add macOS and windows installer (#1352)

2021-12-08 22:18:41 +01:00 · 2021-12-08 22:18:41 +01:00 · 41ace3a9e5
commit 41ace3a9e5
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -15,7 +15,7 @@ jobs:
          submodules: recursive
      - uses: actions/setup-python@v2
        with:
-          python-version: '3.9.x'
+          python-version: '3.8.5'
      - uses: actions/setup-node@v1
        with:
          node-version: '16.x'
@ -114,6 +114,20 @@ jobs:
          make dist
        env:
          BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'dist'
+          recursive: true
+      - shell: bash
+        run: |
+          bash bin/build-windows-installer
+        env:
+          BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'artifacts'
      - uses: actions/upload-artifact@v2
        with:
          name: inkstitch-windows
@ -150,9 +164,11 @@ jobs:
          pip install wheel
          pip install PyGObject
          pip install git+https://github.com/gtaylor/python-colormath
-
          pip install -r requirements.txt
-          pip install pyinstaller==4.3
+          # with --no-binary argument may fix notary issues as well shapely speedups error issue
+          pip install -U lxml --no-binary lxml
+          pip install -U Shapely==1.7.1 --no-binary Shapely
+          pip install pyinstaller

          echo "${{ env.pythonLocation }}/bin" >> $GITHUB_PATH
      - shell: bash
@ -160,6 +176,15 @@ jobs:
          make dist
        env:
          BUILD: osx
+          MACOS_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PWD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          INSTALLER_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE }}
+          INSTALLER_PWD: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
+          NOTARY_ACCOUNT: ${{ secrets.INKSTITCH_NOTARIZE_AC }}
+          NOTARY_PASSWORD: ${{ secrets.INKSTITCH_NOTARIZE_PASS }}
+
+
      - uses: actions/upload-artifact@v2
        with:
          name: inkstitch-mac
@ -212,3 +237,5 @@ jobs:
          title: "${{env.title}}"
          files: |
            artifacts/*.zip
+            artifacts/*.exe
+            artifacts/*.pkg
--- a/.gitignore
+++ b/.gitignore
@ -17,4 +17,4 @@ locales/
 /.idea
 /VERSION
 /src/
-.DS_Store
+.DS_STORE
--- a/3
+++ b/3
@ -1,11 +1,10 @@
-
 dist: version locales inx
 	bash bin/build-python
 	bash bin/build-electron
 	bash bin/build-distribution-archives

 distclean:
-	rm -rf build dist inx locales *.spec *.tar.gz *.zip electron/node_modules electron/dist
+	rm -rf build dist inx locales artifacts win mac *.spec *.tar.gz *.zip electron/node_modules electron/dist

 .PHONY: inx
 inx: version locales
--- a/bin/build-distribution-archives
+++ b/bin/build-distribution-archives
@ -1,27 +1,90 @@
-#!/bin/bash
-
 VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
 OS="${BUILD:-$(uname)}"
-ARCH="$(uname -m)"
-
+mkdir artifacts
 if [ "$BUILD" = "osx" ]; then
-    cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch.app/Contents
-    cp -a icons locales print dist/inkstitch.app/Contents/MacOS
-    cp -a electron/build/mac dist/inkstitch.app/Contents/electron
+    cp -a icons locales print LICENSE VERSION images/examples palettes symbols fonts inx dist/inkstitch.app/Contents/Resources
    rm -rf dist/inkstitch/
+    temp_path="/tmp/inkstitch/"
+    # inside the scripts folder are:
+    # - preinstaller (checks for previously installed inkstitch and deletes it) and
+    # - postinstaller (moves inkstitch folder from /tmp to user Inkscape extensions folder in $HOME)
+    # The postinstaller is a workaround for a proper way to install in user $HOME space
+
+    # Build on GitHub will be handled differently from local builds.
+    # Local builds will not be signed nor notarized. They are run to produce releases for legacy versions of macOS.
+    # Notarization for development branches can be forced with this variable set to true
+    NOTARIZE_DEVELOPMENT_BUILDS=false
+
+    if [[ ! -z "${GITHUB_REF}" ]]; then
+        # This code signs and notarize the inkstitch.app
+        DEV_IDENT="Developer ID Application: Lex Neva (929A568N58)"
+        echo "Signing of inkstitch.app"
+        # Coyping inkstitch-gui.app into inkstitch
+        ditto electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        # signing the binary may fix notary issue
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app/Contents/MacOS/inkstitch -v
+        # last signing before packaging
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app -v
+        echo "Running pkgbuild"
+        INSTALLER_IDENT="Developer ID Installer: Lex Neva (929A568N58)"
+        /usr/bin/pkgbuild --root dist/inkstitch.app \
+                        -s "${INSTALLER_IDENT}" \
+                        --component-plist installer_scripts/inkstitch.plist \
+                        --ownership recommended \
+                        --identifier org.inkstitch.installer \
+                        --version ${VERSION} \
+                        --scripts installer_scripts/scripts \
+                        --install-location ${temp_path}inkstitch.app \
+                        artifacts/inkstitch-${VERSION}-${OS}.pkg
+        if [[ "${GITHUB_REF}" =~ ^refs/tags/v[0-9.]+$ || $NOTARIZE_DEVELOPMENT_BUILDS == true ]]; then
+            echo "Notary starting"
+            bash bin/notarize-app "929A568N58" \
+                                "${NOTARY_ACCOUNT}" \
+                                "${NOTARY_PASSWORD}" \
+                                "org.inkstitch.app" \
+                                artifacts/inkstitch-${VERSION}-${OS}.pkg
+        fi
+    else
+        # local builds will not be signed or notarized
+        cp -a electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        pkgbuild --root dist/inkstitch.app \
+                --component-plist installer_scripts/inkstitch.plist \
+                --ownership recommended \
+                --identifier org.inkstitch.installer \
+                --version ${VERSION} \
+                --scripts installer_scripts/scripts \
+                --install-location ${temp_path}inkstitch.app \
+                artifacts/inkstitch-${VERSION}-${OS}.pkg
+    fi
 else
    cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch
    cp -a icons locales print dist/inkstitch/bin
    cp -a electron/build/*-unpacked dist/inkstitch/electron
+
 fi

-mkdir artifacts
-cd dist
-
-if [ "$$BUILD" = "windows" ]; then
-    # The python zipfile command line utility can't handle directories
-    # containing files with UTF-8 names on Windows, so we use 7-zip instead.
-    7z a ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
-else
-	  python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+if [ "$BUILD" = "windows" ]; then
+    # build the installer locally
+    # remotely it will be called through build.yml after signing
+    if [[ -z "${GITHUB_REF}" ]]; then
+        bash bin/build-windows-installer
+    fi
+fi
+
+if [ "$BUILD" = "linux" ]; then
+    cd dist
+    python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+    cd ..
 fi
--- a/bin/build-electron
+++ b/bin/build-electron
@ -8,6 +8,7 @@ if [ "$BUILD" = "windows" ]; then
 elif [ "$BUILD" = "linux" ]; then
  args="-l --x64"
 elif [ "$BUILD" = "osx" ]; then
+  cp installer_scripts/electron-entitlements.plist electron/build/
  args="-m"
 fi

--- a/bin/build-python
+++ b/bin/build-python
@ -36,6 +36,16 @@ pyinstaller_args+="-p inkscape/share/extensions "
 # output useful debugging info that helps us trace library dependency issues
 pyinstaller_args+="--log-level DEBUG "

+# This adds bundle identifier in reverse DSN format for macos
+if [ "$BUILD" = "osx" ]; then
+    pyinstaller_args+="--osx-bundle-identifier org.inkstitch.app "
+    if [[ -z ${GITHUB_REF} ]]; then
+        :
+    else
+        bash bin/import-macos-keys
+    fi
+fi
+
 if [ "$BUILD" = "windows" ]; then
    python -m PyInstaller $pyinstaller_args inkstitch.py
 else
--- a/bin/build-windows-installer
+++ b/bin/build-windows-installer
@ -0,0 +1,15 @@
+#!/bin/bash
+VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
+OS="${BUILD:-$(uname)}"
+# Create windows installer
+mkdir win
+cp installer_scripts/template.iss win/win_build.iss
+# adds the year and version to the inno installer
+info_year=$( date "+%Y" )
+copyright_year="#define COPYRIGHT \""${info_year}"\" + URL"
+version_block="#define VERSION \""${VERSION}"\""
+sed -i'' -e '/;inkstitch-year/ a\'$'\n'"${copyright_year}"'' win/win_build.iss
+sed -i'' -e '/;inkstitch-version/ a\'$'\n'"${version_block}"'' win/win_build.iss
+
+iscc win/win_build.iss
+mv  win/inkstitch.exe artifacts/inkstitch-${VERSION}-${OS}.exe
--- a/bin/import-macos-keys
+++ b/bin/import-macos-keys
@ -0,0 +1,12 @@
+#!/bin/bash
+# first part of codesiging which is importing to build keychain
+echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+security create-keychain -p "$KEYCHAIN_PWD" build.keychain
+security default-keychain -s build.keychain
+security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
+security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain
+# importing notary certificate
+echo $INSTALLER_CERTIFICATE | base64 --decode > installer-certificate.p12
+security import installer-certificate.p12 -k build.keychain -P "$INSTALLER_PWD" -T /usr/bin/pkgbuild
+security set-key-partition-list -S apple-tool:,apple:,pkgbuild: -s -k "$KEYCHAIN_PWD" build.keychain
--- a/bin/notarize-app
+++ b/bin/notarize-app
@ -0,0 +1,46 @@
+#!/bin/sh -u
+# source of this code: https://github.com/rednoah/notarize-app
+ASC_PROVIDER="$1"
+ASC_USERNAME="$2"
+ASC_PASSWORD="$3"
+
+BUNDLE_ID="$4"
+BUNDLE_PKG="$5"
+
+
+# create temporary files
+NOTARIZE_APP_LOG=$(mktemp -t notarize-app)
+NOTARIZE_INFO_LOG=$(mktemp -t notarize-info)
+
+# delete temporary files on exit
+function finish {
+	rm "$NOTARIZE_APP_LOG" "$NOTARIZE_INFO_LOG"
+}
+trap finish EXIT
+
+
+# submit app for notarization
+if xcrun altool --notarize-app --primary-bundle-id "$BUNDLE_ID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" -f "$BUNDLE_PKG" > "$NOTARIZE_APP_LOG" 2>&1; then
+	cat "$NOTARIZE_APP_LOG"
+	RequestUUID=$(awk -F ' = ' '/RequestUUID/ {print $2}' "$NOTARIZE_APP_LOG")
+
+	# check status periodically
+	while sleep 60 && date; do
+		# check notarization status
+		if xcrun altool --notarization-info "$RequestUUID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" > "$NOTARIZE_INFO_LOG" 2>&1; then
+			cat "$NOTARIZE_INFO_LOG"
+
+			# once notarization is complete, run stapler and exit
+			if ! grep -q "Status: in progress" "$NOTARIZE_INFO_LOG"; then
+				xcrun stapler staple "$BUNDLE_PKG"
+				exit $?
+			fi
+		else
+			cat "$NOTARIZE_INFO_LOG" 1>&2
+			exit 1
+		fi
+	done
+else
+	cat "$NOTARIZE_APP_LOG" 1>&2
+	exit 1
+fi
--- a/electron/build/icons/mac/inkstitch.icns
+++ b/electron/build/icons/mac/inkstitch.icns
--- a/electron/package.json
+++ b/electron/package.json
@ -28,7 +28,11 @@
    },
    "mac": {
      "icon": "build/icons/mac/inkstitch.icns",
-      "target": "dir"
+      "target": "dir",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/electron-entitlements.plist",
+      "entitlementsInherit": "build/electron-entitlements.plist"
    }
  },
  "keywords": [],
@ -77,7 +81,7 @@
    "devtron": "^1.4.0",
    "easygettext": "^2.7.0",
    "electron": "4.1.3",
-    "electron-builder": "^20.39.0",
+    "electron-builder": "22.8.0",
    "electron-debug": "^1.5.0",
    "electron-devtools-installer": "^2.2.4",
    "electron-prebuilt-compile": "4.0.0",
--- a/installer_scripts/electron-entitlements.plist
+++ b/installer_scripts/electron-entitlements.plist
@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+  </dict>
+</plist>
--- a/installer_scripts/entitlements.plist
+++ b/installer_scripts/entitlements.plist
@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+        <true/>
+        <key>com.apple.security.cs.disable-library-validation</key>
+        <true/>
+</dict>
+</plist>
--- a/installer_scripts/inkstitch.plist
+++ b/installer_scripts/inkstitch.plist
@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<array>
+	<dict>
+		<key>BundleHasStrictIdentifier</key>
+		<false/>
+		<key>BundleIsRelocatable</key>
+		<false/>
+		<key>BundleIsVersionChecked</key>
+		<false/>
+		<key>BundleOverwriteAction</key>
+		<string>install</string>
+		<key>RootRelativeBundlePath</key>
+		<string>Contents/MacOS/electron/inkstitch-gui.app</string>
+	</dict>
+</array>
+</plist>
--- a/installer_scripts/scripts/postinstall
+++ b/installer_scripts/scripts/postinstall
@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+mv /tmp/inkstitch/ $HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/
+echo "Inkstitch was moved!"
+exit 0
--- a/installer_scripts/scripts/preinstall
+++ b/installer_scripts/scripts/preinstall
@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+inkstitch_folder=($HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/inkstitch)
+if [[ -L "${inkstitch_folder}" ]]; then
+	unlink "${inkstitch_folder}"
+	echo "Unlinking manual install, to avoid damaging user local repository."
+else
+	rm -rf "${inkstitch_folder}"
+	echo "Removing previous Ink/Stitch installation."
+fi
+exit 0
--- a/installer_scripts/template.iss
+++ b/installer_scripts/template.iss
@ -0,0 +1,84 @@
+#define PROGRAMNAME "Ink/Stitch"
+;inkstitch-version
+#define AppId "org.inkstitch.app"
+#define MyAppPublisher "Inkstitch Open Source Community"
+#define URL "https://inkstitch.org/"
+;inkstitch-year
+#define PATHTODIST "..\dist"
+#define INXPATH "..\inx"
+[Setup]
+; NOTE: The value of AppId uniquely identifies this application. Do not use the same AppId value in installers for other applications.
+; (To generate a new GUID, click Tools | Generate GUID inside the IDE.)
+
+LanguageDetectionMethod=uilanguage
+;AppId={{C78E6C6F-C47E-4319-AF5A-E71387AE2D4E}
+AppId={#AppId}
+AppName={#PROGRAMNAME}
+AppVersion={#VERSION}
+;AppVerName={#MyAppName} {#MyAppVersion}
+AppPublisherURL={#URL}
+AppSupportURL={#URL}
+AppUpdatesURL={#URL}
+DefaultDirName={userappdata}\inkscape\extensions\
+DefaultGroupName={#PROGRAMNAME}
+; Remove the following line to run in administrative install mode (install for all users.)
+ArchitecturesAllowed=x64
+PrivilegesRequired=lowest
+OutputBaseFilename=inkstitch
+OutputDir=.
+Compression=lzma
+SolidCompression=yes
+VersionInfoCompany={#URL}
+VersionInfoCopyright=Copyright (C) {#COPYRIGHT}
+VersionInfoDescription=An open-source machine embroidery design platform based on Inkscape.
+VersionInfoTextVersion={#VERSION}
+WizardStyle=modern
+ShowLanguageDialog=no
+
+[Languages]
+Name: "english"; MessagesFile: "compiler:Default.isl"
+Name: "armenian"; MessagesFile: "compiler:Languages\Armenian.isl"
+Name: "brazilian"; MessagesFile: "compiler:Languages\BrazilianPortuguese.isl"
+Name: "catalan"; MessagesFile: "compiler:Languages\Catalan.isl"
+Name: "corsican"; MessagesFile: "compiler:Languages\Corsican.isl"
+Name: "czech"; MessagesFile: "compiler:Languages\Czech.isl"
+Name: "danish"; MessagesFile: "compiler:Languages\Danish.isl"
+Name: "german"; MessagesFile: "compiler:Languages\German.isl"
+Name: "hebrew"; MessagesFile: "compiler:Languages\Hebrew.isl"
+Name: "icelandic"; MessagesFile: "compiler:Languages\Icelandic.isl"
+Name: "norwegian"; MessagesFile: "compiler:Languages\Norwegian.isl"
+Name: "polish"; MessagesFile: "compiler:Languages\Polish.isl"
+Name: "portuguese"; MessagesFile: "compiler:Languages\Portuguese.isl"
+Name: "spanish"; MessagesFile: "compiler:Languages\Spanish.isl"
+Name: "finnish"; MessagesFile: "compiler:Languages\Finnish.isl"
+Name: "french"; MessagesFile: "compiler:Languages\French.isl"
+Name: "italian"; MessagesFile: "compiler:Languages\Italian.isl"
+Name: "japanese"; MessagesFile: "compiler:Languages\Japanese.isl"
+Name: "dutch"; MessagesFile: "compiler:Languages\Dutch.isl"
+Name: "russian"; MessagesFile: "compiler:Languages\Russian.isl"
+Name: "slovak"; MessagesFile: "compiler:Languages\Slovak.isl"
+Name: "slovenian"; MessagesFile: "compiler:Languages\Slovenian.isl"
+Name: "turkish"; MessagesFile: "compiler:Languages\Turkish.isl"
+Name: "ukrainian"; MessagesFile: "compiler:Languages\Ukrainian.isl"
+
+[Types]
+Name: "English"; Description: "English";
+
+[Files]
+Source: "{#PATHTODIST}\inkstitch\*"; DestDir: "{app}\inkstitch\inkstitch"; Flags: ignoreversion recursesubdirs createallsubdirs
+; NOTE: Don't use "Flags: ignoreversion" on any shared system files 
+[Code]
+
+function InitializeSetup(): Boolean;
+begin
+  Result := True;
+  if RegKeyExists(HKEY_LOCAL_MACHINE,
+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') or
+     RegKeyExists(HKEY_CURRENT_USER,
+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') then
+  begin
+    MsgBox('The application is installed already.', mbInformation, MB_OK);
+    Result := False;
+  end;
+end;
+
--- a/lib/extensions/print_pdf.py
+++ b/lib/extensions/print_pdf.py
@ -73,7 +73,10 @@ class PrintPreviewServer(Thread):

    def __set_resources_path(self):
        if getattr(sys, 'frozen', False):
-            self.resources_path = os.path.join(sys._MEIPASS, 'print', 'resources')
+            if sys.platform == "darwin":
+                self.resources_path = os.path.join(sys._MEIPASS, "..", 'Resources', 'print', 'resources')
+            else:
+                self.resources_path = os.path.join(sys._MEIPASS, 'print', 'resources')
        else:
            self.resources_path = os.path.realpath(os.path.join(os.path.dirname(__file__), '..', '..', 'print', 'resources'))

@ -183,7 +186,10 @@ class PrintPreviewServer(Thread):
 class Print(InkstitchExtension):
    def build_environment(self):
        if getattr(sys, 'frozen', False):
-            print_dir = os.path.join(sys._MEIPASS, "print")
+            if sys.platform == "darwin":
+                print_dir = os.path.join(sys._MEIPASS, "..", 'Resources', "print")
+            else:
+                print_dir = os.path.join(sys._MEIPASS, "print")
        else:
            print_dir = os.path.realpath(os.path.join(os.path.dirname(__file__), "..", "..", "print"))

--- a/lib/gui/electron.py
+++ b/lib/gui/electron.py
@ -22,7 +22,7 @@ def open_url(url):
        electron_path = os.path.join(get_bundled_dir("electron"), "inkstitch-gui")

        if sys.platform == "darwin":
-            electron_path += ".app/Contents/MacOS/inkstitch-gui"
+            electron_path = os.path.join(sys._MEIPASS, "electron", "inkstitch-gui.app", "Contents", "MacOS", "inkstitch-gui")
            command = ["open", "-W", "-a", electron_path, "--args", url]
        else:
            command = [electron_path, url]
@ -32,5 +32,18 @@ def open_url(url):
        cwd = get_bundled_dir("electron")

    # Any output on stdout will crash inkscape.
-    with open(os.devnull, 'w') as null:
-        return subprocess.Popen(command, cwd=cwd, stdout=null)
+    # In macos manual install the python env paths are incomplete
+    # Adding the yarn path to the env paths fixes this issue
+    if sys.platform == "darwin" and getattr(sys, 'frozen', None) is None:
+        mac_dev_env = os.environ.copy()
+        # these are paths installed by brew or macports
+        yarn_path = "/usr/local/bin:/opt/local/bin:"
+        if yarn_path in mac_dev_env["PATH"]:
+            pass
+        else:
+            mac_dev_env["PATH"] = yarn_path + mac_dev_env["PATH"]
+        with open(os.devnull, 'w') as null:
+            return subprocess.Popen(command, cwd=cwd, stdout=null, env=mac_dev_env)
+    else:
+        with open(os.devnull, 'w') as null:
+            return subprocess.Popen(command, cwd=cwd, stdout=null)
--- a/lib/i18n.py
+++ b/lib/i18n.py
@ -30,7 +30,10 @@ def _set_locale_dir():
    else:
        locale_dir = dirname(dirname(realpath(__file__)))

-    locale_dir = os.path.join(locale_dir, 'locales')
+    if sys.platform == "darwin":
+        locale_dir = os.path.join(locale_dir, "..", 'Resources', 'locales')
+    else:
+        locale_dir = os.path.join(locale_dir, 'locales')


 def localize(languages=None):
--- a/lib/inx/utils.py
+++ b/lib/inx/utils.py
@ -35,8 +35,8 @@ def build_environment():
            env.globals["command_tag"] = '<command location="inx">../bin/inkstitch.exe</command>'
            env.globals["image_path"] = '../bin/icons/'
        elif sys.platform == "darwin":
-            env.globals["command_tag"] = '<command location="inx">../MacOS/inkstitch</command>'
-            env.globals["image_path"] = '../MacOS/icons/'
+            env.globals["command_tag"] = '<command location="inx">../../MacOS/inkstitch</command>'
+            env.globals["image_path"] = '../../Resources/icons/'
        else:
            env.globals["command_tag"] = '<command location="inx">../bin/inkstitch</command>'
            env.globals["image_path"] = '../bin/icons/'
--- a/lib/utils/paths.py
+++ b/lib/utils/paths.py
@ -10,13 +10,19 @@ from os.path import dirname, realpath

 def get_bundled_dir(name):
    if getattr(sys, 'frozen', None) is not None:
-        return realpath(os.path.join(sys._MEIPASS, "..", name))
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
+            return realpath(os.path.join(sys._MEIPASS, "..", name))
    else:
        return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))


 def get_resource_dir(name):
    if getattr(sys, 'frozen', None) is not None:
-        return realpath(os.path.join(sys._MEIPASS, name))
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
+            return realpath(os.path.join(sys._MEIPASS, name))
    else:
        return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))
--- a/lib/utils/version.py
+++ b/lib/utils/version.py
@ -11,7 +11,10 @@ from ..i18n import _

 def get_inkstitch_version():
    if getattr(sys, 'frozen', False) and hasattr(sys, '_MEIPASS'):
-        version = realpath(join(sys._MEIPASS, "..", "VERSION"))
+        if sys.platform == "darwin":
+            version = realpath(join(sys._MEIPASS, "..", 'Resources', "VERSION"))
+        else:
+            version = realpath(join(sys._MEIPASS, "..", "VERSION"))
    else:
        version = realpath(join(realpath(__file__), "..", "..", "..", 'VERSION'))
    if isfile(version):
--- a/templates/embroider_settings.xml
+++ b/templates/embroider_settings.xml
@ -12,7 +12,7 @@
    <param name="output_settings" type="description" appearance="header">
        Output Settings
    </param>
-    <param name="collapse_len_mm" type="float" precision="1" min="0" max="10" 
+    <param name="collapse_len_mm" type="float" precision="1" min="0" max="10"
           gui-text="Collapse length (mm)"
           gui-description="Jump stitches smaller than this will be treated as normal stitches.">3</param>
    <script>