release/darwin/README.txt


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55


macOS app bundling guide
========================

Install Code Signing Certificate
--------------------------------

* Go to https://developer.apple.com/account/resources/certificates/list
* Download the Developer ID Application certificate.
* Double click the file and add to key chain (default options).
* Delete the file from the Downloads folder.

* You will also need to install a .p12 public/private key file for the
  certificate. This is only available for the owner of the Blender account,
  or can be exported and copied from another system that already has code
  signing set up.

Find the codesigning identity by running:

$ security find-identity -v -p codesigning

"Developer ID Application: Stichting Blender Foundation" is the identity needed.
The long code at the start of the line is used as <identity> below.

Setup Apple ID
--------------

* The Apple ID must have two step verification enabled.
* Create an app specific password for the code signing app (label can be anything):
https://support.apple.com/en-us/HT204397
* Add the app specific password to keychain:

$ security add-generic-password -a <apple-id> -w <app-specific-password> -s altool-password

When running the bundle script, there will be a popup. To avoid that either:
* Click Always Allow in the popup
* In the Keychain Access app, change the Access Control settings on altool-password

Bundle
------

Then the bundle is created as follows:

$ ./bundle.sh --source <sourcedir> --dmg <dmg> --bundle-id <bundleid> --username <apple-id> --password "@keychain:altool-password" --codesign <identity>

<sourcedir>  directory where built Blender.app is
<dmg>	       location and name of the final disk image
<bundleid>   id on notarization, for example org.blenderfoundation.blender.release
<apple-id>   your appleid email
<identity>   codesigning identity

When specifying only --sourcedir and --dmg, the build will not be signed.

Example :
$ ./bundle.sh --source /data/build/bin --dmg /data/Blender-2.8-alpha-macOS-10.11.dmg --bundle-id org.blenderfoundation.blender.release --username "foo@mac.com" --password "@keychain:altool-password" --codesign AE825E26F12D08B692F360133210AF46F4CF7B97