Redesign and enable macOS signing (#4883)

# Description of Changes
Re-enable macOS signing and tweak so it runs successfully through CI.
Also changes the runner to use macOS 15 instead of 13, which was
throwing a deprecation warning in GitHub. Note that the runner doesn't
affect the minimum target, which I've still got set to 10.15 (no idea if
it actually works on 10.15 but let's assume that if it builds it works
until someone can test it)

.github/workflows/tauri-build.yml

@@ -47,21 +47,19 @@ jobs:
               "windows")
                 echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
-              # "macos")
-              #   echo 'matrix={"include":[{"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-              #   ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
               "linux")
                 echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                # Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-            # Disabled Mac builds: {"platform":"macos-latest","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-13","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
           fi
 
   build:
@@ -96,7 +94,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-latest' || matrix.platform == 'macos-13') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
 
 
@@ -183,80 +181,96 @@ jobs:
         working-directory: ./frontend
         run: npm install
 
-      # Disabled Mac builds - Import Apple Developer Certificate
-      # - name: Import Apple Developer Certificate
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   env:
-      #     APPLE_ID: ${{ secrets.APPLE_ID }}
-      #     APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-      #     APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-      #     APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-      #     KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-      #   run: |
-      #     echo "Importing Apple Developer Certificate..."
-      #     echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-      #     security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
-      #     security default-keychain -s build.keychain
-      #     security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
-      #     security set-keychain-settings -t 3600 -u build.keychain
-      #     security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
-      #     security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
-      #     security find-identity -v -p codesigning build.keychain
-      # - name: Verify Certificate
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   run: |
-      #     echo "Verifying Apple Developer Certificate..."
-      #     CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
-      #     echo "Certificate Info: $CERT_INFO"
-      #     CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-      #     echo "Certificate ID: $CERT_ID"
-      #     echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
-      #     echo "Certificate imported."
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
 
-      # - name: Check DMG creation dependencies (macOS only)
-      #   if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-13'
-      #   run: |
-      #     echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
-      #     echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
-      #     echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
-      #     echo "Available disk space: $(df -h /tmp | tail -1)"
-      #     echo "macOS version: $(sw_vers -productVersion)"
-      #     echo "Available tools:"
-      #     ls -la /usr/bin/hd* || echo "No hd* tools found"
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
 
-      - name: Build Tauri app 
+      - name: Check DMG creation dependencies (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
+          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
+          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
+          echo "Available disk space: $(df -h /tmp | tail -1)"
+          echo "macOS version: $(sw_vers -productVersion)"
+          echo "Available tools:"
+          ls -la /usr/bin/hd* || echo "No hd* tools found"
+
+      - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           SIGN: 1
-          CI: true 
+          CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
-          
+
+      - name: Verify notarization (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Verifying notarization status..."
+          cd ./frontend/src-tauri/target
+          DMG_FILE=$(find . -name "*.dmg" | head -1)
+          if [ -n "$DMG_FILE" ]; then
+            echo "Found DMG: $DMG_FILE"
+            echo "Checking notarization ticket..."
+            spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
+            stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
+          else
+            echo "⚠️ No DMG file found to verify"
+          fi
+
       - name: Rename artifacts
         shell: bash
         run: |
           mkdir -p ./dist
           cd ./frontend/src-tauri/target
-          
+
           # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          # Disabled Mac builds
-          # elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then
-          #   find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-          #   find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
           else
             find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
@@ -273,7 +287,7 @@ jobs:
         shell: bash
         run: |
           cd ./frontend/src-tauri/target
-          
+
           # Check for expected artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             echo "Checking for Windows artifacts..."
@@ -282,14 +296,13 @@ jobs:
               echo "❌ No Windows executable found"
               exit 1
             fi
-          # Disabled Mac builds
-          # elif [ "${{ matrix.platform }}" = "macos-latest" ] || [ "${{ matrix.platform }}" = "macos-13" ]; then
-          #   echo "Checking for macOS artifacts..."
-          #   find . -name "*.dmg" -o -name "*.app" | head -5
-          #   if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
-          #     echo "❌ No macOS artifacts found"
-          #     exit 1
-          #   fi
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            echo "Checking for macOS artifacts..."
+            find . -name "*.dmg" -o -name "*.app" | head -5
+            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
+              echo "❌ No macOS artifacts found"
+              exit 1
+            fi
           else
             echo "Checking for Linux artifacts..."
             find . -name "*.deb" -o -name "*.AppImage" | head -5
@@ -298,7 +311,7 @@ jobs:
               exit 1
             fi
           fi
-          
+
           echo "✅ Build artifacts found for ${{ matrix.name }}"
 
       - name: Test artifact sizes

frontend/src-tauri/tauri.conf.json

@@ -50,6 +50,12 @@
       "deb": {
         "desktopTemplate": "stirling-pdf.desktop"
       }
+    },
+    "macOS": {
+      "minimumSystemVersion": "10.15",
+      "signingIdentity": null,
+      "entitlements": null,
+      "providerShortName": null
     }
   },
   "plugins": {