deskflow/cmake/MacCodesign.cmake

52 lines
2.0 KiB
CMake

# SPDX-FileCopyrightText: (C) 2025-2026 Deskflow Contributors
# SPDX-License-Identifier: MIT
# Warning: Do not use for CI/production, as the `entitlements-dev.plist` file adds special
# entitlements that are only appropriate for local development.
#
# macOS made TCC stricter so that if you don't sign your local dev builds properly, macOS will
# nag you to remove and re-approve the app every time you make a change to the binary which is
# extremely annoying during development.
#
# If you were to use ad-hoc signing (i.e. not specify a certificate), TCC would still nag you
# because the binary identity is anchored not on the app ID, but on the CD hash (which changes
# based on the binary contents).
#
# To use, simply generate a personal certificate for free with Xcode and pass the ID to CMake.
# Full instructions are in the docs.
function(configure_mac_codesign target)
set_property(GLOBAL APPEND PROPERTY _MAC_CODESIGN_DEPENDS $<TARGET_FILE:${target}>)
get_property(deferred GLOBAL PROPERTY _MAC_CODESIGN_DEFERRED)
if(NOT deferred)
set_property(GLOBAL PROPERTY _MAC_CODESIGN_DEFERRED TRUE)
message(STATUS "Apple codesign ID for development only: ${APPLE_CODESIGN_DEV}")
cmake_language(DEFER DIRECTORY ${CMAKE_SOURCE_DIR} CALL _finalize_mac_codesign)
endif()
endfunction()
function(_finalize_mac_codesign)
get_property(depends GLOBAL PROPERTY _MAC_CODESIGN_DEPENDS)
set(stamp_file "${CMAKE_BINARY_DIR}/CMakeFiles/codesign-dev.stamp")
# Use a stamp file because codesign modifies the binaries it signs.
add_custom_command(
OUTPUT ${stamp_file}
COMMAND /usr/bin/codesign
--force
--options runtime
--entitlements "${CMAKE_SOURCE_DIR}/src/apps/res/entitlements-dev.plist"
--sign "${APPLE_CODESIGN_DEV}"
"$<TARGET_BUNDLE_DIR:${CMAKE_PROJECT_PROPER_NAME}>"
COMMAND ${CMAKE_COMMAND} -E touch ${stamp_file}
DEPENDS ${depends}
COMMENT "Codesigning ${CMAKE_PROJECT_PROPER_NAME}"
VERBATIM
)
add_custom_target(codesign-dev ALL DEPENDS ${stamp_file})
endfunction()