macos app bundle (#585)

* test signed app bundle

* fix vars

* fix condition

* typo

* fix quoting

* use recursive signing script

* fix release cleanup

* restore proper ci action

.github/workflows/ci.yml

@@ -71,6 +71,13 @@ jobs:
 
       - name: Install dependencies
         run: dotnet restore
+        
+      - name: Import Code-Signing Certificates
+        uses: Apple-Actions/import-codesign-certs@v1
+        if: matrix.kind == 'macOS'
+        with:
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}        
 
       - name: Build
         shell: bash
@@ -82,19 +89,34 @@ jobs:
           final="${tag2/alpha/$short}"
           release_name="ErsatzTV-$final-${{ matrix.target }}"
           echo "RELEASE_NAME=${release_name}" >> $GITHUB_ENV
-          
+                  
           # Build everything
-          dotnet publish ErsatzTV/ErsatzTV.csproj --framework net6.0 --runtime "${{ matrix.target }}" -c Release -o "$release_name" /property:InformationalVersion="$final-${{ matrix.target }}" /property:EnableCompressionInSingleFile=true /property:DebugType=Embedded /property:PublishSingleFile=true --self-contained true
-          
-          # Pack files
-          if [ "${{ matrix.target }}" == "win-x64" ]; then
-            7z a -tzip "${release_name}.zip" "./${release_name}/*"
+          if [ "${{ matrix.kind }}" == "macOS" ]; then
+            brew tap mitchellh/gon
+            brew install mitchellh/gon/gon
+            dotnet msbuild ErsatzTV/ErsatzTV.csproj -t:BundleApp -p:RuntimeIdentifier="${{ matrix.target }}" -p:CFBundleVersion="${tag2}" -p:Configuration=Release -p:CFBundleShortVersionString="${tag2}" -p:InformationalVersion="$final-${{ matrix.target }}" -p:EnableCompressionInSingleFile=true -p:DebugType=Embedded -p:PublishSingleFile=true -p:PublishDir=$(pwd)/release
+            cp scripts/macOS/launcher.sh release/ErsatzTV.app/Contents/MacOS/
+            scripts/macOS/sign.sh
+            gon -log-level=debug -log-json ./gon.json
+            mv release/ErsatzTV.dmg "${release_name}.dmg"
+            rm -r release
           else
-            tar czvf "${release_name}.tar.gz" "$release_name"
+            dotnet publish ErsatzTV/ErsatzTV.csproj --framework net6.0 --runtime "${{ matrix.target }}" -c Release -o "$release_name" /property:InformationalVersion="$final-${{ matrix.target }}" /property:EnableCompressionInSingleFile=true /property:DebugType=Embedded /property:PublishSingleFile=true --self-contained true
+  
+            # Pack files
+            if [ "${{ matrix.target }}" == "win-x64" ]; then
+              7z a -tzip "${release_name}.zip" "./${release_name}/*"
+            else
+              tar czvf "${release_name}.tar.gz" "$release_name"
+            fi
+
+            # Delete output directory
+            rm -r "$release_name"
           fi
-          
-          # Delete output directory
-          rm -r "$release_name"
+        env:
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
+
       - name: Delete old release assets
         uses: mknejp/delete-release-assets@v1
         with:
@@ -104,6 +126,7 @@ jobs:
           assets: |
             *${{ matrix.target }}.zip
             *${{ matrix.target }}.tar.gz
+            *${{ matrix.target }}.dmg
       - name: Publish
         uses: softprops/action-gh-release@v1
         with:
@@ -112,6 +135,7 @@ jobs:
           files: |
             ${{ env.RELEASE_NAME }}.zip
             ${{ env.RELEASE_NAME }}.tar.gz
+            ${{ env.RELEASE_NAME }}.dmg
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build_and_push:

ErsatzTV/ErsatzTV.csproj

@@ -4,6 +4,18 @@
         <TargetFramework>net6.0</TargetFramework>
         <NoWarn>VSTHRD200</NoWarn>
         <IncludeAllContentForSelfExtract>true</IncludeAllContentForSelfExtract>
+	<RuntimeIdentifiers>osx-x64;osx-arm64</RuntimeIdentifiers>
+    </PropertyGroup>
+
+    <PropertyGroup>
+        <CFBundleName>ErsatzTV</CFBundleName>
+        <CFBundleDisplayName>ErsatzTV</CFBundleDisplayName>
+        <CFBundleIdentifier>com.jasongdove.ersatztv</CFBundleIdentifier>
+        <CFBundlePackageType>APPL</CFBundlePackageType>
+        <CFBundleExecutable>launcher.sh</CFBundleExecutable>
+        <CFBundleIconFile>ErsatzTV.icns</CFBundleIconFile> 
+        <NSPrincipalClass>NSApplication</NSPrincipalClass>
+        <NSHighResolutionCapable>true</NSHighResolutionCapable>
     </PropertyGroup>
 
     <ItemGroup>
@@ -13,6 +25,7 @@
 
     <ItemGroup>
       <PackageReference Include="Blazored.LocalStorage" Version="4.1.5" />
+      <PackageReference Include="DotNet.Bundle" Version="0.9.13" />
       <PackageReference Include="FluentValidation" Version="10.3.6" />
       <PackageReference Include="FluentValidation.AspNetCore" Version="10.3.6" />
       <PackageReference Include="HtmlSanitizer" Version="6.0.453" />
@@ -59,4 +72,11 @@
       <EmbeddedResource Include="Resources\ISO-639-2_utf-8.txt" />
     </ItemGroup>
 
+    <ItemGroup>
+      <Content Include="..\artwork\Ersatztv.icns">
+        <Link>Ersatztv.icns</Link>
+        <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+      </Content>
+    </ItemGroup>
+
 </Project>

artwork/icns.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+IFS='.' read -ra ADDR <<< "$1"
+ICONSET=${ADDR[0]}.iconset
+mkdir $ICONSET
+sips -z 16 16     $1 --out $ICONSET/icon_16x16.png
+sips -z 32 32     $1 --out $ICONSET/icon_16x16@2x.png
+sips -z 32 32     $1 --out $ICONSET/icon_32x32.png
+sips -z 64 64     $1 --out $ICONSET/icon_32x32@2x.png
+sips -z 128 128   $1 --out $ICONSET/icon_128x128.png
+sips -z 256 256   $1 --out $ICONSET/icon_128x128@2x.png
+sips -z 256 256   $1 --out $ICONSET/icon_256x256.png
+sips -z 512 512   $1 --out $ICONSET/icon_256x256@2x.png
+sips -z 512 512   $1 --out $ICONSET/icon_512x512.png
+cp $1 $ICONSET/icon_512x512@2x.png
+iconutil -c icns $ICONSET
+rm -R $ICONSET
+

gon.json

@@ -0,0 +1,15 @@
+{
+  "source" : ["./release/ErsatzTV.app"],
+  "bundle_id" : "com.jasongdove.ersatztv",
+  "apple_id": {
+    "password":  "@env:AC_PASSWORD"
+  },
+  "sign" :{
+    "application_identity" : "C3BBCFB2D6851FF0DCA6CAC06A3EF1ECE71F9FFF",
+    "entitlements_file": "./scripts/macOS/ErsatzTV.entitlements"
+  },
+  "dmg" :{
+    "output_path":  "./release/ErsatzTV.dmg",
+    "volume_name":  "ErsatzTV"
+  }
+}

scripts/macOS/ErsatzTV.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.automation.apple-events</key>
+        <true/>
+    </dict>
+</plist>

scripts/macOS/launcher.sh

@@ -0,0 +1,9 @@
+#! /bin/sh
+
+# Set the working directory
+DIR=$(cd "$(dirname "$0")"; pwd)
+
+# Run the application
+echo "running from $DIR"
+
+open -a Terminal $DIR/ErsatzTV

scripts/macOS/sign.sh

@@ -0,0 +1,15 @@
+#! /bin/bash
+APP_NAME="release/ErsatzTV.app"
+ENTITLEMENTS="scripts/macOS/ErsatzTV.entitlements"
+SIGNING_IDENTITY="C3BBCFB2D6851FF0DCA6CAC06A3EF1ECE71F9FFF"
+
+find "$APP_NAME/Contents/MacOS/"|while read fname; do
+    if [[ -f $fname ]]; then
+        echo "[INFO] Signing $fname"
+        codesign --force --timestamp --options=runtime --entitlements "$ENTITLEMENTS" --sign "$SIGNING_IDENTITY" "$fname"
+    fi
+done
+
+echo "[INFO] Signing app file"
+
+codesign --force --timestamp --options=runtime --entitlements "$ENTITLEMENTS" --sign "$SIGNING_IDENTITY" "$APP_NAME"