Sign release builds and add GitHub updater

Author: LvDAO

.github/workflows/ci.yml

@@ -55,7 +55,19 @@ jobs:
         id: version
         run: echo "value=$(tr -d '[:space:]' < VERSION)" >> "$GITHUB_OUTPUT"
 
+      - name: Import codesigning identity
+        if: ${{ secrets.MACKEYMAP_SIGNING_CERT_BASE64 != '' && secrets.MACKEYMAP_SIGNING_CERT_PASSWORD != '' && secrets.MACKEYMAP_KEYCHAIN_PASSWORD != '' && secrets.MACKEYMAP_SIGN_IDENTITY != '' }}
+        env:
+          MACKEYMAP_SIGNING_CERT_BASE64: ${{ secrets.MACKEYMAP_SIGNING_CERT_BASE64 }}
+          MACKEYMAP_SIGNING_CERT_PASSWORD: ${{ secrets.MACKEYMAP_SIGNING_CERT_PASSWORD }}
+          MACKEYMAP_KEYCHAIN_PASSWORD: ${{ secrets.MACKEYMAP_KEYCHAIN_PASSWORD }}
+          MACKEYMAP_SIGN_IDENTITY: ${{ secrets.MACKEYMAP_SIGN_IDENTITY }}
+        run: ./scripts/import_codesign_identity.sh
+
       - name: Package release artifact
+        env:
+          MACKEYMAP_SIGN_IDENTITY: ${{ secrets.MACKEYMAP_SIGN_IDENTITY }}
+          MACKEYMAP_REQUIRE_SIGNING: ${{ secrets.MACKEYMAP_SIGNING_CERT_BASE64 != '' && secrets.MACKEYMAP_SIGNING_CERT_PASSWORD != '' && secrets.MACKEYMAP_KEYCHAIN_PASSWORD != '' && secrets.MACKEYMAP_SIGN_IDENTITY != '' && '1' || '0' }}
         run: ./scripts/package_release.sh
 
       - name: Upload build artifact

.github/workflows/release.yml

@@ -55,7 +55,30 @@ jobs:
       - name: Validate tag matches VERSION
         run: test "${GITHUB_REF_NAME#v}" = "${{ steps.version.outputs.value }}"
 
+      - name: Require codesigning credentials
+        env:
+          MACKEYMAP_SIGNING_CERT_BASE64: ${{ secrets.MACKEYMAP_SIGNING_CERT_BASE64 }}
+          MACKEYMAP_SIGNING_CERT_PASSWORD: ${{ secrets.MACKEYMAP_SIGNING_CERT_PASSWORD }}
+          MACKEYMAP_KEYCHAIN_PASSWORD: ${{ secrets.MACKEYMAP_KEYCHAIN_PASSWORD }}
+          MACKEYMAP_SIGN_IDENTITY: ${{ secrets.MACKEYMAP_SIGN_IDENTITY }}
+        run: |
+          test -n "$MACKEYMAP_SIGNING_CERT_BASE64"
+          test -n "$MACKEYMAP_SIGNING_CERT_PASSWORD"
+          test -n "$MACKEYMAP_KEYCHAIN_PASSWORD"
+          test -n "$MACKEYMAP_SIGN_IDENTITY"
+
+      - name: Import codesigning identity
+        env:
+          MACKEYMAP_SIGNING_CERT_BASE64: ${{ secrets.MACKEYMAP_SIGNING_CERT_BASE64 }}
+          MACKEYMAP_SIGNING_CERT_PASSWORD: ${{ secrets.MACKEYMAP_SIGNING_CERT_PASSWORD }}
+          MACKEYMAP_KEYCHAIN_PASSWORD: ${{ secrets.MACKEYMAP_KEYCHAIN_PASSWORD }}
+          MACKEYMAP_SIGN_IDENTITY: ${{ secrets.MACKEYMAP_SIGN_IDENTITY }}
+        run: ./scripts/import_codesign_identity.sh
+
       - name: Package release artifact
+        env:
+          MACKEYMAP_SIGN_IDENTITY: ${{ secrets.MACKEYMAP_SIGN_IDENTITY }}
+          MACKEYMAP_REQUIRE_SIGNING: "1"
         run: |
           ./scripts/package_release.sh
 

App/Sources/MacKeyMapApp/AppSupportPaths.swift

@@ -17,6 +17,10 @@ enum AppSupportPaths {
         applicationSupportDirectory.appendingPathComponent("config.json")
     }
 
+    static var updatesDirectory: URL {
+        applicationSupportDirectory.appendingPathComponent("Updates", isDirectory: true)
+    }
+
     static var appLogURL: URL {
         logsDirectory.appendingPathComponent("app.log")
     }
@@ -30,5 +34,9 @@ enum AppSupportPaths {
             at: logsDirectory,
             withIntermediateDirectories: true
         )
+        try FileManager.default.createDirectory(
+            at: updatesDirectory,
+            withIntermediateDirectories: true
+        )
     }
 }

App/Sources/MacKeyMapApp/DiagnosticsStore.swift

@@ -101,6 +101,9 @@ enum DiagnosticsStore {
         let bundle = Bundle.main
         let shortVersion = bundle.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
         let buildVersion = bundle.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "unknown"
+        let bundleIdentifier = bundle.bundleIdentifier ?? "unknown"
+        let bundlePath = bundle.bundleURL.path
+        let codeSignature = currentCodeSignatureSummary()
 
         let deviceLines = snapshot.devices.map { device in
             let mode = device.remapMode ?? "none"
@@ -111,6 +114,9 @@ enum DiagnosticsStore {
             "MacKeyMap Diagnostics",
             "Generated: \(iso8601Timestamp())",
             "Version: \(shortVersion) (\(buildVersion))",
+            "Bundle identifier: \(bundleIdentifier)",
+            "Bundle path: \(bundlePath)",
+            "Code signature: \(codeSignature)",
             "Engine status: \(snapshot.engineStatus)",
             "Remapping enabled: \(config.enabled)",
             "Launch at login: \(config.launchAtLogin)",
@@ -166,4 +172,53 @@ enum DiagnosticsStore {
         formatter.dateFormat = "yyyyMMdd-HHmmss"
         return formatter.string(from: Date())
     }
+
+    private static func currentCodeSignatureSummary() -> String {
+        let process = Process()
+        let outputPipe = Pipe()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/codesign")
+        process.arguments = ["-dv", "--verbose=4", Bundle.main.bundleURL.path]
+        process.standardError = outputPipe
+        process.standardOutput = Pipe()
+
+        do {
+            try process.run()
+            process.waitUntilExit()
+        } catch {
+            return "unavailable (\(error.localizedDescription))"
+        }
+
+        guard process.terminationStatus == 0 else {
+            return "codesign exited with status \(process.terminationStatus)"
+        }
+
+        let data = outputPipe.fileHandleForReading.readDataToEndOfFile()
+        guard let output = String(data: data, encoding: .utf8) else {
+            return "unavailable"
+        }
+
+        let authority = output
+            .components(separatedBy: .newlines)
+            .first(where: { $0.hasPrefix("Authority=") })
+            .map { String($0.dropFirst("Authority=".count)) }
+        let teamIdentifier = output
+            .components(separatedBy: .newlines)
+            .first(where: { $0.hasPrefix("TeamIdentifier=") })
+            .map { String($0.dropFirst("TeamIdentifier=".count)) }
+        let signature = output
+            .components(separatedBy: .newlines)
+            .first(where: { $0.hasPrefix("Signature=") })
+            .map { String($0.dropFirst("Signature=".count)) }
+
+        return [signature, authority, teamIdentifier]
+            .compactMap { $0 }
+            .joined(separator: " | ")
+            .ifEmpty("unavailable")
+    }
+}
+
+private extension String {
+    func ifEmpty(_ fallback: String) -> String {
+        isEmpty ? fallback : self
+    }
 }

App/Sources/MacKeyMapApp/MenuBarController.swift

@@ -12,6 +12,7 @@ final class MenuBarController: NSObject, NSApplicationDelegate {
 
     private let statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
     private let engine = RustEngineBridge()
+    private let updater = ReleaseUpdater()
     private let configStore = ConfigStore()
     private lazy var baseStatusImage = loadBaseStatusImage()
     private var config = AppConfig()
@@ -122,6 +123,14 @@ final class MenuBarController: NSObject, NSApplicationDelegate {
 
         menu.addItem(.separator())
 
+        let updateItem = NSMenuItem(
+            title: "Check for Updates…",
+            action: #selector(checkForUpdates(_:)),
+            keyEquivalent: ""
+        )
+        updateItem.target = self
+        menu.addItem(updateItem)
+
         let launchItem = NSMenuItem(
             title: "Launch at Login",
             action: #selector(toggleLaunchAtLogin(_:)),
@@ -369,6 +378,13 @@ final class MenuBarController: NSObject, NSApplicationDelegate {
         refreshState()
     }
 
+    @objc
+    private func checkForUpdates(_ sender: NSMenuItem) {
+        Task { @MainActor in
+            await updater.checkForUpdates()
+        }
+    }
+
     @objc
     private func quit(_ sender: NSMenuItem) {
         NSApp.terminate(nil)