docs: macOS signing + notarization checklist + entitlements - #30
Merged
Conversation
Add electron/SIGNING.md — the step-by-step to flip SpyDE's macOS build from unsigned to signed + notarized once an Apple Developer account is in hand: create the Developer ID cert, export the .p12, make an App Store Connect API key, set the GitHub secrets, the exact electron-builder.yml + release.yml diffs (matrix-gated to the mac leg), and how to verify (spctl / codesign / stapler). Ship the entitlements file it needs now: electron/build/entitlements.mac.plist (hardened-runtime keys). The disable-library-validation key is load-bearing for SpyDE specifically — the app spawns a uv-managed Python subprocess whose native wheels (torch/numba/rosettasciio) are signed by other teams, and the hardened runtime would otherwise refuse to load them. Un-ignore electron/build/ in .gitignore (the broad Python `build/` rule was hiding electron-builder's buildResources dir, which holds TRACKED source). Link the guide from PACKAGING.md. No behavior change — signing stays off (identity: null) until the secrets + config flip land.
Answer "which intermediate?": Developer ID Certification Authority (G2) — not the retired non-G2 one, not Developer ID Installer. Normally auto-installed by Xcode / double-clicking the cert; only matters on a CI runner missing it. Document exporting the full chain into the .p12 (Cmd-click cert + G2 intermediate) and add a fetch-the-intermediate fallback to the CI keychain step so codesign can always build the chain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ready-to-follow guide for signing + notarizing SpyDE on macOS once an Apple Developer account is available — no more Gatekeeper "unidentified developer" wall, and the auto-update
.zipbecomes trusted too.Adds:
electron/SIGNING.md— the full checklist: Developer ID cert →.p12export → App Store Connect API key → GitHub secrets → exactelectron-builder.yml+release.ymldiffs (matrix-gated to the mac leg) → verify with spctl/codesign/stapler. Plus SpyDE-specific gotchas (the Python-sidecar / native-wheel entitlement, notarizing the zip, notarytool debugging).electron/build/entitlements.mac.plist— the hardened-runtime entitlements.disable-library-validationis load-bearing: SpyDE spawns a uv-managed Python subprocess whose native wheels (torch/numba/rosettasciio) are signed by other teams, which the hardened runtime would otherwise refuse to load..gitignoreun-ignoreselectron/build/(the broad Pythonbuild/rule was hiding electron-builder's buildResources dir).PACKAGING.md.No behavior change — signing stays off (
mac.identity: null) until the secrets + config flip land per the guide. The entitlements plist is validated (well-formed, 4 expected keys).