Repository navigation
CI: sign and notarize the macOS desktop app when secrets are set - #195
Open
kevinelliott wants to merge 1 commit into
Open
kevinelliott wants to merge 1 commit into
kevinelliott wants to merge 1 commit into
Conversation
With the APPLE_* repository secrets present, master pushes, releases and manual runs sign XNG with the Developer ID certificate and notarize it. Pull requests, and repositories without the secrets, keep the ad-hoc signature, so nothing changes until the secrets are added. The app now carries a disable-library-validation entitlement: under the hardened runtime that signing turns on, it could otherwise not load Homebrew's SoapySDR and Airspy libraries. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PS44Q9VjeCGLV3nuhpoua1
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 13 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Kevin · project thread
Wires Developer ID signing and notarization into the Desktop workflow. Nothing changes until the secrets are added: without them the app keeps its ad-hoc signature, exactly as today.
How it works
A new "Set up macOS signing" step passes the secrets to Tauri only when they exist, and only on master pushes, releases and manual runs. Pull requests never see them.
APPLE_CERTIFICATE.p12APPLE_CERTIFICATE_PASSWORDAPPLE_SIGNING_IDENTITYDeveloper ID Application: Name (TEAMID)APPLE_ID,APPLE_PASSWORD,APPLE_TEAM_ID.dmgare signed.Also in this PR:
workflow_dispatchon the Desktop workflow, so a signed build can be run by hand to check the setup.release.ymlpasses secrets through to the Desktop workflow (secrets: inherit).entitlements.plistwithdisable-library-validation. Signing turns on the hardened runtime, which would otherwise refuse to load Homebrew's SoapySDR, its driver modules and the Airspy libraries, and no radio would be found.codesignandspctlresults for the built app.Testing
accepted, source=Notarized Developer ID.spctlwill reject it, which that step makes visible.Generated by Claude Code
Note
Medium Risk
Touches release packaging and adds a security-sensitive entitlement (
disable-library-validation); behavior is gated on secrets and PRs stay unsigned, but misconfigured signing or overly broad entitlements could affect macOS trust and SDR loading.Overview
Adds optional Developer ID signing and notarization for macOS desktop builds in CI when
APPLE_*repository secrets are present.The Desktop workflow gains a Set up macOS signing step (skipped on pull requests) that exports certificate, identity, and optional notarization credentials into
GITHUB_ENVfor Tauri only when secrets exist; otherwise builds stay ad-hoc. Manual runs are enabled viaworkflow_dispatch, and a post-build Show macOS signature step logscodesign/spctloutput. Release now calls the Desktop workflow withsecrets: inheritso tagged releases can sign the same way.Supporting app packaging changes: new
entitlements.plistwithcom.apple.security.cs.disable-library-validation(wired intauri.conf.json) so hardened-runtime signed builds can load Homebrew SoapySDR/Airspy libraries. README and release notes text are updated to describe signed vs unsigned behavior; Windows remains unsigned.Reviewed by Cursor Bugbot for commit ad17252. Bugbot is set up for automated code reviews on this repo. Configure here.