add macOS and windows installer (#1352)

.github/workflows/build.yml

@@ -15,7 +15,7 @@ jobs:
           submodules: recursive
       - uses: actions/setup-python@v2
         with:
-          python-version: '3.9.x'
+          python-version: '3.8.5'
       - uses: actions/setup-node@v1
         with:
           node-version: '16.x'
@@ -114,6 +114,20 @@ jobs:
           make dist
         env:
           BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'dist'
+          recursive: true
+      - shell: bash
+        run: |
+          bash bin/build-windows-installer
+        env:
+          BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'artifacts'
       - uses: actions/upload-artifact@v2
         with:
           name: inkstitch-windows
@@ -150,9 +164,11 @@ jobs:
           pip install wheel
           pip install PyGObject
           pip install git+https://github.com/gtaylor/python-colormath
-
           pip install -r requirements.txt
-          pip install pyinstaller==4.3
+          # with --no-binary argument may fix notary issues as well shapely speedups error issue
+          pip install -U lxml --no-binary lxml
+          pip install -U Shapely==1.7.1 --no-binary Shapely
+          pip install pyinstaller
 
           echo "${{ env.pythonLocation }}/bin" >> $GITHUB_PATH
       - shell: bash
@@ -160,6 +176,15 @@ jobs:
           make dist
         env:
           BUILD: osx
+          MACOS_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PWD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          INSTALLER_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE }}
+          INSTALLER_PWD: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
+          NOTARY_ACCOUNT: ${{ secrets.INKSTITCH_NOTARIZE_AC }}
+          NOTARY_PASSWORD: ${{ secrets.INKSTITCH_NOTARIZE_PASS }}
+
+
       - uses: actions/upload-artifact@v2
         with:
           name: inkstitch-mac
@@ -212,3 +237,5 @@ jobs:
           title: "${{env.title}}"
           files: |
             artifacts/*.zip
+            artifacts/*.exe
+            artifacts/*.pkg

.gitignore

@@ -17,4 +17,4 @@ locales/
 /.idea
 /VERSION
 /src/
-.DS_Store
+.DS_STORE

Makefile

@@ -1,11 +1,10 @@
-
 dist: version locales inx
 	bash bin/build-python
 	bash bin/build-electron
 	bash bin/build-distribution-archives
 
 distclean:
-	rm -rf build dist inx locales *.spec *.tar.gz *.zip electron/node_modules electron/dist
+	rm -rf build dist inx locales artifacts win mac *.spec *.tar.gz *.zip electron/node_modules electron/dist
 
 .PHONY: inx
 inx: version locales

bin/build-distribution-archives

@@ -1,27 +1,90 @@
-#!/bin/bash
-
 VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
 OS="${BUILD:-$(uname)}"
-ARCH="$(uname -m)"
+mkdir artifacts
-
 if [ "$BUILD" = "osx" ]; then
-    cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch.app/Contents
+    cp -a icons locales print LICENSE VERSION images/examples palettes symbols fonts inx dist/inkstitch.app/Contents/Resources
-    cp -a icons locales print dist/inkstitch.app/Contents/MacOS
-    cp -a electron/build/mac dist/inkstitch.app/Contents/electron
     rm -rf dist/inkstitch/
+    temp_path="/tmp/inkstitch/"
+    # inside the scripts folder are:
+    # - preinstaller (checks for previously installed inkstitch and deletes it) and
+    # - postinstaller (moves inkstitch folder from /tmp to user Inkscape extensions folder in $HOME)
+    # The postinstaller is a workaround for a proper way to install in user $HOME space
+
+    # Build on GitHub will be handled differently from local builds.
+    # Local builds will not be signed nor notarized. They are run to produce releases for legacy versions of macOS.
+    # Notarization for development branches can be forced with this variable set to true
+    NOTARIZE_DEVELOPMENT_BUILDS=false
+
+    if [[ ! -z "${GITHUB_REF}" ]]; then
+        # This code signs and notarize the inkstitch.app
+        DEV_IDENT="Developer ID Application: Lex Neva (929A568N58)"
+        echo "Signing of inkstitch.app"
+        # Coyping inkstitch-gui.app into inkstitch
+        ditto electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        # signing the binary may fix notary issue
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app/Contents/MacOS/inkstitch -v
+        # last signing before packaging
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app -v
+        echo "Running pkgbuild"
+        INSTALLER_IDENT="Developer ID Installer: Lex Neva (929A568N58)"
+        /usr/bin/pkgbuild --root dist/inkstitch.app \
+                        -s "${INSTALLER_IDENT}" \
+                        --component-plist installer_scripts/inkstitch.plist \
+                        --ownership recommended \
+                        --identifier org.inkstitch.installer \
+                        --version ${VERSION} \
+                        --scripts installer_scripts/scripts \
+                        --install-location ${temp_path}inkstitch.app \
+                        artifacts/inkstitch-${VERSION}-${OS}.pkg
+        if [[ "${GITHUB_REF}" =~ ^refs/tags/v[0-9.]+$ || $NOTARIZE_DEVELOPMENT_BUILDS == true ]]; then
+            echo "Notary starting"
+            bash bin/notarize-app "929A568N58" \
+                                "${NOTARY_ACCOUNT}" \
+                                "${NOTARY_PASSWORD}" \
+                                "org.inkstitch.app" \
+                                artifacts/inkstitch-${VERSION}-${OS}.pkg
+        fi
+    else
+        # local builds will not be signed or notarized
+        cp -a electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        pkgbuild --root dist/inkstitch.app \
+                --component-plist installer_scripts/inkstitch.plist \
+                --ownership recommended \
+                --identifier org.inkstitch.installer \
+                --version ${VERSION} \
+                --scripts installer_scripts/scripts \
+                --install-location ${temp_path}inkstitch.app \
+                artifacts/inkstitch-${VERSION}-${OS}.pkg
+    fi
 else
     cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch
     cp -a icons locales print dist/inkstitch/bin
     cp -a electron/build/*-unpacked dist/inkstitch/electron
+
 fi
 
-mkdir artifacts
+if [ "$BUILD" = "windows" ]; then
+    # build the installer locally
+    # remotely it will be called through build.yml after signing
+    if [[ -z "${GITHUB_REF}" ]]; then
+        bash bin/build-windows-installer
+    fi
+fi
+
+if [ "$BUILD" = "linux" ]; then
     cd dist
-
-if [ "$$BUILD" = "windows" ]; then
-    # The python zipfile command line utility can't handle directories
-    # containing files with UTF-8 names on Windows, so we use 7-zip instead.
-    7z a ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
-else
     python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+    cd ..
 fi

bin/build-electron

@@ -8,6 +8,7 @@ if [ "$BUILD" = "windows" ]; then
 elif [ "$BUILD" = "linux" ]; then
   args="-l --x64"
 elif [ "$BUILD" = "osx" ]; then
+  cp installer_scripts/electron-entitlements.plist electron/build/
   args="-m"
 fi
 

bin/build-python

@@ -36,6 +36,16 @@ pyinstaller_args+="-p inkscape/share/extensions "
 # output useful debugging info that helps us trace library dependency issues
 pyinstaller_args+="--log-level DEBUG "
 
+# This adds bundle identifier in reverse DSN format for macos
+if [ "$BUILD" = "osx" ]; then
+    pyinstaller_args+="--osx-bundle-identifier org.inkstitch.app "
+    if [[ -z ${GITHUB_REF} ]]; then
+        :
+    else
+        bash bin/import-macos-keys
+    fi
+fi
+
 if [ "$BUILD" = "windows" ]; then
     python -m PyInstaller $pyinstaller_args inkstitch.py
 else

bin/build-windows-installer

@@ -0,0 +1,15 @@
+#!/bin/bash
+VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
+OS="${BUILD:-$(uname)}"
+# Create windows installer
+mkdir win
+cp installer_scripts/template.iss win/win_build.iss
+# adds the year and version to the inno installer
+info_year=$( date "+%Y" )
+copyright_year="#define COPYRIGHT \""${info_year}"\" + URL"
+version_block="#define VERSION \""${VERSION}"\""
+sed -i'' -e '/;inkstitch-year/ a\'$'\n'"${copyright_year}"'' win/win_build.iss
+sed -i'' -e '/;inkstitch-version/ a\'$'\n'"${version_block}"'' win/win_build.iss
+
+iscc win/win_build.iss
+mv  win/inkstitch.exe artifacts/inkstitch-${VERSION}-${OS}.exe

bin/import-macos-keys

@@ -0,0 +1,12 @@
+#!/bin/bash
+# first part of codesiging which is importing to build keychain
+echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+security create-keychain -p "$KEYCHAIN_PWD" build.keychain
+security default-keychain -s build.keychain
+security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
+security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain
+# importing notary certificate
+echo $INSTALLER_CERTIFICATE | base64 --decode > installer-certificate.p12
+security import installer-certificate.p12 -k build.keychain -P "$INSTALLER_PWD" -T /usr/bin/pkgbuild
+security set-key-partition-list -S apple-tool:,apple:,pkgbuild: -s -k "$KEYCHAIN_PWD" build.keychain

bin/notarize-app

@@ -0,0 +1,46 @@
+#!/bin/sh -u
+# source of this code: https://github.com/rednoah/notarize-app
+ASC_PROVIDER="$1"
+ASC_USERNAME="$2"
+ASC_PASSWORD="$3"
+
+BUNDLE_ID="$4"
+BUNDLE_PKG="$5"
+
+
+# create temporary files
+NOTARIZE_APP_LOG=$(mktemp -t notarize-app)
+NOTARIZE_INFO_LOG=$(mktemp -t notarize-info)
+
+# delete temporary files on exit
+function finish {
+	rm "$NOTARIZE_APP_LOG" "$NOTARIZE_INFO_LOG"
+}
+trap finish EXIT
+
+
+# submit app for notarization
+if xcrun altool --notarize-app --primary-bundle-id "$BUNDLE_ID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" -f "$BUNDLE_PKG" > "$NOTARIZE_APP_LOG" 2>&1; then
+	cat "$NOTARIZE_APP_LOG"
+	RequestUUID=$(awk -F ' = ' '/RequestUUID/ {print $2}' "$NOTARIZE_APP_LOG")
+
+	# check status periodically
+	while sleep 60 && date; do
+		# check notarization status
+		if xcrun altool --notarization-info "$RequestUUID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" > "$NOTARIZE_INFO_LOG" 2>&1; then
+			cat "$NOTARIZE_INFO_LOG"
+
+			# once notarization is complete, run stapler and exit
+			if ! grep -q "Status: in progress" "$NOTARIZE_INFO_LOG"; then
+				xcrun stapler staple "$BUNDLE_PKG"
+				exit $?
+			fi
+		else
+			cat "$NOTARIZE_INFO_LOG" 1>&2
+			exit 1
+		fi
+	done
+else
+	cat "$NOTARIZE_APP_LOG" 1>&2
+	exit 1
+fi

electron/package.json

@@ -28,7 +28,11 @@
     },
     "mac": {
       "icon": "build/icons/mac/inkstitch.icns",
-      "target": "dir"
+      "target": "dir",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/electron-entitlements.plist",
+      "entitlementsInherit": "build/electron-entitlements.plist"
     }
   },
   "keywords": [],
@@ -77,7 +81,7 @@
     "devtron": "^1.4.0",
     "easygettext": "^2.7.0",
     "electron": "4.1.3",
-    "electron-builder": "^20.39.0",
+    "electron-builder": "22.8.0",
     "electron-debug": "^1.5.0",
     "electron-devtools-installer": "^2.2.4",
     "electron-prebuilt-compile": "4.0.0",

installer_scripts/electron-entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+  </dict>
+</plist>

installer_scripts/entitlements.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+        <true/>
+        <key>com.apple.security.cs.disable-library-validation</key>
+        <true/>
+</dict>
+</plist>

installer_scripts/inkstitch.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<array>
+	<dict>
+		<key>BundleHasStrictIdentifier</key>
+		<false/>
+		<key>BundleIsRelocatable</key>
+		<false/>
+		<key>BundleIsVersionChecked</key>
+		<false/>
+		<key>BundleOverwriteAction</key>
+		<string>install</string>
+		<key>RootRelativeBundlePath</key>
+		<string>Contents/MacOS/electron/inkstitch-gui.app</string>
+	</dict>
+</array>
+</plist>

installer_scripts/scripts/postinstall

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+mv /tmp/inkstitch/ $HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/
+echo "Inkstitch was moved!"
+exit 0

installer_scripts/scripts/preinstall

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+inkstitch_folder=($HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/inkstitch)
+if [[ -L "${inkstitch_folder}" ]]; then
+	unlink "${inkstitch_folder}"
+	echo "Unlinking manual install, to avoid damaging user local repository."
+else
+	rm -rf "${inkstitch_folder}"
+	echo "Removing previous Ink/Stitch installation."
+fi
+exit 0

installer_scripts/template.iss

@@ -0,0 +1,84 @@
+#define PROGRAMNAME "Ink/Stitch"
+;inkstitch-version
+#define AppId "org.inkstitch.app"
+#define MyAppPublisher "Inkstitch Open Source Community"
+#define URL "https://inkstitch.org/"
+;inkstitch-year
+#define PATHTODIST "..\dist"
+#define INXPATH "..\inx"
+[Setup]
+; NOTE: The value of AppId uniquely identifies this application. Do not use the same AppId value in installers for other applications.
+; (To generate a new GUID, click Tools | Generate GUID inside the IDE.)
+
+LanguageDetectionMethod=uilanguage
+;AppId={{C78E6C6F-C47E-4319-AF5A-E71387AE2D4E}
+AppId={#AppId}
+AppName={#PROGRAMNAME}
+AppVersion={#VERSION}
+;AppVerName={#MyAppName} {#MyAppVersion}
+AppPublisherURL={#URL}
+AppSupportURL={#URL}
+AppUpdatesURL={#URL}
+DefaultDirName={userappdata}\inkscape\extensions\
+DefaultGroupName={#PROGRAMNAME}
+; Remove the following line to run in administrative install mode (install for all users.)
+ArchitecturesAllowed=x64
+PrivilegesRequired=lowest
+OutputBaseFilename=inkstitch
+OutputDir=.
+Compression=lzma
+SolidCompression=yes
+VersionInfoCompany={#URL}
+VersionInfoCopyright=Copyright (C) {#COPYRIGHT}
+VersionInfoDescription=An open-source machine embroidery design platform based on Inkscape.
+VersionInfoTextVersion={#VERSION}
+WizardStyle=modern
+ShowLanguageDialog=no
+
+[Languages]
+Name: "english"; MessagesFile: "compiler:Default.isl"
+Name: "armenian"; MessagesFile: "compiler:Languages\Armenian.isl"
+Name: "brazilian"; MessagesFile: "compiler:Languages\BrazilianPortuguese.isl"
+Name: "catalan"; MessagesFile: "compiler:Languages\Catalan.isl"
+Name: "corsican"; MessagesFile: "compiler:Languages\Corsican.isl"
+Name: "czech"; MessagesFile: "compiler:Languages\Czech.isl"
+Name: "danish"; MessagesFile: "compiler:Languages\Danish.isl"
+Name: "german"; MessagesFile: "compiler:Languages\German.isl"
+Name: "hebrew"; MessagesFile: "compiler:Languages\Hebrew.isl"
+Name: "icelandic"; MessagesFile: "compiler:Languages\Icelandic.isl"
+Name: "norwegian"; MessagesFile: "compiler:Languages\Norwegian.isl"
+Name: "polish"; MessagesFile: "compiler:Languages\Polish.isl"
+Name: "portuguese"; MessagesFile: "compiler:Languages\Portuguese.isl"
+Name: "spanish"; MessagesFile: "compiler:Languages\Spanish.isl"
+Name: "finnish"; MessagesFile: "compiler:Languages\Finnish.isl"
+Name: "french"; MessagesFile: "compiler:Languages\French.isl"
+Name: "italian"; MessagesFile: "compiler:Languages\Italian.isl"
+Name: "japanese"; MessagesFile: "compiler:Languages\Japanese.isl"
+Name: "dutch"; MessagesFile: "compiler:Languages\Dutch.isl"
+Name: "russian"; MessagesFile: "compiler:Languages\Russian.isl"
+Name: "slovak"; MessagesFile: "compiler:Languages\Slovak.isl"
+Name: "slovenian"; MessagesFile: "compiler:Languages\Slovenian.isl"
+Name: "turkish"; MessagesFile: "compiler:Languages\Turkish.isl"
+Name: "ukrainian"; MessagesFile: "compiler:Languages\Ukrainian.isl"
+
+[Types]
+Name: "English"; Description: "English";
+
+[Files]
+Source: "{#PATHTODIST}\inkstitch\*"; DestDir: "{app}\inkstitch\inkstitch"; Flags: ignoreversion recursesubdirs createallsubdirs
+; NOTE: Don't use "Flags: ignoreversion" on any shared system files 
+[Code]
+
+function InitializeSetup(): Boolean;
+begin
+  Result := True;
+  if RegKeyExists(HKEY_LOCAL_MACHINE,
+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') or
+     RegKeyExists(HKEY_CURRENT_USER,
+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') then
+  begin
+    MsgBox('The application is installed already.', mbInformation, MB_OK);
+    Result := False;
+  end;
+end;
+

lib/extensions/print_pdf.py

@@ -73,6 +73,9 @@ class PrintPreviewServer(Thread):
 
     def __set_resources_path(self):
         if getattr(sys, 'frozen', False):
+            if sys.platform == "darwin":
+                self.resources_path = os.path.join(sys._MEIPASS, "..", 'Resources', 'print', 'resources')
+            else:
                 self.resources_path = os.path.join(sys._MEIPASS, 'print', 'resources')
         else:
             self.resources_path = os.path.realpath(os.path.join(os.path.dirname(__file__), '..', '..', 'print', 'resources'))
@@ -183,6 +186,9 @@ class PrintPreviewServer(Thread):
 class Print(InkstitchExtension):
     def build_environment(self):
         if getattr(sys, 'frozen', False):
+            if sys.platform == "darwin":
+                print_dir = os.path.join(sys._MEIPASS, "..", 'Resources', "print")
+            else:
                 print_dir = os.path.join(sys._MEIPASS, "print")
         else:
             print_dir = os.path.realpath(os.path.join(os.path.dirname(__file__), "..", "..", "print"))

lib/gui/electron.py

@@ -22,7 +22,7 @@ def open_url(url):
         electron_path = os.path.join(get_bundled_dir("electron"), "inkstitch-gui")
 
         if sys.platform == "darwin":
-            electron_path += ".app/Contents/MacOS/inkstitch-gui"
+            electron_path = os.path.join(sys._MEIPASS, "electron", "inkstitch-gui.app", "Contents", "MacOS", "inkstitch-gui")
             command = ["open", "-W", "-a", electron_path, "--args", url]
         else:
             command = [electron_path, url]
@@ -32,5 +32,18 @@ def open_url(url):
         cwd = get_bundled_dir("electron")
 
     # Any output on stdout will crash inkscape.
+    # In macos manual install the python env paths are incomplete
+    # Adding the yarn path to the env paths fixes this issue
+    if sys.platform == "darwin" and getattr(sys, 'frozen', None) is None:
+        mac_dev_env = os.environ.copy()
+        # these are paths installed by brew or macports
+        yarn_path = "/usr/local/bin:/opt/local/bin:"
+        if yarn_path in mac_dev_env["PATH"]:
+            pass
+        else:
+            mac_dev_env["PATH"] = yarn_path + mac_dev_env["PATH"]
+        with open(os.devnull, 'w') as null:
+            return subprocess.Popen(command, cwd=cwd, stdout=null, env=mac_dev_env)
+    else:
         with open(os.devnull, 'w') as null:
             return subprocess.Popen(command, cwd=cwd, stdout=null)

lib/i18n.py

@@ -30,6 +30,9 @@ def _set_locale_dir():
     else:
         locale_dir = dirname(dirname(realpath(__file__)))
 
+    if sys.platform == "darwin":
+        locale_dir = os.path.join(locale_dir, "..", 'Resources', 'locales')
+    else:
         locale_dir = os.path.join(locale_dir, 'locales')
 
 

lib/inx/utils.py

@@ -35,8 +35,8 @@ def build_environment():
             env.globals["command_tag"] = '<command location="inx">../bin/inkstitch.exe</command>'
             env.globals["image_path"] = '../bin/icons/'
         elif sys.platform == "darwin":
-            env.globals["command_tag"] = '<command location="inx">../MacOS/inkstitch</command>'
+            env.globals["command_tag"] = '<command location="inx">../../MacOS/inkstitch</command>'
-            env.globals["image_path"] = '../MacOS/icons/'
+            env.globals["image_path"] = '../../Resources/icons/'
         else:
             env.globals["command_tag"] = '<command location="inx">../bin/inkstitch</command>'
             env.globals["image_path"] = '../bin/icons/'

lib/utils/paths.py

@@ -10,6 +10,9 @@ from os.path import dirname, realpath
 
 def get_bundled_dir(name):
     if getattr(sys, 'frozen', None) is not None:
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
             return realpath(os.path.join(sys._MEIPASS, "..", name))
     else:
         return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))
@@ -17,6 +20,9 @@ def get_bundled_dir(name):
 
 def get_resource_dir(name):
     if getattr(sys, 'frozen', None) is not None:
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
             return realpath(os.path.join(sys._MEIPASS, name))
     else:
         return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))

lib/utils/version.py

@@ -11,6 +11,9 @@ from ..i18n import _
 
 def get_inkstitch_version():
     if getattr(sys, 'frozen', False) and hasattr(sys, '_MEIPASS'):
+        if sys.platform == "darwin":
+            version = realpath(join(sys._MEIPASS, "..", 'Resources', "VERSION"))
+        else:
             version = realpath(join(sys._MEIPASS, "..", "VERSION"))
     else:
         version = realpath(join(realpath(__file__), "..", "..", "..", 'VERSION'))