feat: implement macOS code signing and notarization pipeline with entitlements

Author: Soddentrough

.github/workflows/macos.yml

@@ -26,7 +26,26 @@ jobs:
           CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
           CARGO_PROFILE_RELEASE_STRIP: "true"
         run: cargo build --release
-        
+
+      - name: Import Apple Certificate
+        if: ${{ secrets.MACOS_CERTIFICATE != '' }}
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
+          P12_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
+        run: |
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 12)
+
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security default-keychain -s $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          security import $CERTIFICATE_PATH -k $KEYCHAIN_PATH -P "$P12_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
       - name: Package Application
         run: |
           VERSION=$(grep -m1 '^version =' Cargo.toml | cut -d '"' -f2)
@@ -87,8 +106,16 @@ jobs:
           cp assets/soundfont.sf2 RustTracker.app/Contents/Resources/
           dylibbundler -od -b -x RustTracker.app/Contents/MacOS/rusttracker -d RustTracker.app/Contents/Frameworks/ -p @executable_path/../Frameworks/
           
-          # Ad-hoc codesign the entire bundle recursively to satisfy security requirements (especially Apple Silicon)
-          codesign --force --deep --sign - RustTracker.app
+          # Codesign the application
+          if [ -n "${{ secrets.MACOS_CERTIFICATE }}" ]; then
+            echo "Signing with Developer ID Certificate..."
+            find RustTracker.app/Contents/Frameworks -type f \( -name "*.dylib" -or -name "*.so" \) -exec codesign --force --options runtime --sign "Developer ID Application" {} \;
+            codesign --force --options runtime --entitlements entitlements.plist --sign "Developer ID Application" RustTracker.app/Contents/MacOS/rusttracker
+            codesign --force --options runtime --entitlements entitlements.plist --sign "Developer ID Application" RustTracker.app
+          else
+            echo "No Developer ID Certificate found. Performing ad-hoc signing..."
+            codesign --force --deep --sign - RustTracker.app
+          fi
           
       - name: Create DMG
         run: |
@@ -101,6 +128,31 @@ jobs:
             --app-drop-link 400 190 \
             "RustTracker-MacOS-Installer.dmg" \
             "RustTracker.app"
+
+      - name: Notarize DMG
+        if: ${{ secrets.APPLE_ID != '' }}
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          echo "Submitting DMG for notarization..."
+          xcrun notarytool submit RustTracker-MacOS-Installer.dmg \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_ID_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" \
+            --wait
+            
+          echo "Stapling notarization ticket to DMG..."
+          xcrun stapler staple RustTracker-MacOS-Installer.dmg
+            
+      - name: Clean up Keychain
+        if: always() && secrets.MACOS_CERTIFICATE != ''
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          if [ -f "$KEYCHAIN_PATH" ]; then
+            security delete-keychain $KEYCHAIN_PATH
+          fi
             
       - name: Upload Artifact
         uses: actions/upload-artifact@v5

entitlements.plist

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Essential for audio-reactive features (microphone input) -->
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+    
+    <!-- Needed for GPU-accelerated rendering and dynamic memory mapping -->
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    
+    <!-- Necessary because we bundle dynamic libraries (FFmpeg, libopenmpt) via dylibbundler -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>