Perform macOS code-signing

sfztools · Nov 14, 2020 · c7136b6 · c7136b6
1 parent 3cb80b4
commit c7136b6
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/scripts/appveyor/after_build.sh b/scripts/appveyor/after_build.sh
@@ -2,6 +2,30 @@
 set -ex
 
 make DESTDIR=${PWD}/${INSTALL_DIR} install
+
+# Perform code-signing
+if test -z "${CODESIGN_PASSWORD}"; then
+  echo "! Secrets not available, skip code-signing"
+else
+  # unlock the keychain
+  security unlock-keychain -p dummypasswd build.keychain
+  # code-sign VST3 and dylibs
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/VST3/sfizz.vst3
+  # code-sign AudioUnit and dylibs
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/Components/sfizz.component
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/Components/sfizz.component/Contents/Resources/plugin.vst3
+  # code-sign LV2 and dylibs (note: manual, LV2 are not real bundles)
+  codesign --sign "${CODESIGN_IDENTITY}" --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Binary/*.so
+  if ls "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Frameworks/*.dylib &> /dev/null; then
+    codesign --sign "${CODESIGN_IDENTITY}" --keychain build.keychain --verbose \
+             "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Frameworks/*.dylib
+  fi
+fi
+
 tar -zcvf "${INSTALL_DIR}.tar.gz" ${INSTALL_DIR}
 
 # Only release a tarball if there is a tag