Revert accidentally pushed commits

This reverts commit 81de0ee97b.
This reverts commit b4450f0ee5.
This reverts commit d5a128d342.
This reverts commit 580028816c.

.github/workflows/mac_codesign.yml

@@ -1,27 +0,0 @@
-name: macOS build and codesign
-
-on:
-  workflow_dispatch: # Enables manual trigger from GitHub UI
-
-jobs:
-  build-and-code-sign:
-    runs-on: macos-latest
-    environment: macos-codesign
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.79
-      - name: build
-        run: |
-          cargo install apple-codesign
-          echo "$MAC_CODESIGN_APP_P12_BASE64" | base64 --decode > /tmp/app.p12
-          echo "$MAC_CODESIGN_INSTALLER_P12_BASE64" | base64 --decode > /tmp/installer.p12
-          ./build_tools/make_pkg.sh -s -f /tmp/app.p12 -i /tmp/installer.p12 -p "$MAC_CODESIGN_PASSWORD"
-          rm /tmp/installer.p12 /tmp/app.p12
-        env:
-          MAC_CODESIGN_APP_P12_BASE64: ${{ secrets.MAC_CODESIGN_APP_P12_BASE64 }}
-          MAC_CODESIGN_INSTALLER_P12_BASE64: ${{ secrets.MAC_CODESIGN_INSTALLER_P12_BASE64 }}
-          MAC_CODESIGN_PASSWORD: ${{ secrets.MAC_CODESIGN_PASSWORD }}
-          # macOS runners keep having issues loading Cargo.toml dependencies from git (GitHub) instead
-          # of crates.io, so give this a try. It's also sometimes significantly faster on all platforms.
-          CARGO_NET_GIT_FETCH_WITH_CLI: true
-          FISH_ARTEFACT_PATH: /tmp/fish-built

build_tools/mac_codesign.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-
-# Code sign executables or packages for macOS using rcodesign.
-
-set -e
-
-die() { echo "$*" 1>&2; exit 1; }
-
-usage() {
-  die "Usage: $0 -f <p12 file> -p <p12 password> [-e <entitlements file>] <executable1> [<executable2> ...]"
-}
-
-while getopts "i:f:p:e:" opt; do
-  case $opt in
-    f) P12_FILE="$OPTARG";;
-    p) P12_PASSWORD="$OPTARG";;
-    e) ENTITLEMENTS_FILE="$OPTARG";;
-    \?) usage;;
-  esac
-done
-
-shift $((OPTIND -1))
-
-if [ -z "$P12_FILE" ] || [ -z "$P12_PASSWORD" ]; then
-  usage
-fi
-
-if [ $# -lt 1 ]; then
-  usage
-fi
-
-if ! command -v rcodesign &> /dev/null; then
-  die "rcodesign is not installed. Please install it: cargo install apple-codesign"
-fi
-
-for EXECUTABLE in "$@"; do
-    ARGS=(
-        --p12-file "$P12_FILE"
-        --p12-password "$P12_PASSWORD"
-        --code-signature-flags runtime
-    )
-
-    if [ -n "$ENTITLEMENTS_FILE" ]; then
-        ARGS+=(--entitlements-xml-file "$ENTITLEMENTS_FILE")
-    fi
-
-    rcodesign sign "${ARGS[@]}" $EXECUTABLE
-done

build_tools/make_pkg.sh

@@ -2,32 +2,6 @@
 
 # Script to produce an OS X installer .pkg and .app(.zip)
 
-usage() {
-  echo "Usage: $0 [-s] -f <application p12 file> -i <installer p12 file> -p <p12 password> [-e <entitlements file>]"
-  exit 1
-}
-
-set -x
-set -e
-
-SIGN=
-
-while getopts "sf:i:p:e:" opt; do
-  case $opt in
-    s) SIGN=1;;
-    f) P12_APP_FILE=$(realpath "$OPTARG");;
-    i) P12_INSTALL_FILE=$(realpath "$OPTARG");;
-    p) P12_PASSWORD="$OPTARG";;
-    e) ENTITLEMENTS_FILE=$(realpath "$OPTARG");;
-    \?) usage;;
-  esac
-done
-
-if [ -n "$SIGN" ] && ([ -z "$P12_APP_FILE" ] || [-z "$P12_INSTALL_FILE"] || [ -z "$P12_PASSWORD" ]); then
-  usage
-fi
-
-
 VERSION=$(git describe --always --dirty 2>/dev/null)
 if test -z "$VERSION" ; then
   echo "Could not get version from git"
@@ -38,8 +12,16 @@ fi
 
 echo "Version is $VERSION"
 
+set -x
+
+#Exit on error
+set -e
+
+# Respect MAC_CODESIGN_ID, or default for ad-hoc.
+# Note the :- means "or default" and the following - is the value.
+MAC_CODESIGN_ID=${MAC_CODESIGN_ID:--}
+
 PKGDIR=$(mktemp -d)
-echo "$PKGDIR"
 
 SRC_DIR=$PWD
 OUTPUT_PATH=${FISH_ARTEFACT_PATH:-~/fish_built}
@@ -48,53 +30,14 @@ mkdir -p "$PKGDIR/build" "$PKGDIR/root" "$PKGDIR/intermediates" "$PKGDIR/dst"
 
 # Pass FISH_USE_SYSTEM_PCRE2=OFF because a system PCRE2 on macOS will not be signed by fish,
 # and will probably not be built universal, so the package will fail to validate/run on other systems.
-{ cd "$PKGDIR/build" && cmake -DMAC_INJECT_GET_TASK_ALLOW=OFF -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_EXE_LINKER_FLAGS="-Wl,-ld_classic" -DWITH_GETTEXT=OFF -DFISH_USE_SYSTEM_PCRE2=OFF -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64' "$SRC_DIR" && make VERBOSE=1 -j 12 && env DESTDIR="$PKGDIR/root/" make install; }
-
-if test -n "$SIGN"; then
-    echo "Signing executables"
-    ARGS=(
-        --p12-file "$P12_APP_FILE"
-        --p12-password "$P12_PASSWORD"
-        --code-signature-flags runtime
-    )
-    if [ -n "$ENTITLEMENTS_FILE" ]; then
-        ARGS+=(--entitlements-xml-file "$ENTITLEMENTS_FILE")
-    fi
-    for FILE in "$PKGDIR"/root/usr/local/bin/*; do
-        (set +x; rcodesign sign "${ARGS[@]}" "$FILE")
-    done
-fi
-
+{ cd "$PKGDIR/build" && cmake -DMAC_INJECT_GET_TASK_ALLOW=OFF -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_EXE_LINKER_FLAGS="-Wl,-ld_classic" -DWITH_GETTEXT=OFF -DFISH_USE_SYSTEM_PCRE2=OFF -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64' -DMAC_CODESIGN_ID="${MAC_CODESIGN_ID}" "$SRC_DIR" && make VERBOSE=1 -j 12 && env DESTDIR="$PKGDIR/root/" make install; }
 pkgbuild --scripts "$SRC_DIR/build_tools/osx_package_scripts" --root "$PKGDIR/root/" --identifier 'com.ridiculousfish.fish-shell-pkg' --version "$VERSION" "$PKGDIR/intermediates/fish.pkg"
 productbuild  --package-path "$PKGDIR/intermediates" --distribution "$SRC_DIR/build_tools/osx_distribution.xml" --resources "$SRC_DIR/build_tools/osx_package_resources/" "$OUTPUT_PATH/fish-$VERSION.pkg"
 
-if test -n "$SIGN"; then
-    echo "Signing installer"
-    ARGS=(
-        --p12-file "$P12_INSTALL_FILE"
-        --p12-password "$P12_PASSWORD"
-        --code-signature-flags runtime
-    )
-    (set +x; rcodesign sign "${ARGS[@]}" "$OUTPUT_PATH/fish-$VERSION.pkg")
-fi
+MAC_PRODUCTSIGN_ID=${MAC_PRODUCTSIGN_ID:--}
+productsign --sign "${MAC_PRODUCTSIGN_ID}" "$OUTPUT_PATH/fish-$VERSION.pkg" "$OUTPUT_PATH/fish-$VERSION-signed.pkg" && mv "$OUTPUT_PATH/fish-$VERSION-signed.pkg" "$OUTPUT_PATH/fish-$VERSION.pkg"
 
 # Make the app
-cd "$PKGDIR/build"
-make -j 12 fish_macapp
-if test -n "$SIGN"; then
-    echo "Signing app"
-    ARGS=(
-        --p12-file "$P12_APP_FILE"
-        --p12-password "$P12_PASSWORD"
-        --code-signature-flags runtime
-    )
-    if [ -n "$ENTITLEMENTS_FILE" ]; then
-        ARGS+=(--entitlements-xml-file "$ENTITLEMENTS_FILE")
-    fi
-    (set +x; rcodesign sign "${ARGS[@]}" "fish.app")
-
-fi
-mv "fish.app" "$OUTPUT_PATH/fish-$VERSION.app"
-zip -r "$OUTPUT_PATH/fish-$VERSION.app.zip" "$OUTPUT_PATH/fish-$VERSION.app";
+{ cd "$PKGDIR/build" && make -j 12 signed_fish_macapp && zip -r "$OUTPUT_PATH/fish-$VERSION.app.zip" fish.app; }
 
 rm -rf "$PKGDIR"