add macOS and windows installer (#1352)

24 files changed, 383 insertions, 35 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ba294865..713aac19 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,7 +15,7 @@ jobs:
           submodules: recursive
       - uses: actions/setup-python@v2
         with:
-          python-version: '3.9.x'
+          python-version: '3.8.5'
       - uses: actions/setup-node@v1
         with:
           node-version: '16.x'
@@ -114,6 +114,20 @@ jobs:
           make dist
         env:
           BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'dist'
+          recursive: true
+      - shell: bash
+        run: |
+          bash bin/build-windows-installer
+        env:
+          BUILD: windows
+      - uses: dlemstra/code-sign-action@v1
+        with:
+          certificate: '${{ secrets.INKSTITCH_CODE_SIGNING_CERTIFICATE }}'
+          folder: 'artifacts'
       - uses: actions/upload-artifact@v2
         with:
           name: inkstitch-windows
@@ -150,9 +164,11 @@ jobs:
           pip install wheel
           pip install PyGObject
           pip install git+https://github.com/gtaylor/python-colormath
-
           pip install -r requirements.txt
-          pip install pyinstaller==4.3
+          # with --no-binary argument may fix notary issues as well shapely speedups error issue
+          pip install -U lxml --no-binary lxml
+          pip install -U Shapely==1.7.1 --no-binary Shapely
+          pip install pyinstaller
 
           echo "${{ env.pythonLocation }}/bin" >> $GITHUB_PATH
       - shell: bash
@@ -160,6 +176,15 @@ jobs:
           make dist
         env:
           BUILD: osx
+          MACOS_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.INKSTITCH_APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PWD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          INSTALLER_CERTIFICATE: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE }}
+          INSTALLER_PWD: ${{ secrets.INKSTITCH_APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
+          NOTARY_ACCOUNT: ${{ secrets.INKSTITCH_NOTARIZE_AC }}
+          NOTARY_PASSWORD: ${{ secrets.INKSTITCH_NOTARIZE_PASS }}
+
+
       - uses: actions/upload-artifact@v2
         with:
           name: inkstitch-mac
@@ -212,3 +237,5 @@ jobs:
           title: "${{env.title}}"
           files: |
             artifacts/*.zip
+            artifacts/*.exe
+            artifacts/*.pkg
diff --git a/.gitignore b/.gitignore
index 55880ed1..295cba7b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,4 +17,4 @@ locales/
 /.idea
 /VERSION
 /src/
-.DS_Store
+.DS_STORE
\ No newline at end of file
diff --git a/Makefile b/Makefile
index e75308d3..2ed80a17 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,10 @@
-
 dist: version locales inx
 	bash bin/build-python
 	bash bin/build-electron
 	bash bin/build-distribution-archives
 
 distclean:
-	rm -rf build dist inx locales *.spec *.tar.gz *.zip electron/node_modules electron/dist
+	rm -rf build dist inx locales artifacts win mac *.spec *.tar.gz *.zip electron/node_modules electron/dist
 
 .PHONY: inx
 inx: version locales
diff --git a/bin/build-distribution-archives b/bin/build-distribution-archives
index 68dd46cf..2373c23a 100755
--- a/bin/build-distribution-archives
+++ b/bin/build-distribution-archives
@@ -1,27 +1,90 @@
-#!/bin/bash
-
 VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
 OS="${BUILD:-$(uname)}"
-ARCH="$(uname -m)"
-
+mkdir artifacts
 if [ "$BUILD" = "osx" ]; then
-    cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch.app/Contents
-    cp -a icons locales print dist/inkstitch.app/Contents/MacOS
-    cp -a electron/build/mac dist/inkstitch.app/Contents/electron
+    cp -a icons locales print LICENSE VERSION images/examples palettes symbols fonts inx dist/inkstitch.app/Contents/Resources
     rm -rf dist/inkstitch/
+    temp_path="/tmp/inkstitch/"
+    # inside the scripts folder are:
+    # - preinstaller (checks for previously installed inkstitch and deletes it) and
+    # - postinstaller (moves inkstitch folder from /tmp to user Inkscape extensions folder in $HOME)
+    # The postinstaller is a workaround for a proper way to install in user $HOME space
+
+    # Build on GitHub will be handled differently from local builds.
+    # Local builds will not be signed nor notarized. They are run to produce releases for legacy versions of macOS.
+    # Notarization for development branches can be forced with this variable set to true
+    NOTARIZE_DEVELOPMENT_BUILDS=false
+
+    if [[ ! -z "${GITHUB_REF}" ]]; then
+        # This code signs and notarize the inkstitch.app
+        DEV_IDENT="Developer ID Application: Lex Neva (929A568N58)"
+        echo "Signing of inkstitch.app"
+        # Coyping inkstitch-gui.app into inkstitch
+        ditto electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        # signing the binary may fix notary issue
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app/Contents/MacOS/inkstitch -v
+        # last signing before packaging
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app -v
+        echo "Running pkgbuild"
+        INSTALLER_IDENT="Developer ID Installer: Lex Neva (929A568N58)"
+        /usr/bin/pkgbuild --root dist/inkstitch.app \
+                        -s "${INSTALLER_IDENT}" \
+                        --component-plist installer_scripts/inkstitch.plist \
+                        --ownership recommended \
+                        --identifier org.inkstitch.installer \
+                        --version ${VERSION} \
+                        --scripts installer_scripts/scripts \
+                        --install-location ${temp_path}inkstitch.app \
+                        artifacts/inkstitch-${VERSION}-${OS}.pkg
+        if [[ "${GITHUB_REF}" =~ ^refs/tags/v[0-9.]+$ || $NOTARIZE_DEVELOPMENT_BUILDS == true ]]; then
+            echo "Notary starting"
+            bash bin/notarize-app "929A568N58" \
+                                "${NOTARY_ACCOUNT}" \
+                                "${NOTARY_PASSWORD}" \
+                                "org.inkstitch.app" \
+                                artifacts/inkstitch-${VERSION}-${OS}.pkg
+        fi
+    else
+        # local builds will not be signed or notarized
+        cp -a electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        pkgbuild --root dist/inkstitch.app \
+                --component-plist installer_scripts/inkstitch.plist \
+                --ownership recommended \
+                --identifier org.inkstitch.installer \
+                --version ${VERSION} \
+                --scripts installer_scripts/scripts \
+                --install-location ${temp_path}inkstitch.app \
+                artifacts/inkstitch-${VERSION}-${OS}.pkg
+    fi
 else
     cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch
     cp -a icons locales print dist/inkstitch/bin
     cp -a electron/build/*-unpacked dist/inkstitch/electron
+
 fi
 
-mkdir artifacts
-cd dist
+if [ "$BUILD" = "windows" ]; then
+    # build the installer locally
+    # remotely it will be called through build.yml after signing
+    if [[ -z "${GITHUB_REF}" ]]; then
+        bash bin/build-windows-installer
+    fi
+fi
 
-if [ "$$BUILD" = "windows" ]; then
-    # The python zipfile command line utility can't handle directories
-    # containing files with UTF-8 names on Windows, so we use 7-zip instead.
-    7z a ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
-else
-	  python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+if [ "$BUILD" = "linux" ]; then
+    cd dist
+    python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+    cd ..
 fi
diff --git a/bin/build-electron b/bin/build-electron
index 11616cb4..f375e347 100755
--- a/bin/build-electron
+++ b/bin/build-electron
@@ -8,6 +8,7 @@ if [ "$BUILD" = "windows" ]; then
 elif [ "$BUILD" = "linux" ]; then
   args="-l --x64"
 elif [ "$BUILD" = "osx" ]; then
+  cp installer_scripts/electron-entitlements.plist electron/build/
   args="-m"
 fi
 
diff --git a/bin/build-python b/bin/build-python
index 88e166ae..5d16cdf8 100755
--- a/bin/build-python
+++ b/bin/build-python
@@ -36,6 +36,16 @@ pyinstaller_args+="-p inkscape/share/extensions "
 # output useful debugging info that helps us trace library dependency issues
 pyinstaller_args+="--log-level DEBUG "
 
+# This adds bundle identifier in reverse DSN format for macos
+if [ "$BUILD" = "osx" ]; then
+    pyinstaller_args+="--osx-bundle-identifier org.inkstitch.app "
+    if [[ -z ${GITHUB_REF} ]]; then
+        :
+    else
+        bash bin/import-macos-keys
+    fi
+fi
+
 if [ "$BUILD" = "windows" ]; then
     python -m PyInstaller $pyinstaller_args inkstitch.py
 else
diff --git a/bin/build-windows-installer b/bin/build-windows-installer
new file mode 100644
index 00000000..44c29742
--- /dev/null
+++ b/bin/build-windows-installer
@@ -0,0 +1,15 @@
+#!/bin/bash
+VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
+OS="${BUILD:-$(uname)}"
+# Create windows installer
+mkdir win
+cp installer_scripts/template.iss win/win_build.iss
+# adds the year and version to the inno installer
+info_year=$( date "+%Y" )
+copyright_year="#define COPYRIGHT \""${info_year}"\" + URL"
+version_block="#define VERSION \""${VERSION}"\""
+sed -i'' -e '/;inkstitch-year/ a\'$'\n'"${copyright_year}"'' win/win_build.iss
+sed -i'' -e '/;inkstitch-version/ a\'$'\n'"${version_block}"'' win/win_build.iss
+
+iscc win/win_build.iss
+mv  win/inkstitch.exe artifacts/inkstitch-${VERSION}-${OS}.exe
diff --git a/bin/import-macos-keys b/bin/import-macos-keys
new file mode 100644
index 00000000..2fa55f89
--- /dev/null
+++ b/bin/import-macos-keys
@@ -0,0 +1,12 @@
+#!/bin/bash
+# first part of codesiging which is importing to build keychain
+echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+security create-keychain -p "$KEYCHAIN_PWD" build.keychain
+security default-keychain -s build.keychain
+security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
+security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain
+# importing notary certificate
+echo $INSTALLER_CERTIFICATE | base64 --decode > installer-certificate.p12
+security import installer-certificate.p12 -k build.keychain -P "$INSTALLER_PWD" -T /usr/bin/pkgbuild
+security set-key-partition-list -S apple-tool:,apple:,pkgbuild: -s -k "$KEYCHAIN_PWD" build.keychain
diff --git a/bin/notarize-app b/bin/notarize-app
new file mode 100644
index 00000000..4a2bbc41
--- /dev/null
+++ b/bin/notarize-app
@@ -0,0 +1,46 @@
+#!/bin/sh -u
+# source of this code: https://github.com/rednoah/notarize-app
+ASC_PROVIDER="$1"
+ASC_USERNAME="$2"
+ASC_PASSWORD="$3"
+
+BUNDLE_ID="$4"
+BUNDLE_PKG="$5"
+
+
+# create temporary files
+NOTARIZE_APP_LOG=$(mktemp -t notarize-app)
+NOTARIZE_INFO_LOG=$(mktemp -t notarize-info)
+
+# delete temporary files on exit
+function finish {
+	rm "$NOTARIZE_APP_LOG" "$NOTARIZE_INFO_LOG"
+}
+trap finish EXIT
+
+
+# submit app for notarization
+if xcrun altool --notarize-app --primary-bundle-id "$BUNDLE_ID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" -f "$BUNDLE_PKG" > "$NOTARIZE_APP_LOG" 2>&1; then
+	cat "$NOTARIZE_APP_LOG"
+	RequestUUID=$(awk -F ' = ' '/RequestUUID/ {print $2}' "$NOTARIZE_APP_LOG")
+
+	# check status periodically
+	while sleep 60 && date; do
+		# check notarization status
+		if xcrun altool --notarization-info "$RequestUUID" --asc-provider "$ASC_PROVIDER" --username "$ASC_USERNAME" --password "$ASC_PASSWORD" > "$NOTARIZE_INFO_LOG" 2>&1; then
+			cat "$NOTARIZE_INFO_LOG"
+
+			# once notarization is complete, run stapler and exit
+			if ! grep -q "Status: in progress" "$NOTARIZE_INFO_LOG"; then
+				xcrun stapler staple "$BUNDLE_PKG"
+				exit $?
+			fi
+		else
+			cat "$NOTARIZE_INFO_LOG" 1>&2
+			exit 1
+		fi
+	done
+else
+	cat "$NOTARIZE_APP_LOG" 1>&2
+	exit 1
+fi
diff --git a/electron/build/icons/mac/inkstitch.icns b/electron/build/icons/mac/inkstitch.icns
index b5a05fbc..019d2c02 100644
--- a/electron/build/icons/mac/inkstitch.icns
+++ b/electron/build/icons/mac/inkstitch.icns
diff --git a/electron/package.json b/electron/package.json
index cc184dcf..8d823192 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -28,7 +28,11 @@
     },
     "mac": {
       "icon": "build/icons/mac/inkstitch.icns",
-      "target": "dir"
+      "target": "dir",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/electron-entitlements.plist",
+      "entitlementsInherit": "build/electron-entitlements.plist"
     }
   },
   "keywords": [],
@@ -77,7 +81,7 @@
     "devtron": "^1.4.0",
     "easygettext": "^2.7.0",
     "electron": "4.1.3",
-    "electron-builder": "^20.39.0",
+    "electron-builder": "22.8.0",
     "electron-debug": "^1.5.0",
     "electron-devtools-installer": "^2.2.4",
     "electron-prebuilt-compile": "4.0.0",
diff --git a/installer_scripts/electron-entitlements.plist b/installer_scripts/electron-entitlements.plist
new file mode 100644
index 00000000..9b6c3eb6
--- /dev/null
+++ b/installer_scripts/electron-entitlements.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+  </dict>
+</plist>
diff --git a/installer_scripts/entitlements.plist b/installer_scripts/entitlements.plist
new file mode 100644
index 00000000..f0b6f5b0
--- /dev/null
+++ b/installer_scripts/entitlements.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+        <true/>
+        <key>com.apple.security.cs.disable-library-validation</key>
+        <true/>
+</dict>
+</plist>
diff --git a/installer_scripts/inkstitch.plist b/installer_scripts/inkstitch.plist
new file mode 100644
index 00000000..8d102d1f
--- /dev/null
+++ b/installer_scripts/inkstitch.plist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<array>
+	<dict>
+		<key>BundleHasStrictIdentifier</key>
+		<false/>
+		<key>BundleIsRelocatable</key>
+		<false/>
+		<key>BundleIsVersionChecked</key>
+		<false/>
+		<key>BundleOverwriteAction</key>
+		<string>install</string>
+		<key>RootRelativeBundlePath</key>
+		<string>Contents/MacOS/electron/inkstitch-gui.app</string>
+	</dict>
+</array>
+</plist>
diff --git a/installer_scripts/scripts/postinstall b/installer_scripts/scripts/postinstall
new file mode 100755
index 00000000..687f5149
--- /dev/null
+++ b/installer_scripts/scripts/postinstall
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+mv /tmp/inkstitch/ $HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/
+echo "Inkstitch was moved!"
+exit 0
diff --git a/installer_scripts/scripts/preinstall b/installer_scripts/scripts/preinstall
new file mode 100755
index 00000000..40187fb3
--- /dev/null
+++ b/installer_scripts/scripts/preinstall
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+inkstitch_folder=($HOME/Library/Application\ Support/org.inkscape.Inkscape/config/inkscape/extensions/inkstitch)
+if [[ -L "${inkstitch_folder}" ]]; then
+	unlink "${inkstitch_folder}"
+	echo "Unlinking manual install, to avoid damaging user local repository."
+else
+	rm -rf "${inkstitch_folder}"
+	echo "Removing previous Ink/Stitch installation."
+fi
+exit 0
diff --git a/installer_scripts/template.iss b/installer_scripts/template.iss
new file mode 100755
index 00000000..a949a419
--- /dev/null
+++ b/installer_scripts/template.iss
@@ -0,0 +1,84 @@
+#define PROGRAMNAME "Ink/Stitch"

+;inkstitch-version

+#define AppId "org.inkstitch.app"

+#define MyAppPublisher "Inkstitch Open Source Community"

+#define URL "https://inkstitch.org/"

+;inkstitch-year

+#define PATHTODIST "..\dist"

+#define INXPATH "..\inx"

+[Setup]

+; NOTE: The value of AppId uniquely identifies this application. Do not use the same AppId value in installers for other applications.

+; (To generate a new GUID, click Tools | Generate GUID inside the IDE.)

+

+LanguageDetectionMethod=uilanguage

+;AppId={{C78E6C6F-C47E-4319-AF5A-E71387AE2D4E}

+AppId={#AppId}

+AppName={#PROGRAMNAME}

+AppVersion={#VERSION}

+;AppVerName={#MyAppName} {#MyAppVersion}

+AppPublisherURL={#URL}

+AppSupportURL={#URL}

+AppUpdatesURL={#URL}

+DefaultDirName={userappdata}\inkscape\extensions\

+DefaultGroupName={#PROGRAMNAME}

+; Remove the following line to run in administrative install mode (install for all users.)

+ArchitecturesAllowed=x64

+PrivilegesRequired=lowest

+OutputBaseFilename=inkstitch

+OutputDir=.

+Compression=lzma

+SolidCompression=yes

+VersionInfoCompany={#URL}

+VersionInfoCopyright=Copyright (C) {#COPYRIGHT}

+VersionInfoDescription=An open-source machine embroidery design platform based on Inkscape.

+VersionInfoTextVersion={#VERSION}

+WizardStyle=modern

+ShowLanguageDialog=no

+

+[Languages]

+Name: "english"; MessagesFile: "compiler:Default.isl"

+Name: "armenian"; MessagesFile: "compiler:Languages\Armenian.isl"

+Name: "brazilian"; MessagesFile: "compiler:Languages\BrazilianPortuguese.isl"

+Name: "catalan"; MessagesFile: "compiler:Languages\Catalan.isl"

+Name: "corsican"; MessagesFile: "compiler:Languages\Corsican.isl"

+Name: "czech"; MessagesFile: "compiler:Languages\Czech.isl"

+Name: "danish"; MessagesFile: "compiler:Languages\Danish.isl"

+Name: "german"; MessagesFile: "compiler:Languages\German.isl"

+Name: "hebrew"; MessagesFile: "compiler:Languages\Hebrew.isl"

+Name: "icelandic"; MessagesFile: "compiler:Languages\Icelandic.isl"

+Name: "norwegian"; MessagesFile: "compiler:Languages\Norwegian.isl"

+Name: "polish"; MessagesFile: "compiler:Languages\Polish.isl"

+Name: "portuguese"; MessagesFile: "compiler:Languages\Portuguese.isl"

+Name: "spanish"; MessagesFile: "compiler:Languages\Spanish.isl"

+Name: "finnish"; MessagesFile: "compiler:Languages\Finnish.isl"

+Name: "french"; MessagesFile: "compiler:Languages\French.isl"

+Name: "italian"; MessagesFile: "compiler:Languages\Italian.isl"

+Name: "japanese"; MessagesFile: "compiler:Languages\Japanese.isl"

+Name: "dutch"; MessagesFile: "compiler:Languages\Dutch.isl"

+Name: "russian"; MessagesFile: "compiler:Languages\Russian.isl"

+Name: "slovak"; MessagesFile: "compiler:Languages\Slovak.isl"

+Name: "slovenian"; MessagesFile: "compiler:Languages\Slovenian.isl"

+Name: "turkish"; MessagesFile: "compiler:Languages\Turkish.isl"

+Name: "ukrainian"; MessagesFile: "compiler:Languages\Ukrainian.isl"

+

+[Types]

+Name: "English"; Description: "English";

+

+[Files]

+Source: "{#PATHTODIST}\inkstitch\*"; DestDir: "{app}\inkstitch\inkstitch"; Flags: ignoreversion recursesubdirs createallsubdirs

+; NOTE: Don't use "Flags: ignoreversion" on any shared system files 

+[Code]

+

+function InitializeSetup(): Boolean;

+begin

+  Result := True;

+  if RegKeyExists(HKEY_LOCAL_MACHINE,

+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') or

+     RegKeyExists(HKEY_CURRENT_USER,

+       'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{#AppId}_is1') then

+  begin

+    MsgBox('The application is installed already.', mbInformation, MB_OK);

+    Result := False;

+  end;

+end;

+

diff --git a/lib/extensions/print_pdf.py b/lib/extensions/print_pdf.py
index e5cb25d8..97a806a7 100644
--- a/lib/extensions/print_pdf.py
+++ b/lib/extensions/print_pdf.py
@@ -73,7 +73,10 @@ class PrintPreviewServer(Thread):
 
     def __set_resources_path(self):
         if getattr(sys, 'frozen', False):
-            self.resources_path = os.path.join(sys._MEIPASS, 'print', 'resources')
+            if sys.platform == "darwin":
+                self.resources_path = os.path.join(sys._MEIPASS, "..", 'Resources', 'print', 'resources')
+            else:
+                self.resources_path = os.path.join(sys._MEIPASS, 'print', 'resources')
         else:
             self.resources_path = os.path.realpath(os.path.join(os.path.dirname(__file__), '..', '..', 'print', 'resources'))
 
@@ -183,7 +186,10 @@ class PrintPreviewServer(Thread):
 class Print(InkstitchExtension):
     def build_environment(self):
         if getattr(sys, 'frozen', False):
-            print_dir = os.path.join(sys._MEIPASS, "print")
+            if sys.platform == "darwin":
+                print_dir = os.path.join(sys._MEIPASS, "..", 'Resources', "print")
+            else:
+                print_dir = os.path.join(sys._MEIPASS, "print")
         else:
             print_dir = os.path.realpath(os.path.join(os.path.dirname(__file__), "..", "..", "print"))
 
diff --git a/lib/gui/electron.py b/lib/gui/electron.py
index dcf03c6f..651080a9 100644..100755
--- a/lib/gui/electron.py
+++ b/lib/gui/electron.py
@@ -22,7 +22,7 @@ def open_url(url):
         electron_path = os.path.join(get_bundled_dir("electron"), "inkstitch-gui")
 
         if sys.platform == "darwin":
-            electron_path += ".app/Contents/MacOS/inkstitch-gui"
+            electron_path = os.path.join(sys._MEIPASS, "electron", "inkstitch-gui.app", "Contents", "MacOS", "inkstitch-gui")
             command = ["open", "-W", "-a", electron_path, "--args", url]
         else:
             command = [electron_path, url]
@@ -32,5 +32,18 @@ def open_url(url):
         cwd = get_bundled_dir("electron")
 
     # Any output on stdout will crash inkscape.
-    with open(os.devnull, 'w') as null:
-        return subprocess.Popen(command, cwd=cwd, stdout=null)
+    # In macos manual install the python env paths are incomplete
+    # Adding the yarn path to the env paths fixes this issue
+    if sys.platform == "darwin" and getattr(sys, 'frozen', None) is None:
+        mac_dev_env = os.environ.copy()
+        # these are paths installed by brew or macports
+        yarn_path = "/usr/local/bin:/opt/local/bin:"
+        if yarn_path in mac_dev_env["PATH"]:
+            pass
+        else:
+            mac_dev_env["PATH"] = yarn_path + mac_dev_env["PATH"]
+        with open(os.devnull, 'w') as null:
+            return subprocess.Popen(command, cwd=cwd, stdout=null, env=mac_dev_env)
+    else:
+        with open(os.devnull, 'w') as null:
+            return subprocess.Popen(command, cwd=cwd, stdout=null)
diff --git a/lib/i18n.py b/lib/i18n.py
index 37972e36..204381dc 100644
--- a/lib/i18n.py
+++ b/lib/i18n.py
@@ -30,7 +30,10 @@ def _set_locale_dir():
     else:
         locale_dir = dirname(dirname(realpath(__file__)))
 
-    locale_dir = os.path.join(locale_dir, 'locales')
+    if sys.platform == "darwin":
+        locale_dir = os.path.join(locale_dir, "..", 'Resources', 'locales')
+    else:
+        locale_dir = os.path.join(locale_dir, 'locales')
 
 
 def localize(languages=None):
diff --git a/lib/inx/utils.py b/lib/inx/utils.py
index acee88ad..31da518e 100644..100755
--- a/lib/inx/utils.py
+++ b/lib/inx/utils.py
@@ -35,8 +35,8 @@ def build_environment():
             env.globals["command_tag"] = '<command location="inx">../bin/inkstitch.exe</command>'
             env.globals["image_path"] = '../bin/icons/'
         elif sys.platform == "darwin":
-            env.globals["command_tag"] = '<command location="inx">../MacOS/inkstitch</command>'
-            env.globals["image_path"] = '../MacOS/icons/'
+            env.globals["command_tag"] = '<command location="inx">../../MacOS/inkstitch</command>'
+            env.globals["image_path"] = '../../Resources/icons/'
         else:
             env.globals["command_tag"] = '<command location="inx">../bin/inkstitch</command>'
             env.globals["image_path"] = '../bin/icons/'
diff --git a/lib/utils/paths.py b/lib/utils/paths.py
index 938c5f33..2a95f6e7 100644..100755
--- a/lib/utils/paths.py
+++ b/lib/utils/paths.py
@@ -10,13 +10,19 @@ from os.path import dirname, realpath
 
 def get_bundled_dir(name):
     if getattr(sys, 'frozen', None) is not None:
-        return realpath(os.path.join(sys._MEIPASS, "..", name))
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
+            return realpath(os.path.join(sys._MEIPASS, "..", name))
     else:
         return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))
 
 
 def get_resource_dir(name):
     if getattr(sys, 'frozen', None) is not None:
-        return realpath(os.path.join(sys._MEIPASS, name))
+        if sys.platform == "darwin":
+            return realpath(os.path.join(sys._MEIPASS, "..", 'Resources', name))
+        else:
+            return realpath(os.path.join(sys._MEIPASS, name))
     else:
         return realpath(os.path.join(dirname(realpath(__file__)), '..', '..', name))
diff --git a/lib/utils/version.py b/lib/utils/version.py
index 2186ca23..0b46669a 100644..100755
--- a/lib/utils/version.py
+++ b/lib/utils/version.py
@@ -11,7 +11,10 @@ from ..i18n import _
 
 def get_inkstitch_version():
     if getattr(sys, 'frozen', False) and hasattr(sys, '_MEIPASS'):
-        version = realpath(join(sys._MEIPASS, "..", "VERSION"))
+        if sys.platform == "darwin":
+            version = realpath(join(sys._MEIPASS, "..", 'Resources', "VERSION"))
+        else:
+            version = realpath(join(sys._MEIPASS, "..", "VERSION"))
     else:
         version = realpath(join(realpath(__file__), "..", "..", "..", 'VERSION'))
     if isfile(version):
diff --git a/templates/embroider_settings.xml b/templates/embroider_settings.xml
index 09af05fb..96339fcb 100644
--- a/templates/embroider_settings.xml
+++ b/templates/embroider_settings.xml
@@ -12,7 +12,7 @@
     <param name="output_settings" type="description" appearance="header">
         Output Settings
     </param>
-    <param name="collapse_len_mm" type="float" precision="1" min="0" max="10" 
+    <param name="collapse_len_mm" type="float" precision="1" min="0" max="10"
            gui-text="Collapse length (mm)"
            gui-description="Jump stitches smaller than this will be treated as normal stitches.">3</param>
     <script>