Merge pull request #48 from Barre/sign_apple

Implement notarization on desktop apple binaries.

.github/workflows/ci.yml

@@ -224,6 +224,16 @@ jobs:
         name: Install rust apple arm target
         run: rustup target add aarch64-apple-darwin
 
+      - if: startsWith(matrix.os, 'macos') == true
+        name: Install apple api key private key
+        run: |
+          mkdir -p ~/private_keys
+          echo "$API_KEY" >> ~/private_keys/AuthKey_"$API_KEY_ID".p8
+        shell: bash
+        env:
+          API_KEY: ${{secrets.APPLE_API_KEY_CONTENTS}}
+          API_KEY_ID: ${{secrets.APPLE_API_KEY}}
+
       - name: Install node packages
         working-directory: ./web_frontend
         run: npm i
@@ -238,6 +248,12 @@ jobs:
         uses: tauri-apps/tauri-action@5a6072a9edbbf71718caee364b5b96731d7580fc #v0 does not handle universal builds
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
         with:
           tagName: privaxy-v__VERSION__ # the action automatically replaces \_\_VERSION\_\_ with the app version
           releaseName: 'Privaxy v__VERSION__'

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## v0.5.1
+
+- Apple build of desktop app is now notarized.
+
 ## v0.5.0
 
 - Add builds for apple silicon

Cargo.toml

@@ -8,6 +8,10 @@ lto = true
 codegen-units = 1
 opt-level = 3
 
+[profile.release.package.privaxy_app]
+codegen-units = 1
+opt-level = 3
+
 [profile.release.package.web_frontend]
 codegen-units = 1
 opt-level = 's'

src-tauri/tauri.conf.json

@@ -7,7 +7,7 @@
   },
   "package": {
     "productName": "Privaxy",
-    "version": "0.5.0"
+    "version": "0.5.1"
   },
   "tauri": {
     "allowlist": {