Setup macos packaging and code signing

.github/workflows/build.yaml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - develop
   workflow_dispatch:
 jobs:
   build-linux:
@@ -50,6 +51,49 @@ jobs:
           source ./ci/test.sh
           source ./ci/build.sh
         shell: bash
+
+      - name: Setup temporary keychain and add application signing certificate
+        uses: apple-actions/import-codesign-certs@v1
+        with: 
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_APPLICATION }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_APPLICATION_PASSWORD }}
+
+      - name: Codesign AU plugin
+        working-directory: ${{ github.workspace }}/ci/bin
+        run: codesign -s "${{ secrets.APPLE_DEVELOPER_ID_APPLICATION }}" osci-render.component --timestamp
+
+      - name: Codesign VST3 plugin
+        working-directory: ${{ github.workspace }}/ci/bin
+        run: codesign -s "${{ secrets.APPLE_DEVELOPER_ID_APPLICATION }}" osci-render.vst3 --timestamp
+
+      - name: Codesign Standalone app
+        working-directory: ${{ github.workspace }}/ci/bin
+        run: codesign -s "${{ secrets.APPLE_DEVELOPER_ID_APPLICATION }}" osci-render.app --timestamp
+
+      - name: Download Packages installer build tool
+        run: wget http://s.sudre.free.fr/Software/files/Packages.dmg
+
+      - name: Mount Packages image
+        run: hdiutil attach Packages.dmg
+
+      - name: Install Packages
+        run: sudo installer -pkg /Volumes/Packages\ 1.2.9/Install\ Packages.pkg -target /
+
+      - name: Build installer
+        run: packagesbuild --project "${{ github.workspace }}/packaging/osci-render.pkgproj"
+
+      - name: Setup temporary keychain and add installer signing certificate
+        uses: apple-actions/import-codesign-certs@v1
+        with: 
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_INSTALLER }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_INSTALLER_PASSWORD }}
+
+      - name: Sign installer
+        run: productsign -s "${{ secrets.APPLE_DEVELOPER_ID_INSTALLER }}" "${{ github.workspace }}/packaging/osci-render.pkg" "${{ github.workspace }}/bin/osci-render.pkg"
+    
+      - name: Notarize installer
+        run: npx notarize-cli --file "${{ github.workspace }}/packaging/osci-render-signed.pkg" --bundle-id com.osci-render.pkg --username ${{ secrets.APPLE_ID }} --password ${{ secrets.APPLE_NOTARIZATION_PW }}
+
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:

.gitignore

@@ -5,6 +5,7 @@
 
 .DS_Store
 
+*.pkg
 *.psd
 
 # ignore JUCE

osci-render.jucer

@@ -4,8 +4,8 @@
               addUsingNamespaceToJuceHeader="0" jucerFormatVersion="1" pluginCharacteristicsValue="pluginWantsMidiIn"
               pluginManufacturer="jameshball" aaxIdentifier="sh.ball.oscirender"
               cppLanguageStandard="20" projectLineFeed="
" headerPath="./include"
-              version="2.3.0" companyName="James H Ball" companyWebsite="https://osci-render.com"
-              companyEmail="james@ball.sh" defines="NOMINMAX=1
INTERNET_FLAG_NO_AUTO_REDIRECT=0
SOSCI_FEATURES=0"
+              version="2.4.0" companyName="James H Ball" companyWebsite="https://osci-render.com"
+              companyEmail="james@ball.sh" defines="NOMINMAX=1
INTERNET_FLAG_NO_AUTO_REDIRECT=0
SOSCI_FEATURES=1"
               pluginAUMainType="'aumf'" postExportShellCommandPosix="%%1%%/ci/remove_embed_frameworks.sh %%1%%/Builds/MacOSX/osci-render.xcodeproj/project.pbxproj osci-render">
   <MAINGROUP id="j5Ge2T" name="osci-render">
     <GROUP id="{5ABCED88-0059-A7AF-9596-DBF91DDB0292}" name="Resources">
@@ -776,7 +776,8 @@
                extraDefs="JUCE_SILENCE_XCODE_15_LINKER_WARNING=1" smallIcon="pSc1mq"
                bigIcon="pSc1mq" applicationCategory="public.app-category.music"
                microphonePermissionNeeded="1" frameworkSearchPaths="../../External/syphon"
-               embeddedFrameworks="../../External/syphon/Syphon.framework" extraCustomFrameworks="../../External/syphon/Syphon.framework">
+               embeddedFrameworks="../../External/syphon/Syphon.framework" extraCustomFrameworks="../../External/syphon/Syphon.framework"
+               hardenedRuntime="1" hardenedRuntimeOptions="com.apple.security.device.audio-input">
       <CONFIGURATIONS>
         <CONFIGURATION isDebug="1" name="Debug" targetName="osci-render" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS = '@executable_path/../Frameworks' '@executable_path/'"/>
         <CONFIGURATION name="Release" targetName="osci-render" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS = '@executable_path/../Frameworks' '@executable_path/'"/>

sosci.jucer

@@ -257,8 +257,8 @@
                extraCustomFrameworks="../../../External/syphon/Syphon.framework"
                frameworkSearchPaths="../../../External/syphon">
       <CONFIGURATIONS>
-        <CONFIGURATION isDebug="1" name="Debug" targetName="sosci" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS=@executable_path/../Frameworks"/>
-        <CONFIGURATION name="Release" targetName="sosci" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS=@executable_path/../Frameworks"/>
+        <CONFIGURATION isDebug="1" name="Debug" targetName="sosci" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS = '@executable_path/../Frameworks' '@executable_path/'"/>
+        <CONFIGURATION name="Release" targetName="sosci" customXcodeFlags="LD_RUNPATH_SEARCH_PATHS = '@executable_path/../Frameworks' '@executable_path/'"/>
       </CONFIGURATIONS>
       <MODULEPATHS>
         <MODULEPATH id="juce_audio_basics" path="../../../JUCE/modules"/>