Add cross-platform macOS code signing with rcodesign fallback#446
Merged
Add cross-platform macOS code signing with rcodesign fallback#446
Conversation
When not running on macOS, the Mac bundler now falls back to rcodesign for code signing and notarization if the tool is installed and credentials are configured via environment variables: - JDEPLOY_RCODESIGN_P12_FILE: path to PKCS#12 certificate file - JDEPLOY_RCODESIGN_P12_PASSWORD: password for the P12 file - JDEPLOY_RCODESIGN_API_KEY_PATH: App Store Connect API key JSON file - JDEPLOY_RCODESIGN_API_ISSUER + JDEPLOY_RCODESIGN_API_KEY: inline API credentials https://claude.ai/code/session_01TV1XGgx68MVH2Z9KboWurV
- MacOSFileHandler: remove macOS-only restriction, use `cp -a` and `unzip` as fallbacks for `ditto` on non-Mac platforms - MacBundler: move JRE bundling and JCEF framework copying out of the isMac() gate so they run on all platforms; xattr removal remains macOS-only - copyJcefFrameworks: use `cp -a` instead of `ditto` on non-Mac https://claude.ai/code/session_01TV1XGgx68MVH2Z9KboWurV
Adds a skill that tests both the native codesign path (macOS) and the rcodesign fallback path (cross-platform) using self-signed certificates. Supports local testing and CI via GitHub Actions. https://claude.ai/code/session_01TV1XGgx68MVH2Z9KboWurV
The loadAppInfo() method was missing the code signing settings transfer from package.json to AppInfo, causing bundles built via github-prepare-release to skip code signing even when codesign: true was set. This aligns with PackageService which already handles these settings.
Adds a new environment variable JDEPLOY_FORCE_RCODESIGN that when set to "true" forces the use of rcodesign for code signing even on macOS. This makes it easier to test the rcodesign code path without needing Linux. Also fixes rcodesign signing to only sign the .app bundle, not individual non-Mach-O files like app.xml (which rcodesign doesn't support).
Black-box reference covering both native codesign and rcodesign paths, credential configuration, entitlements, notarization flow, CI examples, and the decision logic for backend selection. https://claude.ai/code/session_01TV1XGgx68MVH2Z9KboWurV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for cross-platform macOS code signing using
rcodesignas a fallback to Apple's nativecodesigntool. This enables code signing on non-macOS platforms (Linux, Windows) and provides a testing mechanism for the macOS signing workflow.Key Changes
Core Implementation
xcrun notarytoolMacBundler Updates
MacBundler.javato support dual signing paths:codesignon macOS (preferred when available)rcodesignfallback on non-macOS platforms or when forced viaJDEPLOY_FORCE_RCODESIGNFile Handling
MacOSFileHandler.copyOrExtract()to work on all platforms (not just macOS), enabling JRE and framework bundling on Linux/Windows for macOS app creationTesting & Documentation
test-mac-codesigning/skill.md- Dedicated macOS code signing tests with self-signed certificatestest-full-publishing/skill.md- Full publishing workflow combining Windows Authenticode and macOS signingRcodesignConfigTest.javafor environment variable validationEnvironment Variables
New environment variables for rcodesign configuration:
JDEPLOY_RCODESIGN_P12_FILE- Path to PKCS#12 certificateJDEPLOY_RCODESIGN_P12_PASSWORD- P12 passwordJDEPLOY_RCODESIGN_API_KEY_PATH- App Store Connect API key JSONJDEPLOY_RCODESIGN_API_ISSUER/JDEPLOY_RCODESIGN_API_KEY- API credentialsJDEPLOY_FORCE_RCODESIGN- Force rcodesign even on macOS (for testing)Implementation Details
cp -a/unzipon non-macOS instead ofdittohttps://claude.ai/code/session_01TV1XGgx68MVH2Z9KboWurV