Fix some stuff, add AppEntitlements

Build/AppEntitlements.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.automation.apple-events</key>
+        <true/>
+    </dict>
+</plist>

Build/codesign_macos.sh

@@ -2,20 +2,34 @@
 
 echo "Signing file: $1"
 
-# Turn our base64-encoded certificate back to a regular .p12 file
+# Setup keychain in CI
+if [ -n "$CI" ]; then
+    # Turn our base64-encoded certificate back to a regular .p12 file
+    
+    echo "$MACOS_CERTIFICATE" | base64 --decode -o certificate.p12
+    
+    # We need to create a new keychain, otherwise using the certificate will prompt
+    # with a UI dialog asking for the certificate password, which we can't
+    # use in a headless CI environment
+    
+    security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain 
+    security default-keychain -s build.keychain
+    security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+    security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+fi
 
-echo "$MACOS_CERTIFICATE" | base64 --decode -o certificate.p12
+# Sign all files
 
-# We need to create a new keychain, otherwise using the certificate will prompt
-# with a UI dialog asking for the certificate password, which we can't
-# use in a headless CI environment
+ENTITLEMENTS="AppEntitlements.entitlements"
 
-security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain 
-security default-keychain -s build.keychain
-security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
-security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+find "$1/Contents/MacOS/"|while read fname; do
+    if [[ -f $fname ]]; then
+        echo "[INFO] Signing $fname"
+        codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$fname"
+    fi
+done
 
-# We finally codesign our app bundle, specifying the Hardened runtime option
+echo "[INFO] Signing app file"
 
-/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime "$1" -v
+codesign --force --timestamp -s "$MACOS_CERTIFICATE_NAME" --options=runtime --entitlements "$ENTITLEMENTS" "$1" -v

Build/notarize_macos.sh

@@ -7,9 +7,9 @@ echo "Notarizing file: $1"
 
 echo "Create keychain profile"
 xcrun notarytool store-credentials "notarytool-profile" \
---apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" \
---team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" \
---password "$PROD_MACOS_NOTARIZATION_PWD"
+--apple-id "$MACOS_NOTARIZATION_APPLE_ID" \
+--team-id "$MACOS_NOTARIZATION_TEAM_ID" \
+--password "$MACOS_NOTARIZATION_PWD"
 
 # We can't notarize an app bundle directly, but we need to compress it as an archive.
 # Therefore, we create a zip file containing our app bundle, so that we can send it to the