feat(macOS): sign and notarize app (#117)

Author: raphaelcoeffic

.github/workflows/pipeline.yml

@@ -198,6 +198,19 @@ jobs:
           name: compiled-${{ matrix.os }}
           path: build
 
+      - name: Setup Code Signing (macOS)
+        if: runner.os == 'macOS' && github.event_name != 'pull_request'
+        run: |
+          # Code signing
+          echo 'CSC_LINK=${{ secrets.APPLE_CERT }}' >> $GITHUB_ENV
+          echo 'CSC_KEY_PASSWORD=${{ secrets.APPLE_CERT_PASSWORD }}' >> $GITHUB_ENV
+          # Notarization
+          mkdir -p ~/private_keys/
+          echo '${{ secrets.APPLE_API_KEY }}' > ~/private_keys/AuthKey_${{ secrets.APPLE_API_KEY_ID }}.p8
+          echo 'APPLE_API_KEY=~/private_keys/AuthKey_${{ secrets.APPLE_API_KEY_ID }}.p8' >> $GITHUB_ENV
+          echo 'APPLE_API_KEY_ID=${{ secrets.APPLE_API_KEY_ID }}' >> $GITHUB_ENV
+          echo 'APPLE_API_ISSUER=${{ secrets.APPLE_API_ISSUER_ID }}' >> $GITHUB_ENV
+
       - name: Build
         run: yarn run pack
 

entitlements.mac.plist

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.device.usb</key>
+    <true/>
+  </dict>
+</plist>

package.json

@@ -8,6 +8,8 @@
     "productName": "EdgeTX Buddy",
     "appId": "org.edgetx.buddy",
     "mac": {
+      "hardenedRuntime": true,
+      "entitlements": "./entitlements.mac.plist",
       "target": [
         {
           "target": "dmg",