[Audacity-devel] Building a signed Audacity on OSX

Discussion:

James Crook

2016-12-03 16:53:15 UTC

I'm new to mac, but am able to build on mac, using the instructions here:
https://github.com/audacity/audacity/blob/master/mac/Build.txt

I'm looking for some help with xcodebuild, specifically I want to

1. Build audacity but not create the dmg using xcodebuild
Then I can do some signing on the components.
3. Then create the dmg from the signed app using xcodebuild
Then I can sign the dmg.

I had thought I had signing sorted, using
codesign -s (myInstallerId) -v audacity-macosx-2.1.3.dmg

but that only signs the dmg.

I assumed xcodebuild would do partial incremental builds, but it seems
to be doing the whole lot, so it overwrites the signed components if I
sign them. delete the dmg and
xcodebuild -configuration Release install

Anyone offer some advice as to how to do the partial builds?

--James

----
In more detail

I am on El Capitan.
I installed Xcode 6.4 and used the command line tool xcodebuild.

I think my certificates are OK.
I have signed-up-and-paid apple to be part of 'Apple Developer Program'
and so get a recognised developer Id and I have taken the steps in xcode
accounts to create two code signing identities:

Developer ID Application
Developer ID Installer

My understanding is that these are the two I require for 3rd party (non
Apple Store) downloads. (There are 5 other types of signing identity,
which I do not think are relevant to me....
https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppStoreDistributionTutorial/AddingYourAccounttoXcode/AddingYourAccounttoXcode.html
)

I think I am successfully signing the dmg as
codesign --verify --verbose=2
seems happy.

However, the signing I did does not sign the app (inside the dmg). Nor does:
codesign --deep -s (myInstallerId) -v audacity-macosx-2.1.3.dmg

And --deep is in any case intended for 'emergency use'.

The app itself is not signed.
The 'correct' test seems to be to upload to dropbox and then download
and drag install, and then attempt to run - and I get the usual unsigned
error.

I can see two routes forward:
1) The 'easy route' is to find out what command line options I need to
split xcodebuild into two stages, and sign the intermediate stage, then
run the second part and sign the dmg.
2) The 'alternative route' is to build Audacity with xcode 8.1 gui. This
is supposed to make signing a breeze. I already spent far too much time
trying to find options in the 6.4 gui that don't exist there. I am
hoping I will just need to specify using macosx10.6 sdk to still build
for earlier macs and that the building within xcode gui WITH signing
will be easy...

I thought I'd send this email off whilst waiting for xcode 8.1 to
download. It's taking a while.....

--James.

Michael Savich

2016-12-03 17:33:55 UTC

Permalink

While we are on the subject of the Mac, I was wondering if anybody knows why Audacity canât build with newer than 10.6? I was hoping to add some support for Cocoa-specific features, but what I had in mind requires the 10.12.1 SDK.

Sent from my Mac

Post by James Crook
https://github.com/audacity/audacity/blob/master/mac/Build.txt
I'm looking for some help with xcodebuild, specifically I want to
1. Build audacity but not create the dmg using xcodebuild
Then I can do some signing on the components.
3. Then create the dmg from the signed app using xcodebuild
Then I can sign the dmg.
I had thought I had signing sorted, using
codesign -s (myInstallerId) -v audacity-macosx-2.1.3.dmg
but that only signs the dmg.
I assumed xcodebuild would do partial incremental builds, but it seems
to be doing the whole lot, so it overwrites the signed components if I
sign them. delete the dmg and
xcodebuild -configuration Release install
Anyone offer some advice as to how to do the partial builds?
--James
----
In more detail
I am on El Capitan.
I installed Xcode 6.4 and used the command line tool xcodebuild.
I think my certificates are OK.
I have signed-up-and-paid apple to be part of 'Apple Developer Program'
and so get a recognised developer Id and I have taken the steps in xcode
Developer ID Application
Developer ID Installer
My understanding is that these are the two I require for 3rd party (non
Apple Store) downloads. (There are 5 other types of signing identity,
which I do not think are relevant to me....
https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppStoreDistributionTutorial/AddingYourAccounttoXcode/AddingYourAccounttoXcode.html
)
I think I am successfully signing the dmg as
codesign --verify --verbose=2
seems happy.
codesign --deep -s (myInstallerId) -v audacity-macosx-2.1.3.dmg
And --deep is in any case intended for 'emergency use'.
The app itself is not signed.
The 'correct' test seems to be to upload to dropbox and then download
and drag install, and then attempt to run - and I get the usual unsigned
error.
1) The 'easy route' is to find out what command line options I need to
split xcodebuild into two stages, and sign the intermediate stage, then
run the second part and sign the dmg.
2) The 'alternative route' is to build Audacity with xcode 8.1 gui. This
is supposed to make signing a breeze. I already spent far too much time
trying to find options in the 6.4 gui that don't exist there. I am
hoping I will just need to specify using macosx10.6 sdk to still build
for earlier macs and that the building within xcode gui WITH signing
will be easy...
I thought I'd send this email off whilst waiting for xcode 8.1 to
download. It's taking a while.....
--James.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel

Gale Andrews

2016-12-03 20:25:00 UTC

Permalink

Post by Michael Savich
While we are on the subject of the Mac, I was wondering if anybody knows why
Audacity can’t build with newer than 10.6?

Because we still support 10.6:
http://www.audacityteam.org/download/mac/#sysreq .

We are trying to make 2.1.3 when released the last version for Snow
Leopard, in which case we then support a minimum of 10.7 (and so
I assume our minimum SDK will be 10.7. but others may know more
than me what SDK we need to support 10.7).

I don't know of any discussion yet about dropping 10.7 or 10.8 which I
assume will be next to be dropped.

If you want to discuss more, please start a new topic.

Gale

Post by Michael Savich
I was hoping to add some support for Cocoa-specific features, but what I had in mind
requires the 10.12.1 SDK.
Sent from my Mac
https://github.com/audacity/audacity/blob/master/mac/Build.txt
I'm looking for some help with xcodebuild, specifically I want to
1. Build audacity but not create the dmg using xcodebuild
Then I can do some signing on the components.
3. Then create the dmg from the signed app using xcodebuild
Then I can sign the dmg.
I had thought I had signing sorted, using
codesign -s (myInstallerId) -v audacity-macosx-2.1.3.dmg
but that only signs the dmg.
I assumed xcodebuild would do partial incremental builds, but it seems
to be doing the whole lot, so it overwrites the signed components if I
sign them. delete the dmg and
xcodebuild -configuration Release install
Anyone offer some advice as to how to do the partial builds?
--James
----
In more detail
I am on El Capitan.
I installed Xcode 6.4 and used the command line tool xcodebuild.
I think my certificates are OK.
I have signed-up-and-paid apple to be part of 'Apple Developer Program'
and so get a recognised developer Id and I have taken the steps in xcode
Developer ID Application
Developer ID Installer
My understanding is that these are the two I require for 3rd party (non
Apple Store) downloads. (There are 5 other types of signing identity,
which I do not think are relevant to me....
https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppStoreDistributionTutorial/AddingYourAccounttoXcode/AddingYourAccounttoXcode.html
)
I think I am successfully signing the dmg as
codesign --verify --verbose=2
seems happy.
codesign --deep -s (myInstallerId) -v audacity-macosx-2.1.3.dmg
And --deep is in any case intended for 'emergency use'.
The app itself is not signed.
The 'correct' test seems to be to upload to dropbox and then download
and drag install, and then attempt to run - and I get the usual unsigned
error.
1) The 'easy route' is to find out what command line options I need to
split xcodebuild into two stages, and sign the intermediate stage, then
run the second part and sign the dmg.
2) The 'alternative route' is to build Audacity with xcode 8.1 gui. This
is supposed to make signing a breeze. I already spent far too much time
trying to find options in the 6.4 gui that don't exist there. I am
hoping I will just need to specify using macosx10.6 sdk to still build
for earlier macs and that the building within xcode gui WITH signing
will be easy...
I thought I'd send this email off whilst waiting for xcode 8.1 to
download. It's taking a while.....
--James.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel

Cliff Scott

2016-12-03 19:35:32 UTC

Permalink

James,

I'm no expert on this at all, but I've built using Xcode 7.3 GUI and it builds fine, but the results directory includes all the library files which of course aren't needed. To get it to build on 7.3 required modifying the Xcode info.plist so allow the building with SDK for 10.6. It's not hard, but at least on this system even though I am administrator I didn't have rights to the file and giving rights to the file didn't allow it to be edited. I had to give myself rights to the directory above it. Then the edit would take.
edit (with Xcode) the MinimumSDKVersion key value in /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Info.plist then copy the 10.6 SDK to the directory mentioned in the Build.txt.

What you get out of the GUI is the same, except for the extra library files, you get with the normal xcodebuild zip which comes along with the dmg. Of course you haven't built with the code signing on.

I wonder, now that I think of it, since you are not building the plugins will signing the app solve the problem we're having recognizing the plugins? Will be interesting to see how all this works out.

Cliff

James Crook

2016-12-03 21:59:48 UTC

Permalink

Thanks Cliff.
That got me compiling with xcode 8.1 gui, and xcodebuild command line.
I edited Info.plist by cp it to my own dir, editing there, and sudo cp
back over the original.

Setting the signing account within xcode was a bit peculiar, and didn't
'take' at first - it at first didn't think I had a signing account. I
think the step that fixed it was asking xcode to download the signing
certificates (which I already had). It then gave me a 'Mac Developer:'
ID, which I wasn't aware of having asked for or needing. I thought it
was only for debug/test builds.

With this change xcode gui continues to work, and xcodebuild (which
builds the dmg) fails because of code signing of wxwidgets. Fairly sure
I know what to do there, which is just to rebuild wxwidgets with code
signing enabled. [I had actually previously signed those too]

----
Later...
I am getting there...

This makes the use of the IDs far clearer than apple's site.
http://stackoverflow.com/questions/29039462/which-certificate-should-i-use-to-sign-my-mac-os-x-application

xcode is trying to include both the debug and release wxwidgets libs in
the dmg, and I only signed the release libs. So I need to figure out
why, but I really think I am getting there with the signing now.

Thanks for your help Cliff. I'd practically given up on getting xcode
8.1 to play ball and was about to go back to 6.4. One of my other
missing pieces of knowledge was to double click on the project target to
change settings, not just single click, and I was about to go try that
in 6.4.

--James.

Post by Cliff Scott
James,
I'm no expert on this at all, but I've built using Xcode 7.3 GUI and it builds fine, but the results directory includes all the library files which of course aren't needed. To get it to build on 7.3 required modifying the Xcode info.plist so allow the building with SDK for 10.6. It's not hard, but at least on this system even though I am administrator I didn't have rights to the file and giving rights to the file didn't allow it to be edited. I had to give myself rights to the directory above it. Then the edit would take.
edit (with Xcode) the MinimumSDKVersion key value in /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Info.plist then copy the 10.6 SDK to the directory mentioned in the Build.txt.
What you get out of the GUI is the same, except for the extra library files, you get with the normal xcodebuild zip which comes along with the dmg. Of course you haven't built with the code signing on.
I wonder, now that I think of it, since you are not building the plugins will signing the app solve the problem we're having recognizing the plugins? Will be interesting to see how all this works out.
Cliff

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
audacity-devel mailing list
https://lists.sourceforge.net/lists/listinfo/audacity-devel

Gale Andrews

2016-12-04 00:20:18 UTC

Permalink

Thanks for working away at this James.

mac/Build.txt does of course have a link to
http://forum.audacityteam.org/viewtopic.php?p=303835#p303835 .

from where you can find
https://forums.developer.apple.com/thread/43381

which gives the plist and custom build setting solutions. Perhaps
it's better now to link in Build.txt direct to that Apple thread, or just detail
the plist solution.

Gale

Post by James Crook
Thanks Cliff.
That got me compiling with xcode 8.1 gui, and xcodebuild command line.
I edited Info.plist by cp it to my own dir, editing there, and sudo cp
back over the original.
Setting the signing account within xcode was a bit peculiar, and didn't
'take' at first - it at first didn't think I had a signing account. I
think the step that fixed it was asking xcode to download the signing
certificates (which I already had). It then gave me a 'Mac Developer:'
ID, which I wasn't aware of having asked for or needing. I thought it
was only for debug/test builds.
With this change xcode gui continues to work, and xcodebuild (which
builds the dmg) fails because of code signing of wxwidgets. Fairly sure
I know what to do there, which is just to rebuild wxwidgets with code
signing enabled. [I had actually previously signed those too]
----
Later...
I am getting there...
This makes the use of the IDs far clearer than apple's site.
http://stackoverflow.com/questions/29039462/which-certificate-should-i-use-to-sign-my-mac-os-x-application
xcode is trying to include both the debug and release wxwidgets libs in
the dmg, and I only signed the release libs. So I need to figure out
why, but I really think I am getting there with the signing now.
Thanks for your help Cliff. I'd practically given up on getting xcode
8.1 to play ball and was about to go back to 6.4. One of my other
missing pieces of knowledge was to double click on the project target to
change settings, not just single click, and I was about to go try that
in 6.4.
--James.

Cliff Scott

2016-12-04 02:48:54 UTC

Permalink

James,

Glad you got it going. Once the permissions are set you can double click on the info.plist and Xcode will open to edit it, but cp also works.

Let me know if you can get wxWidgets to build on 8.1. I tried and it wouldn't hardly even start using the command line as instructed in the Build.txt. I don't remember now what the errors were, but it stopped after a few seconds. Since we were concentrating on getting 2.1.3 out I didn't bring it up as I didn't expect anyone to be using it. wxWidgets compiles fine on 7.3.

Cliff