From 2c5f92c5c4ce479e45bacbf4fb52a1dcf771c095 Mon Sep 17 00:00:00 2001
From: ZeldaZach <zahalpern+github@gmail.com>
Date: Thu, 9 Jan 2025 00:00:31 -0500
Subject: [PATCH] Try something else... closer maybe?

---
 .github/workflows/desktop-build.yml |  8 ++++----
 CMakeLists.txt                      |  1 +
 cmake/SignMacApplications.cmake     | 22 ++++++++++++++++++++++
 3 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 cmake/SignMacApplications.cmake

diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 072b1aa36..1ec6d9fd4 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -280,10 +280,10 @@ jobs:
           security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
           security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/cockatrice/cockatrice.app" 
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/oracle/oracle.app"
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/servatrice/servatrice.app"
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/dbconverter/dbconverter.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "./build/cockatrice/cockatrice.app" 
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "./build/oracle/oracle.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "./build/servatrice/servatrice.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "./build/dbconverter/dbconverter.app"
 
 #      - name: CodeSign app bundle
 #        env:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3080c0bbf..f8d06735c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -276,6 +276,7 @@ if(UNIX)
     set(CPACK_PACKAGE_ICON "${CMAKE_CURRENT_SOURCE_DIR}/cockatrice/resources/appicon.icns")
     set(CPACK_DMG_DS_STORE_SETUP_SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/cmake/CMakeDMGSetup.script")
     set(CPACK_DMG_BACKGROUND_IMAGE "${CMAKE_CURRENT_SOURCE_DIR}/cmake/dmgBackground.tif")
+    set(CPACK_PRE_BUILD_SCRIPTS "${CMAKE_CURRENT_SOURCE_DIR}/cmake/SignMacApplications.cmake")
   else()
     # linux
     if(CPACK_GENERATOR STREQUAL "RPM")
diff --git a/cmake/SignMacApplications.cmake b/cmake/SignMacApplications.cmake
new file mode 100644
index 000000000..8b270a02a
--- /dev/null
+++ b/cmake/SignMacApplications.cmake
@@ -0,0 +1,22 @@
+# This script re-signs all apps after CPack packages them. This is necessary because CPack modifies
+# the library references used by Cockatrice to App relative paths, invalidating the code signature.
+if(APPLE)
+    set(APPLICATIONS "cockatrice" "servatrice" "oracle" "dbconverter")
+    foreach(app_name IN LISTS APPLICATIONS)
+        set(FULL_APP_PATH "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/${app_name}.app")
+        message(STATUS "Re-signing ${app_name}.app")
+        execute_process(COMMAND
+                "codesign"
+                "--sign"
+                    "Developer ID Application: Zachary Halpern (STKV3NKYBF)"
+                "--entitlements"
+                    "../.ci/macos.entitlements"
+                "--options"
+                    "runtime"
+                "--force"
+                "--deep"
+                "--timestamp"
+                "--verbose"
+                "${FULL_APP_PATH}")
+    endforeach()
+endif()
\ No newline at end of file