Create apple dmg file

GerryFerdinandus · GerryFerdinandus · commit 40b875548dcc · 2024-12-14T12:45:02.000+01:00
Use dmg file as installer file.
Don't use zip file anymore for macOS.
diff --git a/.github/workflows/cicd_macos.yaml b/.github/workflows/cicd_macos.yaml
@@ -17,10 +17,11 @@ jobs:
     timeout-minutes: 60
     env:
       LAZBUILD_WITH_PATH: /Applications/Lazarus/lazbuild
-      RELEASE_ZIP_FILE: trackereditor_macOS_amd64.zip
       MACOS_APP: enduser/trackereditor.app
-      LAZ_OPT: --widgetset=cocoa
+      PROGRAM_NAME_WITH_PATH: 'enduser/trackereditor'
       BUILD_WITH_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
+      PROJECT_LPI: source/project/tracker_editor/trackereditor.lpi
+      RELEASE_DMG_FILE: trackereditor_macOS_universal.dmg
 
     steps:
     - uses: actions/checkout@v4
@@ -30,24 +31,54 @@ jobs:
     - name: Install Lazarus IDE
       run: brew install --cask lazarus
 
-    - name: Build Release version
-      # Build trackereditor project (Release mode)
-      run: ${{ env.LAZBUILD_WITH_PATH }} --build-all --build-mode=Release ${{ env.LAZ_OPT }} source/project/tracker_editor/trackereditor.lpi
+    - name: Install Create dmg
+      run: brew install create-dmg
+
+    - name: Build trackereditor app for Apple silicon (aarch64)
+      run: |
+        ${{ env.LAZBUILD_WITH_PATH }} --build-all --build-mode=Release --widgetset=cocoa --cpu=aarch64 ${{ env.PROJECT_LPI }}
+        cp -a ${{ env.PROGRAM_NAME_WITH_PATH }} ${{ env.PROGRAM_NAME_WITH_PATH }}-aarch64
+      shell: bash
+
+    - name: Build trackereditor app for Intel Mac version (x86_64)
+      run: |
+        ${{ env.LAZBUILD_WITH_PATH }} --build-all --build-mode=Release --widgetset=cocoa --cpu=x86_64 ${{ env.PROJECT_LPI }}
+        cp -a ${{ env.PROGRAM_NAME_WITH_PATH }} ${{ env.PROGRAM_NAME_WITH_PATH }}-x86_64
+      shell: bash
+
+    - name: Create a Universal macOS binary from aarch64 and x86_64
+      run: |
+        # remove the previeus binary build
+        rm -f ${{ env.PROGRAM_NAME_WITH_PATH }}
+
+        # Create a new Universal macOS binary
+        lipo -create -output ${{ env.PROGRAM_NAME_WITH_PATH }} ${{ env.PROGRAM_NAME_WITH_PATH }}-aarch64 ${{ env.PROGRAM_NAME_WITH_PATH }}-x86_64
+
+        # Remove this single binary build. Not needed any more.
+        rm -f ${{ env.PROGRAM_NAME_WITH_PATH }}-aarch64
+        rm -f ${{ env.PROGRAM_NAME_WITH_PATH }}-x86_64
+      shell: bash
+
+    - name: Extract latest program version from metainfo and update the Info.plist with it
+      env:
+        METAINFO_FILE: metainfo/io.github.gerryferdinandus.bittorrent-tracker-editor.metainfo.xml
+      run: |
+       TRACKER_EDITOR_VERSION=$(xmllint --xpath "string(/component/releases/release[1]/@version)" $METAINFO_FILE)
+       echo Program version: $TRACKER_EDITOR_VERSION
+       plutil -replace CFBundleShortVersionString -string $TRACKER_EDITOR_VERSION ${{ env.MACOS_APP }}/Contents/Info.plist
       shell: bash
 
     - name: Move program and icon into macOS .app
       env:
         ICON_FILE: 'metainfo/io.github.gerryferdinandus.bittorrent-tracker-editor.png'
-        PROGRAM_NAME_WITH_PATH: 'enduser/trackereditor'
       run: |
-        # remove the path
-        PROGRAM_NAME_ONLY=$(basename -- "$PROGRAM_NAME_WITH_PATH")
+        PROGRAM_NAME_ONLY=$(basename -- "${{ env.PROGRAM_NAME_WITH_PATH }}")
 
         # ------ Move program to app
-        # remove symbolic link in app. Need real program here.
-        rm -f "${PROGRAM_NAME_WITH_PATH}.app/Contents/MacOS/${PROGRAM_NAME_ONLY}"
+        # remove the previeus app version
+        rm -f "${{ env.MACOS_APP }}/Contents/MacOS/${PROGRAM_NAME_ONLY}"
         # copy the program to the app version.
-        mv -f "${PROGRAM_NAME_WITH_PATH}" "${PROGRAM_NAME_WITH_PATH}.app/Contents/MacOS"
+        mv -f "${{ env.PROGRAM_NAME_WITH_PATH }}" "${{ env.MACOS_APP }}/Contents/MacOS"
 
         # ------ Create icon set and move it into the app
         iconset_folder="temp_folder.iconset"
@@ -65,17 +96,29 @@ jobs:
         rm -r "${iconset_folder}"
 
         # move icon file to the app
-        mv -f "iconfile.icns"  "${PROGRAM_NAME_WITH_PATH}.app/Contents/Resources"
+        mv -f "iconfile.icns"  "${{ env.MACOS_APP }}/Contents/Resources"
 
         # add icon to plist xml file CFBundleIconFile = "iconfile"
-        plutil -insert CFBundleIconFile -string "iconfile" "${PROGRAM_NAME_WITH_PATH}.app/Contents/Info.plist"
+        plutil -insert CFBundleIconFile -string "iconfile" "${{ env.MACOS_APP }}/Contents/Info.plist"
+      shell: bash
+
+    - name: Check CPU type generated by Lazbuild
+      run: |
+        lipo -archs "${{ env.MACOS_APP }}"/Contents/MacOS/trackereditor
+        lipo -archs "${{ env.MACOS_APP }}"/Contents/MacOS/trackereditor | grep -Fq x86_64
+        lipo -archs "${{ env.MACOS_APP }}"/Contents/MacOS/trackereditor | grep -Fq arm64
+      shell: bash
+
+    - name: Test App SSL connection
+      run: open "${{ env.MACOS_APP }}" --args -TEST_SSL
       shell: bash
 
-    - name: Codesign macOS app bundle
+    - name: Codesign macOS app bundle. If certificate is present.
       if: ${{ env.BUILD_WITH_CERTIFICATE != '' }}
       # This macOS Codesign step is copied from:
       # https://federicoterzi.com/blog/automatic-code-signing-and-notarization-for-macos-apps-using-github-actions/
       # This is a bit different from the previous version for Travis-CI build system to build bittorrent tracker editor
+      # More info https://developer.apple.com/forums/thread/128166
       env:
         MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
         MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
@@ -95,15 +138,35 @@ jobs:
         security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
         security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
 
-        # We finally codesign our app bundle, specifying the Hardened runtime option.
-        #/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime "${{ env.MACOS_APP }}" -v
-
         # sign the app. -sign is the developer cetificate ID
-        # Must use --deep to sign all internal content
-        /usr/bin/codesign --timestamp --force --options runtime --deep --sign "$MACOS_CERTIFICATE_NAME" "${{ env.MACOS_APP }}"
+        /usr/bin/codesign --timestamp --force --options runtime --sign "$MACOS_CERTIFICATE_NAME" "${{ env.MACOS_APP }}"
+      shell: bash
+
+    - name: Create dmg file from the enduser/ folder
+      run: |
+        # Remove all txt file. There are not needed.
+        rm -f enduser/*.txt
+
+        # Build dmg image. https://github.com/create-dmg/create-dmg
+        create-dmg \
+          --volname "bittorrent-tracker-editor" \
+          --window-pos 200 120 \
+          --window-size 800 400 \
+          --icon "trackereditor.app" 200 190 \
+          --app-drop-link 600 185 \
+          ${{ env.RELEASE_DMG_FILE }} \
+          "./enduser"
+      shell: bash
+
+    - name: Codesign dmg file. If certificate is present.
+      if: ${{ env.BUILD_WITH_CERTIFICATE != '' }}
+      env:
+        MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
+      run: |
+        /usr/bin/codesign --timestamp --force --options runtime --sign "$MACOS_CERTIFICATE_NAME" "${{ env.RELEASE_DMG_FILE }}"
       shell: bash
 
-    - name: Notarize macOS app bundle
+    - name: Notarize macOS DMG bundle. If certificate is present.
       if: ${{ env.BUILD_WITH_CERTIFICATE != '' }}
       env:
         PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
@@ -121,7 +184,7 @@ jobs:
         # notarization service
 
         echo "Creating temp notarization archive"
-        ditto -c -k --keepParent "${{ env.MACOS_APP }}" "notarization.zip"
+        ditto -c -k --keepParent "${{ env.RELEASE_DMG_FILE }}" "notarization.zip"
 
         # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
         # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
@@ -134,25 +197,19 @@ jobs:
         # Finally, we need to "attach the staple" to our executable, which will allow our app to be
         # validated by macOS even when an internet connection is not available.
         echo "Attach staple"
-        xcrun stapler staple "${{ env.MACOS_APP }}"
-      shell: bash
-
-    - name: Zip only the app folder.
-      run: |
-        echo "Zip macOS app file"
-        /usr/bin/ditto -c -k --keepParent "${{ env.MACOS_APP }}" "${{ env.RELEASE_ZIP_FILE }}"
+        xcrun stapler staple "${{ env.RELEASE_DMG_FILE }}"
       shell: bash
 
     - name: Upload Artifact
       uses: actions/upload-artifact@v4
       with:
-        name: artifact-${{ runner.os }}
-        path: ${{ env.RELEASE_ZIP_FILE }}
+        name: artifact-${{ env.RELEASE_DMG_FILE }}
+        path: ${{ env.RELEASE_DMG_FILE }}
         compression-level: 0 # no compression. Content is already a zip file
         if-no-files-found: error
 
     - name: File release to end user
       uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/')
       with:
-        files: ${{ env.RELEASE_ZIP_FILE }}
+        files: ${{ env.RELEASE_DMG_FILE }}
