[build] add macOS signing and notarization to GitHub Actions

apps/desktop/scripts/macos/sign_app.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 <app-bundle>" >&2
+    echo "Set CROSSDESK_MACOS_SIGN_IDENTITY to a full Developer ID Application name." >&2
+    echo "Without an identity, the bundle receives an ad-hoc signature for local use." >&2
+    exit 2
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+APP_BUNDLE="$1"
+SIGN_IDENTITY="${CROSSDESK_MACOS_SIGN_IDENTITY:--}"
+SIGN_ARGS=(--force --sign "$SIGN_IDENTITY")
+APP_ARGS=()
+
+case "$SIGN_IDENTITY" in
+    -) ;;
+    "Developer ID Application: "*)
+        SIGN_ARGS+=(--options runtime --timestamp)
+        APP_ARGS+=(--entitlements "$SCRIPT_DIR/entitlements.plist")
+        ;;
+    *)
+        echo "CROSSDESK_MACOS_SIGN_IDENTITY must be a full Developer ID Application name or '-'." >&2
+        exit 1
+        ;;
+esac
+
+if [[ -n "${CROSSDESK_MACOS_KEYCHAIN:-}" ]]; then
+    SIGN_ARGS+=(--keychain "$CROSSDESK_MACOS_KEYCHAIN")
+fi
+
+for executable in CrossDesk crossdesk_updater; do
+    if [[ ! -x "$APP_BUNDLE/Contents/MacOS/$executable" ]]; then
+        echo "Missing app executable: $APP_BUNDLE/Contents/MacOS/$executable" >&2
+        exit 1
+    fi
+done
+
+if [[ ! -d "$APP_BUNDLE/Contents/Frameworks" ]]; then
+    echo "Missing bundled frameworks: $APP_BUNDLE/Contents/Frameworks" >&2
+    exit 1
+fi
+
+# Sign nested code explicitly, from the inside out. The updater also runs
+# outside the bundle, and must retain its own valid Developer ID signature.
+while IFS= read -r -d '' library; do
+    codesign "${SIGN_ARGS[@]}" "$library"
+done < <(find "$APP_BUNDLE/Contents/Frameworks" -type f -name '*.dylib' -print0)
+codesign "${SIGN_ARGS[@]}" "$APP_BUNDLE/Contents/MacOS/crossdesk_updater"
+codesign "${SIGN_ARGS[@]}" ${APP_ARGS[@]+"${APP_ARGS[@]}"} "$APP_BUNDLE"
+codesign --verify --deep --strict --verbose=2 "$APP_BUNDLE"
+
+echo "App signed with: $SIGN_IDENTITY"