add macOS and windows installer (#1352)

1 files changed, 78 insertions, 15 deletions

diff --git a/bin/build-distribution-archives b/bin/build-distribution-archives
index 68dd46cf..2373c23a 100755
--- a/bin/build-distribution-archives
+++ b/bin/build-distribution-archives
@@ -1,27 +1,90 @@
-#!/bin/bash
-
 VERSION="$(echo ${GITHUB_REF} | sed -e 's|refs/heads/||' -e 's|refs/tags/||' -e 's|/|-|g')"
 OS="${BUILD:-$(uname)}"
-ARCH="$(uname -m)"
-
+mkdir artifacts
 if [ "$BUILD" = "osx" ]; then
-    cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch.app/Contents
-    cp -a icons locales print dist/inkstitch.app/Contents/MacOS
-    cp -a electron/build/mac dist/inkstitch.app/Contents/electron
+    cp -a icons locales print LICENSE VERSION images/examples palettes symbols fonts inx dist/inkstitch.app/Contents/Resources
     rm -rf dist/inkstitch/
+    temp_path="/tmp/inkstitch/"
+    # inside the scripts folder are:
+    # - preinstaller (checks for previously installed inkstitch and deletes it) and
+    # - postinstaller (moves inkstitch folder from /tmp to user Inkscape extensions folder in $HOME)
+    # The postinstaller is a workaround for a proper way to install in user $HOME space
+
+    # Build on GitHub will be handled differently from local builds.
+    # Local builds will not be signed nor notarized. They are run to produce releases for legacy versions of macOS.
+    # Notarization for development branches can be forced with this variable set to true
+    NOTARIZE_DEVELOPMENT_BUILDS=false
+
+    if [[ ! -z "${GITHUB_REF}" ]]; then
+        # This code signs and notarize the inkstitch.app
+        DEV_IDENT="Developer ID Application: Lex Neva (929A568N58)"
+        echo "Signing of inkstitch.app"
+        # Coyping inkstitch-gui.app into inkstitch
+        ditto electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        # signing the binary may fix notary issue
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app/Contents/MacOS/inkstitch -v
+        # last signing before packaging
+        /usr/bin/codesign -s "${DEV_IDENT}" \
+                        --deep \
+                        --force \
+                        --entitlements installer_scripts/entitlements.plist \
+                        -o runtime \
+                        --timestamp \
+                        dist/inkstitch.app -v
+        echo "Running pkgbuild"
+        INSTALLER_IDENT="Developer ID Installer: Lex Neva (929A568N58)"
+        /usr/bin/pkgbuild --root dist/inkstitch.app \
+                        -s "${INSTALLER_IDENT}" \
+                        --component-plist installer_scripts/inkstitch.plist \
+                        --ownership recommended \
+                        --identifier org.inkstitch.installer \
+                        --version ${VERSION} \
+                        --scripts installer_scripts/scripts \
+                        --install-location ${temp_path}inkstitch.app \
+                        artifacts/inkstitch-${VERSION}-${OS}.pkg
+        if [[ "${GITHUB_REF}" =~ ^refs/tags/v[0-9.]+$ || $NOTARIZE_DEVELOPMENT_BUILDS == true ]]; then
+            echo "Notary starting"
+            bash bin/notarize-app "929A568N58" \
+                                "${NOTARY_ACCOUNT}" \
+                                "${NOTARY_PASSWORD}" \
+                                "org.inkstitch.app" \
+                                artifacts/inkstitch-${VERSION}-${OS}.pkg
+        fi
+    else
+        # local builds will not be signed or notarized
+        cp -a electron/build/mac dist/inkstitch.app/Contents/MacOS/electron
+        pkgbuild --root dist/inkstitch.app \
+                --component-plist installer_scripts/inkstitch.plist \
+                --ownership recommended \
+                --identifier org.inkstitch.installer \
+                --version ${VERSION} \
+                --scripts installer_scripts/scripts \
+                --install-location ${temp_path}inkstitch.app \
+                artifacts/inkstitch-${VERSION}-${OS}.pkg
+    fi
 else
     cp -a images/examples palettes symbols fonts inx LICENSE VERSION dist/inkstitch
     cp -a icons locales print dist/inkstitch/bin
     cp -a electron/build/*-unpacked dist/inkstitch/electron
+
 fi
 
-mkdir artifacts
-cd dist
+if [ "$BUILD" = "windows" ]; then
+    # build the installer locally
+    # remotely it will be called through build.yml after signing
+    if [[ -z "${GITHUB_REF}" ]]; then
+        bash bin/build-windows-installer
+    fi
+fi
 
-if [ "$$BUILD" = "windows" ]; then
-    # The python zipfile command line utility can't handle directories
-    # containing files with UTF-8 names on Windows, so we use 7-zip instead.
-    7z a ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
-else
-	  python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+if [ "$BUILD" = "linux" ]; then
+    cd dist
+    python -m zipfile -c ../artifacts/inkstitch-${VERSION}-${OS}.zip *;
+    cd ..
 fi