Skip to content

MacNativeBuilder: optional Developer ID signing + notarization#5243

Merged
shai-almog merged 1 commit into
masterfrom
feature/macnative-notarization
Jun 14, 2026
Merged

MacNativeBuilder: optional Developer ID signing + notarization#5243
shai-almog merged 1 commit into
masterfrom
feature/macnative-notarization

Conversation

@shai-almog

@shai-almog shai-almog commented Jun 14, 2026

Copy link
Copy Markdown
Collaborator

What

Adds opt-in Developer ID signing + notarization to MacNativeBuilder so a pre-compiled Mac-native app clears Gatekeeper when downloaded, rather than relying on the ad-hoc/linker signature that a quarantined download cannot use.

Gated on macNative.notarize=true (default off — existing builds are unchanged).

How

signAndNotarizeMacApp(request, appBundle, developerIdEntitlements):

  • Imports the supplied Developer ID cert into a throwaway keychain — the cert is provided the same way as the iOS build (request.getCertificate() / getCertificatePassword()), so the build host needs nothing pre-installed.
  • Codesigns inside-out (frameworks/dylibs first, then the bundle) with --options runtime + the *-DeveloperID.entitlements the builder already generates.
  • xcrun notarytool submit --wait, xcrun stapler staple, then verifies.

Notary credentials via macNative.notarize.keychainProfile or macNative.notarize.appleId / teamId / password.

Called by whatever produces the Mac .app (the release pipeline after xcodebuild).

🤖 Generated with Claude Code

@shai-almog @claude
MacNativeBuilder: optional Developer ID signing + notarization
8798e2e 
Adds opt-in (macNative.notarize=true) Developer ID signing with the hardened
runtime, notarization (notarytool --wait) and stapling, so a pre-compiled
Mac-native app clears Gatekeeper when downloaded instead of relying on the
ad-hoc/linker signature a quarantined download cannot use.

The Developer ID cert is supplied the same way as the iOS build (the request
certificate/.p12 + password), imported into a throwaway keychain so the build
host needs nothing pre-installed. Notary credentials via
macNative.notarize.keychainProfile or appleId/teamId/password. Default off, so
existing builds are unchanged; signs with the *-DeveloperID.entitlements the
builder already generates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@shai-almog

shai-almog commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 128 screenshots: 128 matched.

Native Android coverage

  • 📊 Line coverage: 14.21% (8642/60799 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
    • Other counters: instruction 11.51% (42589/370069), branch 5.05% (1759/34801), complexity 6.04% (2015/33356), method 10.47% (1633/15593), class 17.14% (377/2200)
    • Lowest covered classes
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysKt – 0.00% (0/6327 lines covered)
      • kotlin.collections.unsigned.kotlin.collections.unsigned.UArraysKt___UArraysKt – 0.00% (0/2384 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.ClassReader – 0.00% (0/1519 lines covered)
      • kotlin.collections.kotlin.collections.CollectionsKt___CollectionsKt – 0.00% (0/1148 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.MethodWriter – 0.00% (0/923 lines covered)
      • kotlin.sequences.kotlin.sequences.SequencesKt___SequencesKt – 0.00% (0/730 lines covered)
      • kotlin.text.kotlin.text.StringsKt___StringsKt – 0.00% (0/623 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.Frame – 0.00% (0/564 lines covered)
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysJvmKt – 0.00% (0/495 lines covered)
      • kotlinx.coroutines.kotlinx.coroutines.JobSupport – 0.00% (0/423 lines covered)

✅ Native Android screenshot tests passed.

Native Android coverage

  • 📊 Line coverage: 14.21% (8642/60799 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
    • Other counters: instruction 11.51% (42589/370069), branch 5.05% (1759/34801), complexity 6.04% (2015/33356), method 10.47% (1633/15593), class 17.14% (377/2200)
    • Lowest covered classes
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysKt – 0.00% (0/6327 lines covered)
      • kotlin.collections.unsigned.kotlin.collections.unsigned.UArraysKt___UArraysKt – 0.00% (0/2384 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.ClassReader – 0.00% (0/1519 lines covered)
      • kotlin.collections.kotlin.collections.CollectionsKt___CollectionsKt – 0.00% (0/1148 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.MethodWriter – 0.00% (0/923 lines covered)
      • kotlin.sequences.kotlin.sequences.SequencesKt___SequencesKt – 0.00% (0/730 lines covered)
      • kotlin.text.kotlin.text.StringsKt___StringsKt – 0.00% (0/623 lines covered)
      • org.jacoco.agent.rt.internal_b6258fc.asm.org.jacoco.agent.rt.internal_b6258fc.asm.Frame – 0.00% (0/564 lines covered)
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysJvmKt – 0.00% (0/495 lines covered)
      • kotlinx.coroutines.kotlinx.coroutines.JobSupport – 0.00% (0/423 lines covered)

Benchmark Results

Detailed Performance Metrics

Metric Duration
SIMD kernel backend scalar fallback (no native SIMD)
SIMD int-add (64K x300) java 141ms / native 247ms = 0.5x speedup
SIMD float-mul (64K x300) java 123ms / native 97ms = 1.2x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path gated to scalar (CPU autovectorizes scalar; explicit SIMD not beneficial here)
Base64 CN1 encode 248.000 ms
Base64 CN1 decode 364.000 ms
Base64 native encode 1358.000 ms
Base64 encode ratio (CN1/native) 0.183x (81.7% faster)
Base64 native decode 1209.000 ms
Base64 decode ratio (CN1/native) 0.301x (69.9% faster)
Image encode benchmark status skipped (SIMD unsupported)

@github-actions

github-actions Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

✅ Continuous Quality Report

Test & Coverage

Static Analysis

  • SpotBugs [Report archive]
    • ✅ ByteCodeTranslator: 0 findings (no issues)
    • ✅ android: 0 findings (no issues)
    • ✅ codenameone-maven-plugin: 0 findings (no issues)
    • ✅ core-unittests: 0 findings (no issues)
    • ✅ ios: 0 findings (no issues)
  • ✅ PMD: 0 findings (no issues) [Report archive]
  • ✅ Checkstyle: 0 findings (no issues) [Report archive]

Generated automatically by the PR CI workflow.

@shai-almog

shai-almog commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 128 screenshots: 128 matched.
✅ Native Mac screenshot tests passed.

Benchmark Results

  • VM Translation Time: 0 seconds
  • Compilation Time: 168 seconds

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 53ms / native 3ms = 17.6x speedup
SIMD float-mul (64K x300) java 58ms / native 3ms = 19.3x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path active (NEON-accelerated)
Base64 CN1 encode 298.000 ms
Base64 CN1 decode 235.000 ms
Base64 native encode 734.000 ms
Base64 encode ratio (CN1/native) 0.406x (59.4% faster)
Base64 native decode 390.000 ms
Base64 decode ratio (CN1/native) 0.603x (39.7% faster)
Base64 SIMD encode 63.000 ms
Base64 encode ratio (SIMD/CN1) 0.211x (78.9% faster)
Base64 SIMD decode 59.000 ms
Base64 decode ratio (SIMD/CN1) 0.251x (74.9% faster)
Base64 encode ratio (SIMD/native) 0.086x (91.4% faster)
Base64 decode ratio (SIMD/native) 0.151x (84.9% faster)
Image encode benchmark iterations 100
Image createMask (SIMD off) 17.000 ms
Image createMask (SIMD on) 2.000 ms
Image createMask ratio (SIMD on/off) 0.118x (88.2% faster)
Image applyMask (SIMD off) 75.000 ms
Image applyMask (SIMD on) 80.000 ms
Image applyMask ratio (SIMD on/off) 1.067x (6.7% slower)
Image modifyAlpha (SIMD off) 84.000 ms
Image modifyAlpha (SIMD on) 69.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.821x (17.9% faster)
Image modifyAlpha removeColor (SIMD off) 100.000 ms
Image modifyAlpha removeColor (SIMD on) 96.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 0.960x (4.0% faster)

@shai-almog

shai-almog commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 121 screenshots: 121 matched.
✅ JavaScript-port screenshot tests passed.

@shai-almog

shai-almog commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 124 screenshots: 124 matched.
✅ Native iOS screenshot tests passed.

Benchmark Results

  • VM Translation Time: 0 seconds
  • Compilation Time: 421 seconds

Build and Run Timing

Metric Duration
Simulator Boot 99000 ms
Simulator Boot (Run) 1000 ms
App Install 21000 ms
App Launch 8000 ms
Test Execution 365000 ms

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 265ms / native 3ms = 88.3x speedup
SIMD float-mul (64K x300) java 114ms / native 13ms = 8.7x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path active (NEON-accelerated)
Base64 CN1 encode 414.000 ms
Base64 CN1 decode 246.000 ms
Base64 native encode 959.000 ms
Base64 encode ratio (CN1/native) 0.432x (56.8% faster)
Base64 native decode 342.000 ms
Base64 decode ratio (CN1/native) 0.719x (28.1% faster)
Base64 SIMD encode 61.000 ms
Base64 encode ratio (SIMD/CN1) 0.147x (85.3% faster)
Base64 SIMD decode 55.000 ms
Base64 decode ratio (SIMD/CN1) 0.224x (77.6% faster)
Base64 encode ratio (SIMD/native) 0.064x (93.6% faster)
Base64 decode ratio (SIMD/native) 0.161x (83.9% faster)
Image encode benchmark iterations 100
Image createMask (SIMD off) 24.000 ms
Image createMask (SIMD on) 4.000 ms
Image createMask ratio (SIMD on/off) 0.167x (83.3% faster)
Image applyMask (SIMD off) 162.000 ms
Image applyMask (SIMD on) 68.000 ms
Image applyMask ratio (SIMD on/off) 0.420x (58.0% faster)
Image modifyAlpha (SIMD off) 144.000 ms
Image modifyAlpha (SIMD on) 279.000 ms
Image modifyAlpha ratio (SIMD on/off) 1.938x (93.8% slower)
Image modifyAlpha removeColor (SIMD off) 81.000 ms
Image modifyAlpha removeColor (SIMD on) 192.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 2.370x (137.0% slower)

@shai-almog

shai-almog commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 128 screenshots: 128 matched.
✅ Native iOS Metal screenshot tests passed.

Benchmark Results

  • VM Translation Time: 0 seconds
  • Compilation Time: 470 seconds

Build and Run Timing

Metric Duration
Simulator Boot 95000 ms
Simulator Boot (Run) 1000 ms
App Install 15000 ms
App Launch 14000 ms
Test Execution 309000 ms

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 94ms / native 3ms = 31.3x speedup
SIMD float-mul (64K x300) java 95ms / native 15ms = 6.3x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path active (NEON-accelerated)
Base64 CN1 encode 428.000 ms
Base64 CN1 decode 350.000 ms
Base64 native encode 992.000 ms
Base64 encode ratio (CN1/native) 0.431x (56.9% faster)
Base64 native decode 402.000 ms
Base64 decode ratio (CN1/native) 0.871x (12.9% faster)
Base64 SIMD encode 77.000 ms
Base64 encode ratio (SIMD/CN1) 0.180x (82.0% faster)
Base64 SIMD decode 85.000 ms
Base64 decode ratio (SIMD/CN1) 0.243x (75.7% faster)
Base64 encode ratio (SIMD/native) 0.078x (92.2% faster)
Base64 decode ratio (SIMD/native) 0.211x (78.9% faster)
Image encode benchmark iterations 100
Image createMask (SIMD off) 23.000 ms
Image createMask (SIMD on) 2.000 ms
Image createMask ratio (SIMD on/off) 0.087x (91.3% faster)
Image applyMask (SIMD off) 73.000 ms
Image applyMask (SIMD on) 50.000 ms
Image applyMask ratio (SIMD on/off) 0.685x (31.5% faster)
Image modifyAlpha (SIMD off) 74.000 ms
Image modifyAlpha (SIMD on) 55.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.743x (25.7% faster)
Image modifyAlpha removeColor (SIMD off) 80.000 ms
Image modifyAlpha removeColor (SIMD on) 82.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 1.025x (2.5% slower)

@shai-almog shai-almog merged commit 5e18e8d into master Jun 14, 2026
27 checks passed
@shai-almog shai-almog deleted the feature/macnative-notarization branch June 14, 2026 17:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shai-almog