ FIX: Only staple the DMG – the .app was not notarized separately, so stapling it would cause error 65. + # xcrun stapler staple "${FILE_NAME}.dmg" + + # # ❌ REMOVED: Stapling the standalone .app + # # xcrun stapler staple "${ROOT_DIR}/pactus-gui.app" fi echo "Creating tar.gz archive" From 4fac89f592995213074ee577b4d4844be925d959 Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 15:17:57 +0800 Subject: [PATCH 11/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 28 ++++++++++++++++++------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index e0ba8c58e..16df657dd 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -81,21 +81,33 @@ rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar # After gtk-mac-bundler and your fix-install-names script... if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "=== Signing all Mach-O files inside the app bundle (dylibs, .so, executables)..." - find ${ROOT_DIR}/pactus-gui.app/Contents -type f -perm +111 -exec file {} \; | grep "Mach-O" | cut -d: -f1 | while read binary; do - echo "Signing: $binary" - codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" "$binary" + echo "=== Step 1: Signing all .so and .dylib files inside the app bundle..." + + # Use find to locate all .so and .dylib files, regardless of permissions. + find ${ROOT_DIR}/pactus-gui.app/Contents \( -name "*.dylib" -o -name "*.so" \) -print0 | while IFS= read -r -d '' binary; do + echo "Signing binary: $binary" + codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" + done + + echo "=== Step 2: Signing all executable binaries inside the app bundle..." + + # Use find to locate all regular files with executable bits, check for Mach-O, and sign them. + find ${ROOT_DIR}/pactus-gui.app/Contents -type f -perm +111 -print0 | while IFS= read -r -d '' binary; do + if file "$binary" | grep -q "Mach-O"; then + echo "Signing executable: $binary" + codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" + fi done - # Also sign standalone binaries outside the bundle (if any) + echo "=== Step 3: Signing standalone binaries in build directory..." for bin in pactus-daemon pactus-wallet pactus-shell pactus-gui; do if [ -f "${BUILD_DIR}/${bin}" ]; then - codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" "${BUILD_DIR}/${bin}" + codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "${BUILD_DIR}/${bin}" fi done - echo "=== Signing the whole app bundle..." - codesign --force --timestamp --options runtime --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + echo "=== Step 4: Finally, signing the whole .app bundle..." + codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app fi # if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then From 4d32aee1eb419fe3a0bc9142f1d3c436d912b41c Mon Sep 17 00:00:00 2001 From: Mostafa Date: Sat, 25 Apr 2026 15:31:45 +0800 Subject: [PATCH 12/12] temp signing --- .github/releasers/releaser_gui_macos.sh | 53 +++++++++++++++---------- 1 file changed, 31 insertions(+), 22 deletions(-) diff --git a/.github/releasers/releaser_gui_macos.sh b/.github/releasers/releaser_gui_macos.sh index 16df657dd..29dbe289b 100644 --- a/.github/releasers/releaser_gui_macos.sh +++ b/.github/releasers/releaser_gui_macos.sh @@ -81,44 +81,53 @@ rm -rf ${ROOT_DIR}/pactus-gui.app/Contents/Resources/Cellar # After gtk-mac-bundler and your fix-install-names script... if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then - echo "=== Step 1: Signing all .so and .dylib files inside the app bundle..." + echo "=== Signing all Mach-O files inside the app bundle (dylibs, .so, executables, etc.)..." - # Use find to locate all .so and .dylib files, regardless of permissions. - find ${ROOT_DIR}/pactus-gui.app/Contents \( -name "*.dylib" -o -name "*.so" \) -print0 | while IFS= read -r -d '' binary; do - echo "Signing binary: $binary" - codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" - done + # Create a temporary file to list all Mach-O binaries + find ${ROOT_DIR}/pactus-gui.app/Contents -type f -exec file {} \; | grep "Mach-O" | cut -d: -f1 > /tmp/macho_files.txt - echo "=== Step 2: Signing all executable binaries inside the app bundle..." + # First, sign only the .dylib and .so files (if any) + grep -E '\.(dylib|so)$' /tmp/macho_files.txt | while read binary; do + echo "Signing library: $binary" + codesign --force --timestamp --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" + if [ $? -ne 0 ]; then exit 1; fi + done - # Use find to locate all regular files with executable bits, check for Mach-O, and sign them. - find ${ROOT_DIR}/pactus-gui.app/Contents -type f -perm +111 -print0 | while IFS= read -r -d '' binary; do - if file "$binary" | grep -q "Mach-O"; then - echo "Signing executable: $binary" - codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" - fi + # Then sign all other Mach-O binaries (executables, helpers, etc.) + grep -v -E '\.(dylib|so)$' /tmp/macho_files.txt | while read binary; do + echo "Signing binary: $binary" + codesign --force --timestamp --verbose --sign "${MACOS_CERT_IDENTITY}" "$binary" + if [ $? -ne 0 ]; then exit 1; fi done - echo "=== Step 3: Signing standalone binaries in build directory..." + # Sign standalone binaries outside the app (if any) for bin in pactus-daemon pactus-wallet pactus-shell pactus-gui; do if [ -f "${BUILD_DIR}/${bin}" ]; then - codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" "${BUILD_DIR}/${bin}" + echo "Signing standalone binary: ${BUILD_DIR}/${bin}" + codesign --force --timestamp --verbose --sign "${MACOS_CERT_IDENTITY}" "${BUILD_DIR}/${bin}" fi done - echo "=== Step 4: Finally, signing the whole .app bundle..." - codesign --force --timestamp --options runtime --verbose --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + echo "=== Signing the whole app bundle (top-level)..." + codesign --force --timestamp --verbose --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app + + echo "=== Verification: checking the final app bundle..." + codesign --verify --verbose --deep --strict ${ROOT_DIR}/pactus-gui.app + if [ $? -ne 0 ]; then + echo "ERROR: App bundle verification failed!" + exit 1 + fi fi # if [ ! -z "${MACOS_CERT_IDENTITY}" ]; then # echo "=== Signing artifacts..." -# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon -# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet -# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell -# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui +# codesign --force --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-daemon +# codesign --force --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-wallet +# codesign --force --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-shell +# codesign --force --timestamp --sign "${MACOS_CERT_IDENTITY}" ${BUILD_DIR}/pactus-gui # echo "=== Signing app bundle..." -# codesign --force --options runtime --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app +# codesign --force --timestamp --sign "${MACOS_CERT_IDENTITY}" ${ROOT_DIR}/pactus-gui.app # fi echo "Creating dmg"