message: Use signed mac package
  * Add app signing and notarize for Mac package
  Uses repository secrets, so this will not run on standard fork
  pull requests.
  Should run on merge and releases.
diff: @@ -201,6 +201,44 @@ jobs:
  message(FATAL_ERROR "Running tests failed!")
  endif()
  + - name: Install the Apple certificate
  + # From GitHub docs: https://docs.github.com/en/actions/guides/installing-an-apple-certificate-on-macos-runners-for-xcode-development
  + if: runner.os == 'macOS'
  + working-directory: ${{ runner.workspace }}/build
  + env:
  + BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
  + P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
  + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
  + NOTARIZE_USERNAME: ${{ secrets.AC_USERNAME }}
  + NOTARIZE_PASSWORD: ${{ secrets.AC_PASSWORD }}
  + PRODUCT_BUNDLE_IDENTIFIER: cc.avogadro
  + run: |
  + # create variables
  + if [ -n "${P12_PASSWORD}" ]; then
  + CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
  + KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
  +
  + # import certificate and provisioning profile from secrets
  + echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode --output $CERTIFICATE_PATH
  + # check that it was created properly
  + ls -l $CERTIFICATE_PATH
  + md5 $CERTIFICATE_PATH
  +
  + # create temporary keychain if the cert is non-zero
  + if [ -s $CERTIFICATE_PATH ]; then
  + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
  + security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
  + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
  +
  + # import certificate to keychain
  + security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
  + security list-keychain -d user -s $KEYCHAIN_PATH
  +
  + # code-sign app
  + codesign --deep -s "Developer ID Application: Geoffrey Hutchison" -v prefix/Avogadro2.app
  + fi # certificate exists
  + fi # password exists
  +
  - name: Pack
  if: matrix.config.artifact != 0
  run: cpack ${{ matrix.config.cpack_flags }}
  @@ -226,6 +264,18 @@ jobs:
  rm avogadroapp/Avogadro2*Linux.*
  working-directory: ${{ runner.workspace }}/build
  + - name: Notarize Mac DMG
  + if: runner.os == 'macOS'
  + run: |
  + # check if we have the password and the username
  + if [ -n "${NOTARIZE_PASSWORD}" ] && [ -n "${NOTARIZE_USERNAME}" ]; then
  + npx notarize-cli --file "build/avogadroapp/Avogadro2*.dmg"
  + fi
  + env:
  + NOTARIZE_USERNAME: ${{ secrets.AC_USERNAME }}
  + NOTARIZE_PASSWORD: ${{ secrets.AC_PASSWORD }}
  + PRODUCT_BUNDLE_IDENTIFIER: cc.avogadro
  +
  - name: Setup tmate session
  if: ${{ failure() }}
  uses: mxschmitt/action-tmate@v3
  