Merge pull request ActivityWatch#620 from ActivityWatch/dev/macos-sig…

…n-and-notarize
Dhruv7201 · Jan 26, 2022 · 093f630 · 093f630
2 parents e4499e6 + 19731d6
commit 093f630
Show file tree

Hide file tree

Showing 11 changed files with 350 additions and 178 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -116,24 +116,49 @@ jobs:
       run: |
         source venv/bin/activate || source venv/Scripts/activate
         make test
+
     # Don't run integration tests on Windows, doesn't work for some reason
     - name: Run integration tests
       if: "!startsWith(runner.os, 'windows')"
       run: |
         source venv/bin/activate || source venv/Scripts/activate
         make test-integration
+
     - name: Package
       shell: bash
       run: |
         source venv/bin/activate || source venv/Scripts/activate
         poetry install  # run again to ensure we have the correct version of PyInstaller
         make package
+
     - name: Package dmg
       if: startsWith(runner.os, 'macOS')
       run: |
+        # Load certificates
+        # TODO: Only load key & sign if env vars for signing exists
+        ./scripts/ci/import-macos-p12.sh
+
+        # Build .app and .dmg
         source venv/bin/activate
-        make dist/ActivityWatch.dmg;
-        mv dist/ActivityWatch.dmg dist/activitywatch-$(scripts/package/getversion.sh)-macos-x86_64.dmg;
+        make dist/ActivityWatch.dmg
+        codesign --verbose -s ${APPLE_PERSONALID} dist/ActivityWatch.dmg
+
+        # Run prechecks
+        brew install akeru-inc/tap/xcnotary
+        xcnotary precheck dist/ActivityWatch.app
+        xcnotary precheck dist/ActivityWatch.dmg
+
+        # Notarize
+        make dist/notarize
+        mv dist/ActivityWatch.dmg dist/activitywatch-$(scripts/package/getversion.sh)-macos-x86_64.dmg
+      env:
+        APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }}
+        APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+        APPLE_PERSONALID: ${{ secrets.APPLE_TEAMID }} # APPLE_PERSONAL_ID == APPLE_TEAM_ID for personal accounts
+        APPLE_TEAMID: ${{ secrets.APPLE_TEAMID }}
+        CERTIFICATE_MACOS_P12_BASE64: ${{ secrets.CERTIFICATE_MACOS_P12_BASE64 }}
+        CERTIFICATE_MACOS_P12_PASSWORD: ${{ secrets.CERTIFICATE_MACOS_P12_PASSWORD }}
+
     - name: Upload packages
       uses: actions/upload-artifact@v2-preview
       with:

diff --git a/.travis.yml b/.travis.yml
@@ -84,6 +84,7 @@ script:
  - "poetry install"  # install pyinstaller again since it gets uninstalled for some reason
  - "make package"
  - if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then
+     ./scripts/ci/import-macos-p12.sh
      make dist/ActivityWatch.dmg;
      mv dist/ActivityWatch.dmg dist/activitywatch-$(scripts/package/getversion.sh)-macos-x86_64.dmg;
    fi
@@ -97,7 +98,7 @@ deploy:
    skip_cleanup: true
    file_glob: true
    file: dist/activitywatch-*.*
-   api_key:
+   token:
      secure: PSkaHT7bhmCBFutBhfIyHd/j784e0bgzVrahA9+IrEZQqHmJzGvkytf4mQ+EWz0lYDX/Jko7aIFfuCQ8yoVNnnwCu8SwTKXcwrkwuJrymupIK+Xxau6C4rMBLK81mphZs8t2YjJK720EquZ54Tt5Y79Dh2tk9ZxdgqWgVLVhhZziD2/I5BfpsqRgCFqZc4UKAOAf5jpe1lgCOz4zkLP3vgQUyIJgkc9A1BT01f5v860hAlH8HchBAlIMklzPJt3ps9ch8dLRtCC3ZQRWIQpNGjw10P4BO3DqjF4ASeo0ZtbLGIFZeWnnAbQxRIztPUqiYnTQckvHcHYAKG8cyO8SBKQj1au5FRTCHbafpOOzLDWkXx+fqaYakxmPlW6YGp+zaiDQsmNCIdCWWsFU8+gUgZL8Owf4eYc2LI4LW7SI/RC7HjllqNP8WVbZSbQRcvQrK9ZN6fiOixTLni2cXyKy6SxVaDd/+iji8YwPW8JrOawTsXIoZRDE6vq41Y47tO/MU9yLm8RkRkApBGgsc+5RJCEEiDyghJ3op+rWIavcMmSZQ3TBo5e00XyPBd7dGkxoLk9WUSuaZgTmi7FSfDDxWW9TiE7tP2ruIV4fcAlOOkM5ll3K6XIo61JM0JAuAKsg7g32lOnr2DEGDk8XlV3QqIEzwjXLjdVrk3ALabp8HjI=
    on:
      tags: true

diff --git a/Makefile b/Makefile
@@ -132,13 +132,16 @@ aw-qt/media/logo/logo.icns:
 	rm -R build/MyIcon.iconset
 	mv build/MyIcon.icns aw-qt/media/logo/logo.icns
 
+dist/ActivityWatch.app: aw-qt/media/logo/logo.icns
+	pyinstaller --clean --noconfirm --windowed aw.spec
+
 dist/ActivityWatch.dmg: dist/ActivityWatch.app
+	# NOTE: This does not codesign the dmg, that is done in the CI config
 	pip install dmgbuild
 	dmgbuild -s scripts/package/dmgbuild-settings.py -D app=dist/ActivityWatch.app "ActivityWatch" dist/ActivityWatch.dmg
 
-dist/ActivityWatch.app: aw-qt/media/logo/logo.icns
-	pip install git+git://github.com/pyinstaller/pyinstaller.git@55c8855d9db0fa596ceb28505f3ee2f402ecd4da
-	pyinstaller --clean --noconfirm --windowed aw.spec
+dist/notarize:
+	./scripts/notarize.sh
 
 package:
 	mkdir -p dist/activitywatch
@@ -158,8 +161,9 @@ ifndef SKIP_SERVER_RUST
 endif
 	make --directory=aw-qt package
 	cp -r aw-qt/dist/aw-qt/. dist/activitywatch
-# Remove problem-causing binaries, see https://github.com/ActivityWatch/activitywatch/issues/161
-	rm -f dist/activitywatch/libdrm.so.2
+# Remove problem-causing binaries
+	rm -f dist/activitywatch/libdrm.so.2       # see: https://github.com/ActivityWatch/activitywatch/issues/161
+	rm -f dist/activitywatch/libharfbuzz.so.0  # see: https://github.com/ActivityWatch/activitywatch/issues/660#issuecomment-959889230
 # Remove unecessary files
 	rm -rf dist/activitywatch/pytz
 # Builds zips and setups

diff --git a/aw-client b/aw-client
diff --git a/aw-core b/aw-core
diff --git a/aw.spec b/aw.spec
@@ -17,6 +17,10 @@ current_release = subprocess.run(
 ).stdout.strip()
 print("bundling activitywatch version " + current_release)
 
+entitlements_file = Path(".") / "scripts" / "package" / "entitlements.plist"
+codesign_identity = os.environ.get("APPLE_PERSONALID")
+assert codesign_identity, "Environment variable APPLE_PERSONALID not set"
+
 aw_core_path = Path(os.path.dirname(aw_core.__file__))
 restx_path = Path(os.path.dirname(flask_restx.__file__))
 
@@ -153,6 +157,8 @@ aww_exe = EXE(
     strip=False,
     upx=True,
     console=True,
+    entitlements_file=entitlements_file,
+    codesign_identity=codesign_identity,
 )
 aww_coll = COLLECT(
     aww_exe,
@@ -174,6 +180,8 @@ awa_exe = EXE(
     strip=False,
     upx=True,
     console=True,
+    entitlements_file=entitlements_file,
+    codesign_identity=codesign_identity,
 )
 awa_coll = COLLECT(
     awa_exe,
@@ -196,6 +204,8 @@ aws_exe = EXE(
     strip=False,
     upx=True,
     console=True,
+    entitlements_file=entitlements_file,
+    codesign_identity=codesign_identity,
 )
 aws_coll = COLLECT(
     aws_exe,
@@ -218,6 +228,8 @@ awq_exe = EXE(
     upx=True,
     icon=icon,
     console=False if platform.system() == "Windows" else True,
+    entitlements_file=entitlements_file,
+    codesign_identity=codesign_identity,
 )
 awq_coll = COLLECT(
     awq_exe,
@@ -237,12 +249,16 @@ if platform.system() == "Darwin":
         aws_coll,
         name="ActivityWatch.app",
         icon=icon,
-        bundle_identifier="ActivityWatch",
-        # TODO: Get the right version here
-        version=current_release,
+        bundle_identifier="net.activitywatch.ActivityWatch",
+        version=current_release.lstrip("v"),
         info_plist={
             "NSPrincipalClass": "NSApplication",
             "CFBundleExecutable": "MacOS/aw-qt",
             "CFBundleIconFile": "logo.icns",
+            "NSAppleEventsUsageDescription": "Please grant access to use Apple Events",
+            # This could be set to a more specific version string (including the commit id, for example)
+            "CFBundleVersion": current_release.lstrip("v"),
+            # Replaced by the 'version' kwarg above
+            # "CFBundleShortVersionString": current_release.lstrip('v'),
         },
     )
+1 −0		.gitignore
+28 −0		README.md
+54 −0		aw_client/classes.py
+183 −2		aw_client/cli.py
+261 −0		aw_client/queries.py
+97 −0		examples/email_report.py
+1 −1		examples/load_dataframe.py
+15 −4		examples/working_hours.py
+140 −74		poetry.lock
+2 −1		pyproject.toml
+4 −2		aw_core/log.py
+417 −294		poetry.lock
+4 −3		pyproject.toml