Add signing for mac osx. #6748

Siedlerchr · 2020-08-09T13:14:37Z

First part of fixing #6154

Sign and notarize dmg
Sign and notarize pkg

Edit: We maybe should run the signing only on master?

Change in CHANGELOG.md described (if applicable)
Tests created for changes (if applicable)
Manually tested changed features in running JabRef (always required)
Screenshots added in PR description (for UI changes)
Checked documentation: Is the information available and up to date? If not created an issue at https://github.com/JabRef/user-documentation/issues or, even better, submitted a pull request to the documentation repository.

Siedlerchr · 2020-08-09T13:47:03Z

windows seems to fail:

Running [C:\Program Files (x86)\WiX Toolset v3.11\bin\light.exe, -nologo, -spdb, -ext, WixUtilExtension, -out, D:\a\jabref\jabref\build\distribution\JabRef-5.1.30845.msi, -sice:ICE27, -ext, WixUIExtension, -loc, D:\a\jabref\jabref\build\installer\config\MsiInstallerStrings_en.wxl, -b, D:\a\jabref\jabref\build\installer\config, D:\a\jabref\jabref\build\installer\wixobj\main.wixobj, D:\a\jabref\jabref\build\installer\wixobj\bundle.wixobj]in D:\a\jabref\jabref\build\installer\images\win-msi.image\JabRef
D:\a\jabref\jabref\build\installer\config\main.wxs(85) : error LGHT0091 : Duplicate symbol 'Property:ARPPRODUCTICON' found. This typically means that an Id is duplicated. Check to make sure all your identifiers of a given type (File, Component, Feature) are unique.
D:\a\jabref\jabref\build\installer\config\main.wxs(147) : error LGHT0092 : Location of symbol related to previous error.
java.io.IOException: Command [C:\Program Files (x86)\WiX Toolset v3.11\bin\light.exe, -nologo, -spdb, -ext, WixUtilExtension, -out, D:\a\jabref\jabref\build\distribution\JabRef-5.1.30845.msi, -sice:ICE27, -ext, WixUIExtension, -loc, D:\a\jabref\jabref\build\installer\config\MsiInstallerStrings_en.wxl, -b, D:\a\jabref\jabref\build\installer\config, D:\a\jabref\jabref\build\installer\wixobj\main.wixobj, D:\a\jabref\jabref\build\installer\wixobj\bundle.wixobj]in D:\a\jabref\jabref\build\installer\images\win-msi.image\JabRef exited with 92

Fix indendation

* 'macsign' of github.com:JabRef/jabref: Update deployment.yml

Siedlerchr · 2020-08-09T18:32:24Z

@Gena928 @k3KAW8Pnf7mkmdSMPHz27
Can you please test this version here on mac?
The pgk and the dmg should now be signed correctly:
https://builds.jabref.org/pull/6748/merge/

(Just want to make sure that it works on your machines as well, because I have the certs already imported)

Gena928 · 2020-08-09T19:40:38Z

Good day,
I was able to install JabRef using DMG & PKG files.
Unfortunately icons in dmg file are not in the center in the install frame.

But this looks much better now.

Siedlerchr · 2020-08-09T20:39:27Z

@Gena928 Yeah! glad to hear that it works now fine.
Regarding the icons, I think we need to copy over that script and adapt the sizes:

  if theFilePath is "DEPLOY_INSTALL_LOCATION" then
      -- Position install location
      set position of item theFile of theWindow to {390, 130}
    else
      -- Position application or runtime
      set position of item theFile of theWindow to {120, 130}
    end if

https://github.com/openjdk/jdk/blob/master/src/jdk.incubator.jpackage/macosx/classes/jdk/incubator/jpackage/internal/resources/DMGsetup.scpt

Gena928 · 2020-08-09T20:42:03Z

OK, let me know if you need my testing.
But I think the result is very good now. Nice work!

k3KAW8Pnf7mkmdSMPHz27 · 2020-08-10T19:22:56Z

Awesome that you are working on this!

.pkg works as it should (signed and not notarized), but I don't know how to verify the signature of the .dmg.

spctl -t open --assess --verbose JabRef-5.1.dmg and spctl -a -t open --context context:primary-signature -v JabRef-5.1.dmg gives me

JabRef-5.1.dmg: rejected
source=Insufficient Context

and

JabRef-5.1.dmg: rejected
source=no usable signature

but I am guessing this is as it should be?

Siedlerchr · 2020-08-10T20:17:29Z

Thanks for the feedback, glad that the signing at least works so that no warning is displayed.
Notarization seems to be the next step after the build.
Requires additional handling, will look into it.
It's really confusing figuring out the certificate stuff

k3KAW8Pnf7mkmdSMPHz27 · 2020-08-11T14:43:42Z

I get no error message related to signing from either the dmg or pkg.

A minor "nitpick" is that the pkg displays a warning for it not being notarized ("... can't be opened because Apple cannot check it for malicious software.")

Siedlerchr · 2020-08-11T15:01:04Z

Yeah, I noticed that too. I will try to setup the notarization workflow next. Then aftewards ist should be also possible to add it to the app store. Probably reqires another different certificate signing stuff

tobiasdiez · 2020-08-13T09:09:43Z

.github/workflows/deployment.yml

@@ -55,14 +56,29 @@ jobs:
      - name: Set up JDK
        uses: actions/setup-java@v1
        with:
-          java-version: 14
+          java-version: 15-ea


Why do we need to upgrade to 15?

Because of this bug https://bugs.openjdk.java.net/browse/JDK-8238184

.github/workflows/deployment.yml

buildres/windows/JabRef-post-image.wsf

tobiasdiez · 2020-08-13T09:14:13Z

Concerning the installation screen, the easiest option is probably to change the image.

* upstream/master: Improve handling of annotation processor in eclipse (#6749) New Crowdin updates (#6741) Bump appleboy/ssh-action from v0.1.2 to v0.1.3 (#6752) Bump WyriHaximus/github-action-wait-for-status from 0.1.0 to v1.1 (#6751) Squashed 'src/main/resources/csl-styles/' changes from 827b986..d23a3ab

regenerate all icons

koppor

Please fix #6748 (comment).

Siedlerchr · 2020-08-19T21:07:27Z

I think @Gena928 did the initial design of the install dialog. Need to find the original PR.
Personally, I don't see a big problem with using our modified version.

* upstream/master: Hint message for TextFieldTableCells commit JFX bug (#6772) Add new authors

* upstream/macsign: Use Major.Minor version in the file name Remove empty lines Fix comment char Refine comments Fix indent Fix indent to ease reviewing

* upstream/master: Streamline new library command (#6773) [6574] Added support for biblatex-software (#6747) Updated the eclipse doc with a note and image on how to add the run/debug configuration. (#6776) New Crowdin updates (#6774)

* upstream/master: fix checkstyle in adr

* upstream/macsign: try with other jdk for linux and win

Siedlerchr · 2020-08-23T13:35:39Z

@k3KAW8Pnf7mkmdSMPHz27 Both the installer and the dmg should now be signed and notarized. Can you confirm that?
You can try the latest master when it's ready

tobiasdiez · 2020-08-23T19:30:45Z

@Siedlerchr please also add this PR in #5226 as I guess most of these changes can be reverted as soon as the corresponding upstream java bugs are fixed.

* upstream/master: Bump WyriHaximus/github-action-wait-for-status from v1.1 to v1.1.2 (#6786) Bump postgresql from 42.2.15 to 42.2.16 (#6785) Bump unirest-java from 3.9.00 to 3.10.00 (#6784) Bump org.beryx.jlink from 2.21.2 to 2.21.3 (#6783) Bump mockito-core from 3.5.0 to 3.5.5 (#6782) Fixed forgotten biblatex test with biblatex-software type definitions (#6780) Enable SpringerFetcherTest running on CI using a dedicated key (#6729) Add missing authors New Crowdin updates (#6778) Add signing for mac osx. (#6748) Linkfix Squashed 'src/main/resources/csl-styles/' changes from 0895562..469deb6

update to version 15

90ff628

Siedlerchr force-pushed the macsign branch from cfe9d28 to 90ff628 Compare August 9, 2020 13:17

change to 15 ea

5c2bdcf

Siedlerchr added 8 commits August 9, 2020 18:47

lets test with the cert

272b709

run keychain adding only on osx

abec6a5

import second cert

ad46c1a

Update deployment.yml

3069ee1

Fix indendation

remove windows icon hack

a9dbb27

Merge branch 'macsign' of github.com:JabRef/jabref into macsign

1c601b5

* 'macsign' of github.com:JabRef/jabref: Update deployment.yml

Fix deploy indendation. Fucking yaml.

c5af100

set keychain password manually

8f53fa9

Siedlerchr added the status: ready-for-review Pull Requests that are ready to be reviewed by the maintainers label Aug 9, 2020

Siedlerchr changed the title ~~[WIP] Test macsign~~ Add signing for mac osx. Aug 9, 2020

Siedlerchr closed this Aug 10, 2020

Siedlerchr reopened this Aug 10, 2020

tobiasdiez reviewed Aug 13, 2020

View reviewed changes

Siedlerchr added 4 commits August 14, 2020 19:29

change icon position in dmg setup

31f720c

TODO: find out the corect parameters for the installer vars

4d91c16

udpate icons for mac

a439125

regenerate all icons

koppor requested changes Aug 19, 2020

View reviewed changes

Siedlerchr added 17 commits August 20, 2020 09:41

Merge remote-tracking branch 'upstream/master' into macsign

d9b14a2

* upstream/master: Hint message for TextFieldTableCells commit JFX bug (#6772) Add new authors

Merge remote-tracking branch 'upstream/macsign' into macsign

5c0a2fb

* upstream/macsign: Use Major.Minor version in the file name Remove empty lines Fix comment char Refine comments Fix indent Fix indent to ease reviewing

fix paths

a6daf13

try with java 14

4ac2e87

specify path for ea15 to use official openjdk build

74c9d1d

change to adoptopenjkd action

5670ae3

fix

1ab0275

try without ea

68143b1

specify ea

fdb11b4

set fail fast to false

2fffc7a

try with other jdk for linux and win

514a23a

Merge remote-tracking branch 'upstream/master' into macsign

6967acb

* upstream/master: fix checkstyle in adr

Add notarization for pkg installer as well

0410e00

Merge remote-tracking branch 'upstream/macsign' into macsign

bf6125b

* upstream/macsign: try with other jdk for linux and win

fix missing extension in pkg

73a136b

JabRef deleted a comment from github-actions bot Aug 23, 2020

koppor added this to the v5.1 milestone Aug 23, 2020

Siedlerchr mentioned this pull request Aug 23, 2020

Modify background image for mac in dmg koppor/jabref#463

Open

koppor merged commit 3310a23 into master Aug 23, 2020

koppor deleted the macsign branch August 23, 2020 18:55

stefan-kolb mentioned this pull request Aug 23, 2020

Issues depending on external libraries #5226

Open

33 tasks

koppor mentioned this pull request Aug 27, 2020

Does JabRef 5.1 master build not include the JRE? koppor/jabref#465

Closed

stefan-kolb mentioned this pull request Jan 8, 2021

Entitlements file Mac #7317

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add signing for mac osx. #6748

Add signing for mac osx. #6748

Siedlerchr commented Aug 9, 2020 •

edited

Loading

Siedlerchr commented Aug 9, 2020 •

edited

Loading

Siedlerchr commented Aug 9, 2020

Gena928 commented Aug 9, 2020

Siedlerchr commented Aug 9, 2020

Gena928 commented Aug 9, 2020

k3KAW8Pnf7mkmdSMPHz27 commented Aug 10, 2020 •

edited

Loading

Siedlerchr commented Aug 10, 2020 •

edited

Loading

k3KAW8Pnf7mkmdSMPHz27 commented Aug 11, 2020 •

edited

Loading

Siedlerchr commented Aug 11, 2020

tobiasdiez Aug 13, 2020

Siedlerchr Aug 13, 2020 •

edited

Loading

tobiasdiez commented Aug 13, 2020

koppor left a comment

Siedlerchr commented Aug 19, 2020

Siedlerchr commented Aug 23, 2020 •

edited

Loading

tobiasdiez commented Aug 23, 2020

Add signing for mac osx. #6748

Add signing for mac osx. #6748

Conversation

Siedlerchr commented Aug 9, 2020 • edited Loading

Siedlerchr commented Aug 9, 2020 • edited Loading

Siedlerchr commented Aug 9, 2020

Gena928 commented Aug 9, 2020

Siedlerchr commented Aug 9, 2020

Gena928 commented Aug 9, 2020

k3KAW8Pnf7mkmdSMPHz27 commented Aug 10, 2020 • edited Loading

Siedlerchr commented Aug 10, 2020 • edited Loading

k3KAW8Pnf7mkmdSMPHz27 commented Aug 11, 2020 • edited Loading

Siedlerchr commented Aug 11, 2020

tobiasdiez Aug 13, 2020

Choose a reason for hiding this comment

Siedlerchr Aug 13, 2020 • edited Loading

Choose a reason for hiding this comment

tobiasdiez commented Aug 13, 2020

koppor left a comment

Choose a reason for hiding this comment

Siedlerchr commented Aug 19, 2020

Siedlerchr commented Aug 23, 2020 • edited Loading

tobiasdiez commented Aug 23, 2020

Siedlerchr commented Aug 9, 2020 •

edited

Loading

Siedlerchr commented Aug 9, 2020 •

edited

Loading

k3KAW8Pnf7mkmdSMPHz27 commented Aug 10, 2020 •

edited

Loading

Siedlerchr commented Aug 10, 2020 •

edited

Loading

k3KAW8Pnf7mkmdSMPHz27 commented Aug 11, 2020 •

edited

Loading

Siedlerchr Aug 13, 2020 •

edited

Loading

Siedlerchr commented Aug 23, 2020 •

edited

Loading