native-packages 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db11bd5b39c572e4983697e34112948cf182169145c1504a5c2223bd6c01bad0
-  data.tar.gz: 379244306eeb13a7e501cd3808dbe3fd81337079e70b129ca446e243a311daaa
+  metadata.gz: ccc727393fcd07bd511465e0b2c46b19679a387b6ffee081693231061424fbd9
+  data.tar.gz: 9a402ad593dd1035f1ab350e9cdc1a81292f0976303d6454c2ad9a3ecc53ae91
 SHA512:
-  metadata.gz: 4169d1495a88f410c99a59ff1de20b9d6162468e5ddd4a3082a89e843ded13f84d74401cd91f4fde3b6e4457dfa91aa9ea78e19c7c0560c7fd89c3bd18785ec8
-  data.tar.gz: 2e89f5a56a85d642e8139c1c6725c3f90db7d664580c33ac64c6a432cac1998f5fa1e7cb220e415597532a83802b068c72f3be47c36a301ce51c795e89494244
+  metadata.gz: ee7950fbfd3a6d8e8d934e2c51a2620e717644c30803d660617d3e44d9c2274819fdc37dd815208493244b553976df685d2d3ec2d129eede0301bb61f7dd80d5
+  data.tar.gz: a57e20ba12b60b53bcbe0b9e5d896fb874d2535ae73f6f24a03b067ef9310eb35133bd51654d29a58d6e2990577a7dd6d4d056bf796ed44905c00866a087d983

data/README.md

@@ -61,6 +61,10 @@ the application's existing packaging commands on macOS or Windows, using the
 same verified build manifests as Linux packages. Native recipes consume prepared
 directories and need no nFPM installation. The gem checks Mach-O/PE architecture,
 preserves safe internal bundle links and hashes the output after signing hooks.
+With complete Apple credentials, macOS DMG builds automatically sign their owned
+app copy, notarize the image, staple and validate its ticket before recording
+checksums. `notarize-macos INPUT --output OUTPUT` prepares signed, notarized
+portable code for an application-owned archive. See [Apple notarization](docs/apple-notarization.md).
 App compilation, installer policy and signing identities stay in the application
 repository.
 
@@ -103,7 +107,7 @@ packaging:
   needs: release
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.4.0
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.5.0
   with:
     version: ${{ github.ref_name }}
     publish: true
@@ -129,7 +133,7 @@ Migration combines `packaging/project.yml`, its nFPM definition and repository r
 bundle install
 bundle exec ruby -Ilib -e 'Dir["test/*_test.rb"].sort.each { |path| require_relative path }'
 gem build native-packages.gemspec
-ruby test/gem_install.rb native-packages-0.4.0.gem
+ruby test/gem_install.rb native-packages-0.5.0.gem
 ```
 
 Tests build real packages, inspect their payloads and exercise repository publication against local Git fixtures. CI additionally runs disposable Linux install/upgrade/remove checks, SRPM rebuilds and Windows MSIX acceptance. Runtime build manifests report installation as `not-tested`: CI fixture coverage is not a substitute for testing each application's packages.

data/docs/acceptance/0.5.0-notarization.md

@@ -0,0 +1,30 @@
+# Native Apple notarization acceptance, 2026-09-13
+
+A private Mac test used the candidate 0.5.0 implementation with the owner's
+Developer ID Application certificate and app-specific notarization credentials.
+No application release was created or replaced.
+
+- Verified the published Fastpotify v0.7.1 universal DMG against its release
+  checksum, then copied its app and notices into an isolated test input.
+- The shared native build signed its owned copy, verified both arm64 and x86_64
+  Mach-O slices, packaged a new DMG, obtained Apple acceptance, and stapled and
+  validated the notarization ticket before recording the package hash.
+- Gatekeeper accepted both the resulting DMG and its contained app with
+  `source=Notarized Developer ID`. The app binary ran `--version` successfully.
+- The portable command signed a newly compiled ARM64 executable, companion dylib
+  and app bundle, submitted a temporary ZIP, and obtained Apple acceptance
+  (submission `6a096e26-0f47-409f-b15d-654ff2a32292`). The app's stapled ticket
+  validated and Gatekeeper accepted it. Both standalone and bundled executables
+  successfully called the signed dylib after packaging. Non-code fixture data
+  remained unchanged, and the returned tree was archived as a tarball.
+
+All images were detached after inspection. The gem's temporary signing keychains
+were deleted. Original source payloads were not signed in place. Unit coverage
+also exercises absent/partial credentials, failed acceptance/stapling, private
+error redaction, inside-out signing and existing after-package hooks on both Mac
+and Windows, including Apple variables present on a Windows target.
+
+This is actual Apple service and native Gatekeeper evidence on the available
+Apple Silicon Mac. It is not an Intel execution test, a fresh-machine GUI test,
+or validation of Fastpotify playback, RekordFlash inference/models, FastsApp
+messaging or TonePush hardware. Those remain application acceptance work.

data/docs/apple-notarization.md

@@ -0,0 +1,86 @@
+# Apple signing and notarization
+
+Since native-packages 0.5.0, a native macOS DMG build automatically signs and
+notarizes when all six environment variables below are present. No variables
+preserves existing local/unsigned behavior. Any incomplete set fails with the
+missing variable names before packaging. Linux and Windows targets ignore these
+Apple variables. `validate` and `build --dry-run` remain offline.
+
+| Environment variable | Value |
+| --- | --- |
+| `APPLE_CERTIFICATE_P12` | Base64-encoded Developer ID Application certificate and private key, exported as PKCS#12 |
+| `APPLE_CERTIFICATE_PASSWORD` | Password protecting that export |
+| `APPLE_SIGNING_IDENTITY` | Exact `Developer ID Application: Name (TEAMID)` identity |
+| `APPLE_ID` | Apple Account email |
+| `APPLE_TEAM_ID` | Developer Program Team ID |
+| `APPLE_APP_PASSWORD` | Apple Account app-specific password |
+
+Store these in CI secrets and expose them as environment variables only in the
+trusted macOS release job. The gem does not fetch secrets from a password manager
+or GitHub. A free Apple account cannot replace Developer Program membership and
+a valid Developer ID Application certificate.
+
+## Native DMG builds
+
+Build the application's complete `.app` and prepare its configured native input
+first, then run the normal command on macOS:
+
+```sh
+native-packages --config native-packages.macos.yaml build \
+  --version 1.2.3 --target macos-universal --output dist/macos-packages
+```
+
+The gem imports the certificate and notary credentials into a fresh, temporary
+keychain. It never replaces the default keychain or its search list, and deletes
+its keychain after success or failure. Credential values are excluded from
+manifests and redacted from tool errors.
+
+The input is copied and checked before signing. All Mach-O code and nested
+frameworks/app bundles in the owned copy are signed from the inside out with a
+secure timestamp and hardened runtime. Existing entitlements and requirements
+are preserved; the gem does not invent exceptions such as disabling library
+validation. The application remains responsible for any required entitlements.
+
+Signing finishes **before `native.command`**. Its recipe must copy `@PAYLOAD@`
+unchanged, create the configured DMG, and avoid replacing signatures with ad-hoc
+ones. The original application input remains unchanged. `after_package` still
+runs, then the gem signs the DMG, submits it with `notarytool`, waits for Apple's
+`Accepted` result, staples and validates the ticket, and verifies the image.
+Only then are package hashes and the build manifest written. The manifest's
+package validation records Apple acceptance, submission ID and stapling.
+
+Remove redundant Apple signing and notarization from application hooks when
+adopting this flow. Existing Inno/MSIX signing hooks remain independent.
+Submission waits up to 30 minutes; failure or timeout prevents publication of a
+completed build. Apple may continue processing a timed-out submission.
+
+## Portable macOS archives
+
+A standalone executable cannot carry a stapled ticket, and Apple does not accept
+`.tar.gz` as a submission. Prepare the entire portable tree, including binaries,
+dylibs, models and notices, then use:
+
+```sh
+native-packages notarize-macos portable-input \
+  --output signed/Example-1.2.3-macos-arm64
+tar czf Example-1.2.3-macos-arm64.tar.gz \
+  -C signed Example-1.2.3-macos-arm64
+```
+
+The destination must be new and outside the input directory. This command needs
+no application configuration. With credentials, it signs only its copy, submits
+that exact code through a temporary ZIP, waits for acceptance, and staples and
+validates any `.app` bundles. It then publishes the signed directory atomically.
+Archive only that returned tree; do not modify its signed contents. Without
+credentials it copies the input unchanged and explicitly reports that signing
+and notarization were skipped.
+
+Standalone binaries rely on Gatekeeper's online ticket lookup. An accepted
+portable submission does not claim offline stapling support for raw executables.
+Notarization also does not replace app startup, model/GPU, entitlement, OS-version
+or installation testing. Test a fresh downloaded package with Gatekeeper before
+announcing the first notarized release.
+
+Apple references: [Developer ID certificates](https://developer.apple.com/help/account/certificates/create-developer-id-certificates/),
+[signing distribution code](https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac/),
+[notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution).

data/docs/configuration.md

@@ -39,7 +39,7 @@ before_build: [./scripts/build-linux.sh, '@ARCH@']
 
 It runs once per selected target in the configuration directory, before copying local inputs. `NATIVE_PACKAGES_TARGET` and `NATIVE_PACKAGES_VERSION` are also set. It is skipped in release mode and never executed by `validate`, `doctor` or a dry run. A shell script remains responsible for complex build operations.
 
-`after_package` is an optional argument array invoked once per generated package, before output hashes are recorded. It additionally receives `@PACKAGE@` and `@FORMAT@`. Use it for existing native signing tools, for example a Windows SDK SignTool script. It runs in local and release mode and must preserve the output filename and file set. The MSIX acceptance test uses SignTool because Windows rejected the signature produced by nFPM 2.47.0's built-in signer in that test.
+`after_package` is an optional argument array invoked once per generated package, before output hashes are recorded. For native DMG targets, automatic [Apple notarization](apple-notarization.md) runs after this hook; input signing completes before the native recipe. It additionally receives `@PACKAGE@` and `@FORMAT@`. Use it for existing native signing tools, for example a Windows SDK SignTool script. It runs in local and release mode and must preserve the output filename and file set. The MSIX acceptance test uses SignTool because Windows rejected the signature produced by nFPM 2.47.0's built-in signer in that test.
 
 ## Tokens and additional assets
 

data/docs/legacy.md

@@ -8,7 +8,7 @@ Applications keep their own configuration and templates. This repository holds t
 
 | Layer | Responsibility |
 | --- | --- |
-| Application build jobs | Compile for each OS and architecture; create compatible binaries, macOS bundles and Windows installers; sign and notarize where required. |
+| Application build jobs | Compile for each OS and architecture; create compatible binaries, macOS bundles and Windows installers; provide Apple credentials to shared native builds or retain their existing signing tools. |
 | nFPM | Turn a set of built files and package metadata into native package files. |
 | native-packages | Verify release checksums, render recipes, check Linux ELF dependencies, invoke nFPM, attach packaging assets, and stage or publish downstream updates. |
 | Distribution infrastructure | Build and review submitted recipes, host package indexes, and make packages available to users. |

data/docs/native-recipes.md

@@ -1,14 +1,16 @@
-# Native DMG and Inno recipes (0.3)
+# Native DMG and Inno recipes
 
 The shared build command can coordinate existing macOS and Windows packaging
 scripts. These are native command adapters, separate from nFPM. They do not
-generate an installer recipe, compile an app, supply signing identities or
-automatically notarize anything. The application retains those decisions.
+generate an installer recipe or compile an app. Since 0.5.0, complete Apple
+credentials automatically enable Developer ID signing and notarization for DMG
+targets. The application supplies its identity, bundle contents and entitlements.
+See [Apple notarization](apple-notarization.md).
 
 ```yaml
 schema: 1
 tool:
-  version: '0.3.0'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app
@@ -55,9 +57,9 @@ the configuration for compatibility with mixed Linux/native builds.
 
 `native.command` is a nonempty argument array, including `@PACKAGE@`, which
 resolves to the exact output filename in a fresh directory. `@PAYLOAD@` is an
-owned copy of the input directory's contents. It does not retain the original
-directory's basename: a DMG script should copy it into its own temporary
-`Example.app` folder before calling hdiutil. Other existing target tokens apply.
+owned copy of the input directory's contents. A top-level `.app` retains its basename; other input directories use `payload`.
+A DMG script should copy the owned input into its own temporary
+`Example.app` folder or image staging directory before calling hdiutil. Other existing target tokens apply.
 Commands run in the application configuration directory and receive the same
 target/version environment as other build hooks.
 
@@ -70,17 +72,18 @@ must check its own additional tools. Mac architecture inspection also needs
 Apple's `lipo`. Supported Mac targets are `amd64`, `arm64` and `universal` (both).
 
 Input copying preserves file modes and internal relative symlinks, including
-framework links. Escaping, dangling and special-file entries fail. The staged
-tree must match the original digest and remain unchanged after packaging and
-signing hooks. Package only this staged input; do not read another application
+framework links. Escaping, dangling and special-file entries fail. The initial staged tree must match the original digest. Automatic Apple
+signing then signs only that owned copy. The signed staged tree must remain
+unchanged after application packaging and `after_package` hooks. Package only this staged input; do not read another application
 build from a global location. Recipes should preserve existing destinations,
 clean only their own temporary files and use argument arrays for subprocesses.
 
 The command must create exactly its declared `.dmg` or `.exe` file. The adapter
 checks a UDIF trailer or PE container respectively. This is a container check,
-not proof of a valid installer, signature or application. The existing
-`after_package` hook can sign/notarize the output in place before the final hash
-is recorded. Do not modify a package after building its manifest: signature
+not proof of a valid installer, signature or application. The existing `after_package` hook runs before automatic Apple DMG signing,
+notarization and stapling, all before the final hash is recorded. Remove redundant
+Apple signing/notarization hooks when enabling automatic credentials. Other
+application-specific output hooks remain supported. Do not modify a package after building its manifest: signature
 stapling changes bytes and must run inside that hook if the manifest is to verify.
 
 Applications should invoke hdiutil's verification, platform signature checks and

data/docs/platforms.md

@@ -12,11 +12,11 @@ All seven nFPM 2.47.0 packagers are exposed by the v0.2 CLI. Each target explici
 | MSIX | nFPM `msix`, PE architecture checks, `after_package` hook for native signing | Windows executables/DLLs, application identity, assets, capabilities and signing certificate |
 | SRPM | nFPM `srpm`, source/spec input validation | A correct spec and sources, native rebuild testing |
 | AUR | Template rendering, `.SRCINFO`, staged Git publication | Native PKGBUILD source/bin/git variants and build checks |
-| Homebrew | Hash/render supplied formulae or casks and publish a tap | macOS bundles, signing/notarization, native recipe logic |
+| Homebrew | Hash/render supplied formulae or casks and publish a tap | Completed macOS assets, native recipe logic |
 | Nixpkgs/Gentoo/Void and similar repositories | Template rendering and configured Git/PR/MR publication | Native recipes, dependency hashes, distro checks and review |
 | Flatpak | No build/publication adapter yet | Use flatpak-builder and native manifests/runtime/sandbox settings |
 | Inno Setup | Native command adapter, PE inspection, copied input and final output hashes | Inno recipe/compiler, application version mapping, signing and installation tests |
-| macOS DMG | Native command adapter, Mach-O inspection, copied bundle and final output hashes | Bundle, hdiutil recipe, signing/notarization, update/rollback testing |
+| macOS DMG | Native command adapter, Mach-O inspection, automatic Developer ID signing/notarization with Apple credentials, final stapled hashes | Bundle, hdiutil recipe, Apple credentials/entitlements, update/rollback testing |
 | Other Windows installers | No adapter for NSIS/WiX yet | Existing native tools and WinGet/Scoop integrations |
 
 The IPK acceptance fixture targets OpenWrt 24.10.8. OpenWrt 25.12 switched to APK, so IPK is not the package format for every OpenWrt release. [OpenWrt 25.12 release notes](https://openwrt.org/releases/25.12/notes-25.12.0)

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.4.0'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.4.0'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/build.rb

@@ -3,6 +3,7 @@
 require_relative "configuration"
 require_relative "inspection"
 require_relative "native_recipe"
+require_relative "macos_signing"
 
 module NativePackages
   class Build
@@ -35,6 +36,7 @@ module NativePackages
         next unless target["native"]
         metadata = configuration.target_tokens(configuration.tokens("9.8.7"), id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
         NativeRecipe.new(root).doctor(target, render_tree(target.fetch("native").fetch("command"), metadata))
+        MacosSigning.new(root).doctor if target["platform"] == "macos"
       end
       required = []
       required << "readelf" if selected.values.any? { |target| target["platform"] == "linux" && target.fetch("kind", "binary") == "binary" }
@@ -129,52 +131,58 @@ module NativePackages
           digest = native ? native.digest(source) : input_digest(source)
           sources << { "target" => id, "path" => source.to_s, "sha256" => digest }
           Dir.mktmpdir("native-packages-input-") do |directory|
-            payload = Pathname.new(directory) / "payload"
+            payload = Pathname.new(directory) / (native && source.extname == ".app" ? source.basename : "payload")
             if native
               FileUtils.cp_r(source, payload, preserve: true)
               raise Error, "native input changed while staging" unless native.digest(payload) == digest
             else
               copy_input(source, payload, input.fetch("kind", "archive"))
             end
-            target.fetch("formats").each do |format|
-              destination = staging / "packages" / id / format
-              destination.mkpath
-              if native
-                inspection = native.inspect(payload, target)
-                recipe = target.fetch("native")
-                tokens = configuration.target_tokens(info, id, target, payload)
-                package_path = destination / render(recipe.fetch("output"), tokens)
-                run(*render_tree(recipe.fetch("command"), tokens.merge("PACKAGE" => package_path.to_s, "FORMAT" => format)),
-                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s, "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
-                packages = files(destination)
-                raise Error, "native recipe must create only its declared output" unless packages == [package_path]
-                native.check_output(package_path, format)
-              else
-                package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
-                if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
-                  raise Error, "prerelease package versions must use unmodified nFPM semver conversion"
+            signer = target["platform"] == "macos" ? MacosSigning.new(root) : nil
+            with_signing(signer) do |signing|
+              signing.sign_payload(payload) if signing
+              payload_digest = native && native.digest(payload)
+              target.fetch("formats").each do |format|
+                destination = staging / "packages" / id / format
+                destination.mkpath
+                if native
+                  inspection = native.inspect(payload, target)
+                  recipe = target.fetch("native")
+                  tokens = configuration.target_tokens(info, id, target, payload)
+                  package_path = destination / render(recipe.fetch("output"), tokens)
+                  run(*render_tree(recipe.fetch("command"), tokens.merge("PACKAGE" => package_path.to_s, "FORMAT" => format)),
+                    env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s, "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                  packages = files(destination)
+                  raise Error, "native recipe must create only its declared output" unless packages == [package_path]
+                  native.check_output(package_path, format)
+                else
+                  package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+                  if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
+                    raise Error, "prerelease package versions must use unmodified nFPM semver conversion"
+                  end
+                  package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
+                    "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
+                  inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+                  config_path = Pathname.new(directory) / "nfpm.yaml"
+                  write(config_path, YAML.dump(package))
+                  run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
+                    env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
+                  packages = files(destination)
+                  raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
                 end
-                package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
-                  "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
-                inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
-                config_path = Pathname.new(directory) / "nfpm.yaml"
-                write(config_path, YAML.dump(package))
-                run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
-                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
-                packages = files(destination)
-                raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
-              end
-              if target["after_package"]
-                signing = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
-                run(*render_tree(target.fetch("after_package"), signing), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
-                raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
-              end
-              if native
-                native.check_output(packages.first, format)
-                raise Error, "native recipes/signing must not change their input payload" unless native.digest(payload) == digest
+                if target["after_package"]
+                  hook_tokens = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
+                  run(*render_tree(target.fetch("after_package"), hook_tokens), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                  raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
+                end
+                if native
+                  native.check_output(packages.first, format)
+                  raise Error, "native recipes/signing must not change their input payload" unless native.digest(payload) == payload_digest
+                end
+                inspection["apple"] = signing.notarize(packages.first) if signing
+                records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
+                  "sha256" => sha256(packages.first), "validation" => inspection }
               end
-              records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
-                "sha256" => sha256(packages.first), "validation" => inspection }
             end
           end
         end
@@ -194,6 +202,14 @@ module NativePackages
       output
     end
 
+    def with_signing(signer)
+      if signer&.enabled?
+        signer.with_identity { |active| yield active }
+      else
+        yield nil
+      end
+    end
+
     def release_cache(info)
       repository = configuration.data.fetch("release").fetch("repository")
       raise Error, "release.repository must be owner/repository" unless /\A[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\z/.match?(repository)

data/lib/native_packages/cli.rb

@@ -14,6 +14,7 @@ module NativePackages
           [--target ID] [--format FORMAT]          Select targets/formats (repeatable)
           [--output DIRECTORY] [--dry-run]         Choose output or inspect the plan
           [--defer-recipes]                        Build targets without recipe assets/tools
+        notarize-macos DIRECTORY --output DIRECTORY Copy, sign and notarize portable Mac code
         aggregate DIR... --output DIRECTORY        Combine target builds before publishing
           [--finalize-recipes]                    Generate recipes from deferred builds
         publish --from DIRECTORY --to github,aur   Publish a complete, verified build
@@ -46,7 +47,7 @@ module NativePackages
       parser = OptionParser.new do |flags|
         flags.on("--config FILE") { |value| config_path = value }
         flags.on("--help", "-h") { puts HELP; return }
-        flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare].include?(command)
+        flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare notarize-macos].include?(command)
         flags.on("--body-file FILE") { |value| options[:body_file] = Pathname.new(value).expand_path(root) } if command == "publish"
         if %w[build doctor].include?(command)
           flags.on("--target ID") { |value| options[:ids] << value }
@@ -78,7 +79,7 @@ module NativePackages
       parser.parse!(arguments)
       arity = { "init" => 0..0, "migrate" => 0..0, "build" => 0..0, "doctor" => 0..0, "aggregate" => 1..,
         "prepare" => 1..1, "check" => 1..1, "artifacts" => 1..1, "publish-release" => 2..2,
-        "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
+        "notarize-macos" => 1..1, "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
         "publish-aur" => 1..1, "status" => 0..1, "check-version" => 1..1, "validate" => 0..0 }[command]
       raise Error, HELP unless arity&.cover?(arguments.length)
       if command == "init"
@@ -86,6 +87,10 @@ module NativePackages
         return Scaffold.new(root).init(**options.slice(:interactive, :name, :input).merge(formats: options[:init_formats]))
       end
       return Scaffold.new(root).migrate(dry_run: options[:dry_run]) if command == "migrate"
+      if command == "notarize-macos"
+        raise Error, "notarize-macos requires --output" unless options[:output]
+        return MacosSigning.new(root).prepare_directory(arguments.first, output: options.fetch(:output))
+      end
       path = Configuration.discover(root, config_path)
       configuration = path && Configuration.new(path)
       if %w[build doctor aggregate].include?(command) || options[:from]

data/lib/native_packages/macos_signing.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+module NativePackages
+  # Apple credentials opt native DMG builds into Developer ID distribution.
+  # Only the owned staging copy is signed; caller inputs and keychains survive.
+  class MacosSigning
+    include Support
+    VARIABLES = %w[APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD].freeze
+    BUNDLES = %w[.app .framework .xpc .appex .bundle .plugin].freeze
+    attr_reader :root
+
+    def initialize(root, environment = ENV)
+      @root = root
+      @credentials = VARIABLES.to_h { |name| [name, environment[name].to_s] }
+      @redactions = @credentials.values.reject(&:empty?)
+    end
+
+    def enabled? = @credentials.values.any? { |value| !value.empty? }
+
+    def doctor
+      return unless enabled?
+      missing = @credentials.select { |_, value| value.strip.empty? }.keys
+      raise Error, "incomplete Apple notarization credentials: configure #{missing.join(', ')}" unless missing.empty?
+      identity = @credentials.fetch("APPLE_SIGNING_IDENTITY")
+      team = @credentials.fetch("APPLE_TEAM_ID")
+      unless identity.start_with?("Developer ID Application: ") && identity.end_with?("(#{team})")
+        raise Error, "APPLE_SIGNING_IDENTITY must be a Developer ID Application identity for APPLE_TEAM_ID"
+      end
+      begin
+        @certificate = @credentials.fetch("APPLE_CERTIFICATE_P12").delete("\r\n").unpack1("m0")
+        raise ArgumentError if @certificate.empty?
+      rescue ArgumentError
+        raise Error, "APPLE_CERTIFICATE_P12 must contain a base64-encoded PKCS#12 certificate and private key"
+      end
+      missing_tools = %w[security codesign xcrun hdiutil ditto].reject { |tool| available?(tool) }
+      raise Error, "install required Apple tools: #{missing_tools.join(', ')}" unless missing_tools.empty?
+      execute "xcrun", "--find", "notarytool"
+      execute "xcrun", "--find", "stapler"
+    end
+
+    def with_identity
+      doctor
+      return yield(nil) unless enabled?
+      Dir.mktmpdir("native-packages-signing-") do |directory|
+        @keychain = Pathname.new(directory) / "signing.keychain-db"
+        certificate = Pathname.new(directory) / "certificate.p12"
+        File.write(certificate, @certificate, mode: "wb", perm: 0o600)
+        password = OpenSSL::Random.random_bytes(32).unpack1("H*")
+        @redactions << password
+        begin
+          execute "security", "create-keychain", "-p", password, @keychain
+          execute "security", "set-keychain-settings", "-lut", "21600", @keychain
+          execute "security", "unlock-keychain", "-p", password, @keychain
+          execute "security", "import", certificate, "-k", @keychain,
+            "-P", @credentials.fetch("APPLE_CERTIFICATE_PASSWORD"), "-T", "/usr/bin/codesign"
+          execute "security", "set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-k", password, @keychain
+          identities = execute "security", "find-identity", "-v", "-p", "codesigning", @keychain
+          unless identities.include?(%Q{"#{@credentials.fetch("APPLE_SIGNING_IDENTITY")}"})
+            raise Error, "imported P12 has no valid private signing identity matching APPLE_SIGNING_IDENTITY"
+          end
+          execute "xcrun", "notarytool", "store-credentials", "native-packages", "--keychain", @keychain,
+            "--apple-id", @credentials.fetch("APPLE_ID"), "--team-id", @credentials.fetch("APPLE_TEAM_ID"),
+            "--password", @credentials.fetch("APPLE_APP_PASSWORD")
+          yield self
+        ensure
+          # Never replace the user's search list or default keychain. Deleting
+          # just this keychain also removes its own entry from the search list.
+          execute "security", "delete-keychain", @keychain if @keychain.exist?
+          @keychain = nil
+        end
+      end
+    end
+
+    def sign_payload(payload)
+      tree = NativeRecipe.new(root).tree(payload)
+      paths = tree.filter_map do |relative, kind, *|
+        path = payload / relative
+        if kind == "file" && NativeRecipe::MACHO.include?(path.binread(4).unpack1("H*"))
+          path
+        elsif kind == "directory" && (BUNDLES.include?(path.extname) || (path / "Contents/Info.plist").file?)
+          path
+        end
+      end
+      raise Error, "Apple signing needs a payload containing Mach-O code" if paths.empty?
+      # Files first, then their containing code bundles, including frameworks.
+      paths.sort_by { |path| [-path.each_filename.count, path.to_s] }.each do |path|
+        metadata = path.directory? ? "entitlements,requirements" : "identifier,entitlements,requirements"
+        execute "codesign", "--force", "--timestamp", "--options", "runtime",
+          "--preserve-metadata=#{metadata}", "--keychain", @keychain,
+          "--sign", @credentials.fetch("APPLE_SIGNING_IDENTITY"), path
+        execute "codesign", "--verify", "--strict", path
+      end
+    end
+
+    def notarize(package)
+      execute "hdiutil", "verify", package
+      execute "codesign", "--force", "--timestamp", "--keychain", @keychain,
+        "--sign", @credentials.fetch("APPLE_SIGNING_IDENTITY"), package
+      execute "codesign", "--verify", "--strict", package
+      response = submit(package)
+      execute "xcrun", "stapler", "staple", package
+      execute "xcrun", "stapler", "validate", package
+      execute "hdiutil", "verify", package
+      puts "Apple accepted #{package.basename}; its notarization ticket is stapled and validated."
+      { "signature" => "developer-id", "notarization" => "accepted", "submission_id" => response.fetch("id"), "stapled" => true }
+    end
+
+    def submit(package)
+      puts "Submitting #{package.basename} to Apple's notary service..."
+      response = JSON.parse(execute("xcrun", "notarytool", "submit", package,
+        "--keychain-profile", "native-packages", "--keychain", @keychain,
+        "--wait", "--timeout", "30m", "--output-format", "json"))
+      unless response["status"] == "Accepted"
+        raise Error, "Apple notarization was not accepted (submission #{response.fetch('id', 'unknown')}); inspect the notarytool log before distributing"
+      end
+      response.fetch("id")
+      response
+    rescue JSON::ParserError, KeyError
+      raise Error, "Apple notary service returned an invalid result; no package was published"
+    end
+
+    # A portable tarball cannot itself be submitted or stapled. Apple accepts
+    # the exact signed code through a temporary ZIP; the app owns the final tar.
+    def prepare_directory(source, output:)
+      source = Pathname.new(source).expand_path(root)
+      output = Pathname.new(output).expand_path(root)
+      raise Error, "output exists: #{output}; choose a fresh --output" if output.exist?
+      if output.to_s.start_with?(source.to_s + File::SEPARATOR)
+        raise Error, "signed output must be outside the input directory"
+      end
+      native = NativeRecipe.new(root)
+      original = native.digest(source)
+      raise Error, "macOS signing must run on macOS" if enabled? && NativeRecipe.host != "macos"
+      output.dirname.mkpath
+      Dir.mktmpdir(".native-packages-macos-", output.dirname) do |directory|
+        copied = Pathname.new(directory) / source.basename
+        FileUtils.cp_r(source, copied, preserve: true)
+        raise Error, "native input changed while staging" unless native.digest(copied) == original
+        with_identity do |signing|
+          if signing
+            sign_payload(copied)
+            archive = Pathname.new(directory) / "notarization.zip"
+            execute "ditto", "-c", "-k", "--keepParent", copied, archive
+            response = submit(archive)
+            native.tree(copied).each do |relative, kind, *|
+              bundle = copied / relative
+              next unless kind == "directory" && bundle.extname == ".app"
+              execute "xcrun", "stapler", "staple", bundle
+              execute "xcrun", "stapler", "validate", bundle
+            end
+            puts "Apple accepted portable code (submission #{response.fetch('id')}). Standalone executables use online ticket lookup."
+          else
+            puts "Apple credentials are absent; copying portable code without signing or notarization."
+          end
+        end
+        copied.rename(output)
+      end
+      output
+    end
+
+    def execute(*arguments)
+      capture(*arguments)
+    rescue Error => error
+      message = error.message.b
+      @redactions.sort_by { |value| -value.bytesize }.each { |value| message.gsub!(value.b, "[REDACTED]") }
+      raise Error, message
+    end
+  end
+end

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
   class Error < StandardError; end
 
   module Support

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Carmine Paolino
@@ -18,6 +18,8 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - README.md
+- docs/acceptance/0.5.0-notarization.md
+- docs/apple-notarization.md
 - docs/cli-design.md
 - docs/configuration.md
 - docs/legacy.md
@@ -36,6 +38,7 @@ files:
 - lib/native_packages/cli.rb
 - lib/native_packages/configuration.rb
 - lib/native_packages/inspection.rb
+- lib/native_packages/macos_signing.rb
 - lib/native_packages/native_recipe.rb
 - lib/native_packages/project.rb
 - lib/native_packages/repositories.rb