Signing MacOS Binaries / App Store distribution

[emlynmac]

Hi,

As I understand, we don't have a signing method for jamulus currently.
I'm a macOS / iOS developer by trade and have the developer membership and I'd be willing to make the signing / App Store releases for jamulus moving forward if there is interest.

[ann0see]

Hi @emlynmac Thanks for volunteering!
Yes, Jamulus is currently not signed and iOS support is only in a very early stage. Personally, I'd really appreciate having a signed version of Jamulus! A few questions would arise on the signing topic :

How would this affect our release process? Would you need to compile, sign and upload Jamulus on your own? Could we integrate signing in our CI process? How can we ensure that you're releasing the official version (without malware, etc)?

[ann0see]

Can try it soon. So you‘re saying that this needs changes in the Qt source? Are you sure it’s not possible to add configuration parameters which set these entitlements?

[emlynmac]

After looking through the macdeployqt source, it looks for an entitlements file in the bundle. Now I've put that in place, the codesign finds it and uses it.

[ann0see]

Thanks for both links. Yes, the app seems to be signed now but audio isn’t working as you said. Can the entitlements file be added by qmake?

[emlynmac]

yes, the entitlements can be added - and found it seems.
So I have now a fully working / signed version of 3.8.0
https://upload.disroot.org/r/RkFDZ7hH#Ln/WujuCs0Czokpxt44ZKfx/d/2vtNaEfFmkAgTCqZM=

This does require making some changes to the build files and having the signing certificate handy, so I'll have to rebuild locally when it is release time.

I'll make a PR for the changes

[emlynmac]

PR: #1856

[ngocdh]

Thank you @emlynmac. I would love to see Jamulus on the App Store one day :)

[emlynmac]

Me too - let's see if I can make that happen....

[emlynmac]

I'm almost there - I have built a version that works, let's see if apple approve it for use.

[ann0see]

I see two next actions here:

1. Clarification of the App Store release with our "explanation"/"disclaimer" (can be delayed)
2. Signed macOS binaries (this is finished technically; however we haven’t clarified how @emlynmac can show that his binaries are trustworthy and only based on the code from this repo.) I don’t think there’s a need (yet) to include in into the CI process.

[gene96817]

For establishing the binaries published by @emlynmtac are trustworthy, a simple low-tech way is that we publish on jamulus.io the signature of the trusted code. Then if anyone cares, they can check that the code they receive through the Apple Store has the right signature.

[ann0see]

I doubt that’s possible since he needs to compile with a signing certificate —> hash gets invalid. Same with a normal non AppStore signed version of Jamulus

[gene96817]

1- Just take a convenient signature or hash.
2- posting the hash on Jamulus.io is a statement that we recognize that distribution.
3- provide instructions of how to validate (check) the hash. Some users know they should check but they don't know how.

[emlynmac]

I’ll have to set up some sort of signing from a branch in my fork of GitHub. I need to build with my signing certificate and then notarized with Apple

[ann0see]

Ok. So GH compiles it, we get the binaries (verify that the code is not different) and then upload it as official release?

[danryu]

Hi guys,

Not sure where you are at with this, but I managed to put some time into this recently.
After a lot of trial and error (and battling with the sparse Apple dev cli tool documentation) I finally have a working autobuild that generates:

• signed macOS pkg file for submission to MacOS App Store
• signed iOS ipa file for submission to iOS App Store

These files can then be submitted directly to the App Store via eg Transporter on macOS, and will appear within the app store submission build choices. Easy!

I built on the previous work by @ann0see and @emlynmac - please see changes in our fork at https://github.com/koord-live/koord-realtime.
most changes being in:
https://github.com/koord-live/koord-realtime/blob/kdev/ios/deploy_ios.sh
https://github.com/koord-live/koord-realtime/blob/kdev/.github/autobuild/ios.sh

Note: I had to move to macOS 11 to build for iOS, in order to use XCode 13.2.1 (13+ being necessary for SDK compatibility for App Store upload). Still with Qt 5.15.2 - I tried 6.0, 6.1 and 6.2 but with vague build failures in each case.

If there is interest in a PR I would be happy to do this - I have just merged from upstream master so it will be an easy merge.

Requirements:

1. Set up the following resources in in https://developer.apple.com/account/resources/certificates/list

Certificates:

• Mac Installer Distribution
• Mac App Distribution
• iOS Distribution

Identifier:

• app ID (bundleID)

Profile:

• iOS Distribution (AppStore) - ProvisioningProfile

2. Add certs + profile to Github Secrets as per
   https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development

3. Run the autobuild :)
   Signed IPA and PKG files are produced.

[emlynmac]

@danryu thanks for your work.
We currently have a means to push the signed macOS builds out via gitHub auto build on my fork - it would be nice to get the App Store sorted out too.

Can you make a PR for your work and I can look at it?

Please can you separate the steps into one for macOS App Store and one for iOS App Store?

Thanks!

[danryu]

Yes no problem, that should be straightforward.

[danryu]

For clarity I created 2 separate PRs:

• macOS signed for App Store: Automate signed pkg build for macOS App Store submission #2624
• iOS signed for App Store: Automate build of iOS signed ipa file for App Store submission #2625

The end product files in each case should pass all verification checks when uploading to App Store via eg Transporter.

[ann0see]

Great! Thank you very much. I think most of this is up to emlyn since he's the person distributing the signed app?