From 11cb242ed202e424cd05b22b3a73a2544c26e81c Mon Sep 17 00:00:00 2001
From: Logan McNaughton <848146+loganmc10@users.noreply.github.com>
Date: Tue, 7 Apr 2026 11:31:04 -0600
Subject: [PATCH] sign mac bundle (#712)

* sign mac bundle

* xcrun

* use zip

* more
---
 .github/workflows/build.yml                    | 18 +++++++++++++++++-
 Cargo.toml                                     |  1 +
 ...titlements.plist => entitlements_dev.plist} |  0
 data/entitlements_prod.plist                   | 18 ++++++++++++++++++
 4 files changed, 36 insertions(+), 1 deletion(-)
 rename data/{entitlements.plist => entitlements_dev.plist} (100%)
 create mode 100644 data/entitlements_prod.plist

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b0a1ce2..d4dfffe 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -164,10 +164,26 @@ jobs:
             @executable_path/../Frameworks/libfreetype.6.dylib target/${{ matrix.target }}/release/bundle/osx/Gopher64.app/Contents/MacOS/gopher64
           install_name_tool -change /opt/homebrew/opt/libpng/lib/libpng16.16.dylib \
             @executable_path/../Frameworks/libpng16.16.dylib target/${{ matrix.target }}/release/bundle/osx/Gopher64.app/Contents/Frameworks/libfreetype.6.dylib
-          codesign -f --entitlements data/entitlements.plist --deep --timestamp --options runtime -s - target/${{ matrix.target }}/release/bundle/osx/Gopher64.app
         env:
           NETPLAY_ID: ${{ secrets.NETPLAY_ID }}
           MACOSX_DEPLOYMENT_TARGET: "26.0"
+      - name: Sign Bundle Dev
+        if: ${{ github.ref_type != 'tag' }}
+        run: |
+          codesign -f --entitlements data/entitlements_dev.plist --deep --timestamp --options runtime -s - target/${{ matrix.target }}/release/bundle/osx/Gopher64.app
+      - name: Import Codesign Certs
+        if: ${{ github.ref_type == 'tag' }}
+        uses: apple-actions/import-codesign-certs@v6
+        with:
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATES_FILE_BASE64 }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATES_PASSWORD }}
+      - name: Sign Bundle Release
+        if: ${{ github.ref_type == 'tag' }}
+        run: |
+          codesign -f --entitlements data/entitlements_prod.plist --deep --timestamp --options runtime -s "${{ secrets.APPLE_DEVELOPER_ID }}" target/${{ matrix.target }}/release/bundle/osx/Gopher64.app
+          zip -r gopher64-${{ matrix.arch }}.zip target/${{ matrix.target }}/release/bundle/osx/Gopher64.app
+          xcrun notarytool submit --wait --apple-id "${{ secrets.APPLE_ID }}" --team-id "${{ secrets.APPLE_DEVELOPER_ID }}" --password "${{ secrets.APPLE_APP_PASSWORD }}" gopher64-${{ matrix.arch }}.zip
+          xcrun stapler staple target/${{ matrix.target }}/release/bundle/osx/Gopher64.app
       - name: Upload file
         uses: actions/upload-artifact@v7
         with:
diff --git a/Cargo.toml b/Cargo.toml
index 3a1fa3c..78e0860 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -58,3 +58,4 @@ identifier = "io.github.gopher64.gopher64"
 category = "public.app-category.games"
 icon = ["data/icon/gopher64_128x128.png","data/icon/gopher64_256x256.png","data/icon/gopher64_512x512.png"]
 osx_frameworks = ["/opt/homebrew/opt/molten-vk/lib/libMoltenVK.dylib","/opt/homebrew/opt/freetype/lib/libfreetype.6.dylib","/opt/homebrew/opt/libpng/lib/libpng16.16.dylib"]
+osx_minimum_system_version = "26.0"
diff --git a/data/entitlements.plist b/data/entitlements_dev.plist
similarity index 100%
rename from data/entitlements.plist
rename to data/entitlements_dev.plist
diff --git a/data/entitlements_prod.plist b/data/entitlements_prod.plist
new file mode 100644
index 0000000..45b3615
--- /dev/null
+++ b/data/entitlements_prod.plist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
+	<key>com.apple.security.network.server</key>
+	<true/>
+	<key>com.apple.security.device.usb</key>
+	<true/>
+	<key>com.apple.security.device.bluetooth</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-only</key>
+	<true/>
+</dict>
+</plist>