specter-desktop/pyinstaller/README.md

Pyinstaller build

Releases are built by .github/workflows/release.yml (triggered by a version tag). The notes below are for local / manual builds.

Install requirements:

virtualenv --python=python3 .buildenv
source .buildenv/bin/activate 
pip3 install -r requirements.txt --require-hashes
cd pyinstaller
pip3 install -r requirements.txt --require-hashes

Now run:

pyinstaller specterd.spec

And for HWIBridge, run:

pyinstaller hwibridge.spec

Code signing the macOS app for Apple GateKeeper

Note: for this, you'll need to have an active Apple Developer account

If this is the first time you go through this process, you'll need to first set up the following:

Apple Developer Certificate for Code-Signing

1. Go to the Apple Developer website: https://developer.apple.com
2. Click Account -> Certificates, Identifiers & Profiles
3. Click the + icon to create a new certificate. Select Developer ID Application and click Continue
4. You'll need now to create a certificate signing request, which you can do by following these instructions: https://help.apple.com/developer-account/#/devbfa00fef7, After that you should be able to generate and download the certificate.
5. Download the certificate, then double-click the downloaded certificate to install it in your keychain.

App Specific Password for authenticating to iTunesConnect for notarization

1. Sign into you Apple ID account: https://appleid.apple.com
2. Go to Security -> App Specific Passwords and click Generate Password…, you'll be asked to enter a label and click Create, then you'll receive a new password.
3. Copy the password generated, then open the Terminal and run:

xcrun altool --store-password-in-keychain-item "AC_PASSWORD" -u "<your-apple-id>" -p "<the-generated-password>"

Release builds sign and notarize via .github/workflows/release.yml (build-electron-macos job) using the APPLE_CERTIFICATE_BASE64, APPLE_CERTIFICATE_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID secrets. See docs/release-guide.md for the full secret inventory. For manual local signing, use electron-builder directly (npm run dist -- --mac in pyinstaller/electron/, with the identity configured in package.json).

Notarization takes ~10 minutes, during which Apple emails notification of success/failure. If for some reason the notarization failed, you'll be able to get the reason by copying the Request Identifier (you should be able to find this in the email and in the logs). Then run the following command:

xcrun altool --verbose --notarization-info <request_identifier> -u "<apple_id>" -p "@keychain:AC_PASSWORD"

This will output a long message, at the end of which you should have be able to find the LogFileURL:. This URL should contain a JSON with the issues found by Apple and which you'll need to fix to be able to pass Apple's notarization.