Set up the code-signing key pair for macOS

.appveyor.yml

@@ -19,6 +19,15 @@ environment:
     VCPKG_TRIPLET: x64-windows-static
     PATH: C:\Program Files (x86)\Inno Setup 6;%PATH%
 
+  # Made with https://github.com/sfztools/code-signing
+  CODESIGN_IDENTITY: codesign.sfz.tools
+  CODESIGN_P12:
+    secure: 9GwD/vqCwHVJBohmtmYRTumfxBx91vtF5dyS8gLAVw8INzBgvZLHxHc7D4Kcgzs1RCpch3Ts/KA/PH8wDSLnWzXgyfVTqTY4XE5NAP+i9y+s6WwR3JBPperkrsfKinP+PhRwxwXlEeZ09asDIYFwgTturFEUUJY55fA7uofiV+Hb1/QgqoLr3xYZZAzEFFsx0aOZXmgbYRpGr9DWjhFI7ei0gnrAnJGUR9Fq9Teg6iF2aZgk77bZOJ9SK0bBJUcm0l0KOqqKnnxvOMqCt4AEpjaAFjNCyrtYYZatUP6KSKCrZjyKbXqjxqk+OsPZA+wXUGOR0w8M3ARpDqmvK0KqYJGs+L6QGDMkHobwRdkUammIk+CVpG0DWEXCJGlNZgSvrg6f0m7hFNf53RxsjgL2jGN2mxJ/nVe9EpuJnL8UFACH5O3w1Q/b9kMNDHuROMpNNXl5UICMb9gsWnW4js+R02cBAlLzPGcyZhu8AJxyMcJ9tNqYherAkWQ37i09QpuRycZDvuhxQ0gWnqIRWUB8iXarHTRl1Jvc/GvlLCoOv3OSKxQV1dfzyhvBJBk1jDFgZ/AhZhZIQxIFVY0KCIuoWe2OdZEZ+4jws4BeK0sA4LtsRAePXvR6iAtWczbt6vJGjL7JvCznRJMz8KA+oLdw1iuJCIrK9e4JkTIfIAlFqrAHZoZwxE6Gmn7aG3OGEhNRL4q76dI3xQaUI6Ff6GT1B+rbBv6UggNYtv+kTq/Qb0HerpFtjCPzr/p6gCYNJkkjpPu0lAxEY5QY13y2JEK0Ef5Avy65iIauZvOGDnfCngaBfNK9exqSnLEXUbILSBawdJvZsOZSakeqqCsxJE+pE4AoJVKiJHae2FqQaBRbxLgApfv6J7k0UCzLMQZG2xQGIQe/9B/ExXxNJWSg/nZ9WIWJ9klBn5MiFOm74guApJK1qVeQLz9q1shANpAZFIzp46XiNR7FJAWSvBdnU2HmI4iB2yr/gWGu3ibZrYwFJmwCG8lNwztGsHsAPPu/rITx5RJK+eRRsxU9snihBNlSK03HXK+ZFa3JxMVokr8Smo7AwZnMFYlrgpnYSBEhIKEJM+KTAn8Bm3aqg5M42yB94IlFpp8BOlqjkuZwblA1Ap7wxwoc5OaxC9B8PLhFZmgLZA/P043gIoAAUH8pPg7UT2l1tfxSotE7OaUnIuSv4S9RWKbXG7d9qiNdmjLE0EXpCI2ovpNLbCwJhonnCnlRSVnhC2MjL0MZ0v0vmDKE/7mAheFJ5D5pI5yC87e6Dnr6dFI9CDoewrdylzfjYpLhQUfuihpzs/Z4Cus68cI9wXhYxbpsO8SMz1d86OZGnS9J34hY0KzlHPCtxQIo921n4q7UHPCL/yHPW/zFDBiXMyoXhW+2Z3r0TVSBP3Z9oAOFUFQ/8VkuPuz2paRqDNAYDgoGWmNvaDby8sZWZoT6i3rdoz3jqE1A5MDXIbM6mtB1XMC8+TDWJKHs0IECMz0HcBQToHhUFl0fxfAJ3JNk6elmQiCkqhx+qC5d/1RHkjXuYRHFh+BsJLXTTKTzykCk3fIS5xjWOBjaSMDTTHaOrPFbt1beNeydAsBnMuElitwQhs6f6b8Y+CK8zrFDEzSiS+VmLzA+vY4uO6M7EHUID7Od6mg6hkh9Bh0Qr+vxwlHjZeigvpOPzTB/7oSKkWIEboR+pp6r2Ffyyl8E3cpplxkguRkzyr5uF/sJL7R6/HMI+S2eTlwv4geUlHs3VhJliclRtOk1xz3oblvEcjqF2B+OsFOOrESaPi1U8U3Hnw9sp429kOHhI7gcYwqLIKL5d2JtKZ2JyURFFqh5mbjQIcnENCSxfJYjdcdTusT+kD8nCd16E1YXkqzEdGTnhWLjZWPqsQg/OYYH/BACQz0B1C2+QByBhnf2UVtf1ZwMTjgb5cnYbDKXDu7oItvmeWiTvdJvH4IkOlXoT63ByoqpZrA0e48Ay/9883Q87fDSZZ8/qmlEariEqz9IaoJz3YHi1YWU5C2E7GFJtlBA3Knzs6GUuKUnvdceVUEQKMTfBQYmropm3M+UzBGkWqFuOvD2h7hfLcE3NHrJVyv4HlocRcmIL8WLyrZJh5EgUxqJGfyzsOUVdFv46djx93jZOESyAl7Af3GRNcQgjX2WJci+/1YaNyNwh93mKzhzKlx2u9FwvB0sugK24IRJMDGk31IbT72APxL7gn2jIyf7dJFKTyNknf0FHj/hQPGkpUeGCSI4pIqllwK77ghbJOqKW7o6t2cE5njMF+mS2BqpnPgZyA+1s0FpkbOFiSZOiqyC9WkEUY0jjSMH2eUonSIAOpGV+dTfBoJq3HW05voreKfpCVE2JZt4IN0eHWsXYgyims7oYyRUt0n7++yKMl/qAjubvmJzm1KC2ijsqmLSK//mmHUDopxEirNlBDEdDNDwqLtcK9jKJ/MB2Ou4Ga5oEi69y4sLiNGBv44yptb3iShVxC4sRDpvqmxubwi+Ov6MNq/YstokMygvVTz2HGLBwHTUhPArvsxulECeWf6XfYAsiec7tncZkIW6G43EL0uzsGt2FIIDZp9EUu+K4qOhbqvWxOpOBUEvobXAmHp0X3fpUanzZfn4PcHs/Egm0f4zWgd2Jd94dciGiHPaap0oPnKuH4U/YdiVgsesLRpum1S+iPayeqtMwzMwWkihOJ38Kneubd60qLLj2X7fL7UTFhHRSxRY9QE+yBCEGVHSmsO6piTSZvDOL07DjUhKXN/d7YCeRg1gWVgPc5hZHnqov/hoo3N8FneVhlkEfGhcvt7IBhfVn7ntuMVhyg6IKlJb6GJXJntOVX2iT4TvgL+hnur7PtDjKppA69TX6klDz/W3cM0YUe0iR4lJuzIUZZpK5p9S7BWWbtdCP9IstsHu57kb/HCGo7Bg6Yxvks9dy//LWAwfmsz+bFb+PM2tBFWBNhUhBMs6jRPiFmLyZCZ6Tx0fdTNXuUrsewu5s58X2fr5/cwGPfYxAaK3XM95cMGR1CBS//hhYdA6EUn8IleC+yjzKzuoKrh3dj/zEWd8LSUQ+TTmNj8qCFaLl6oFQw0VGvcGzUSobVa4Rsmh26IyZd1oadGH/stIPrh8V4T2HU8Pm/2LOaWmOpUtG/LAGQ9OHFlLCcgB9d9w5is+jWZL3T1jUuH2VqGCzMr7agIUyFyLovpN4uS2EdJUqEMJ0G1kAT1RMdj4UExG1GVBhabiVwPytZO/rIB84F+HZZdU9kMbThjOl30tPm7EmEvhf4QEgM19Ke922lRHXSsuqb9Y/dSoKOegQs/v0lsOjFXTCcQuKTLYK5H1dVJ7DdBrtP2ndqpt6zL7exkfKhSPvftma0vJXak3DZL/eNRW3WdmFrbNYKCxwTo3Uo4gDTxTDa20PSFm7TK81D1Yk8S0x7s20uJVfbLBVqQ6wvTJrJPe4l8Rtk4GDIsY0RLHyxAq5QBp/uLcoS0Uuhq1aOOkZxqm5+S/Ekl6eYEhjpV/oSzjLd8L7M8gMIcCkS3/7Brn/XlIp+5XaPiAxo9jaTbun/VntmCn0EAt7PvdLqks3whcrwFrTZrt/rXxYl57ABsUzFtczxyXXpYp+HYi9CNZOULPLMAriXzBjg3PDnuW2IJwR20xfE9QbU92eAV6nWPEIgOQCSBjdhiD3sq23eTQmoa2qZUO3LIUQXvytRc2TzKQblOgQY4ZiubqU0dHFZLMnEQo/oQccO3jD5S01F9a0DYV3lXi1kx5+YcUs6R5sXnXiEiHCcs9flAZoPsozLU4LjLXeAPLCc7j0FwH1JJ1dcHSHacD4DhWCxrQWz0iWBJPWMT7IIEtU1p9qmphKkkADQt9LQ8wygWmP2txAwAnw0TOZlW3mr0EwprewQW8utiR4CW2TYJzxuAx60r0fngClS8V3uofV7NhPS6BMVbAu2qzeDDpqY64HMuToIJ486IDdsd/aX/07dqlRteHX0ltHOOk1L8BxNTPQ7dfnfwB36aGS5oZL3oWVOr5ITD1IobUj9Rf2bx98XUEeVpKvqFRDwKM9jfyl6Fx07+bOfJq2UsH1skdGuVm9pSsCsEAo/tbDaLAsier1mQLwQ3hpGo7Z+BIVo3h4sfbDuiHNfBDSTitDGogSzxaJVJX9WzmCZAOH9TDRFF5i4VwnOVjgBDj9WOWAbPLkANpCN5+kOLclywnhA5IGJiKb9NqG/5zc+Io11Aa78XN/CEniu4xbXXYMuG6QL9l5qcUThtgxjWKhcs+T5O+sR+kMZ8r5UUsHnvEVRj0CExZ0EDBdA2t5QpGIGhD6bL25CTasAz1PDGNvST+hWUoxKr1xe1mdgXblymR2WipuKDaEgFQW5S1qcRF6vQDqKT7
+  CODESIGN_PASSWORD:
+    secure: MdBjjykL0JHVnXeh3KbZ+8S1YtSi5rYz3tOxrlot3/FQrw7LeuISY8T+K/Xf1kZB4oQH/k8ht1DNxJOQ+k84AulqtHhWfuMYOHK4rm5RTho=
+  SFZTOOLS_CRT:
+    secure: OWNh97s3+yJBO6NfaF82v8fZzhw4cBLVEneVOS7Vab6kGaUcRs1E2VdYPzxKvnZmgLxWWbV9SCiHFpyJ4TFk35A1PVrEO9zzvVHJ0c9lfaJ3O1O57kgjwVMZErEiDbbU2MvaBIji43+L66sLYabBZpeIdM//J+MUGF0jw7ouujTT7bMGawKnkCzxsCH9BtAtRUyTMCC521CKcGqg+PeOfIxjoM3oW6KigZPCs7H+gOZ/PxeI3/VMcz3Ab4iDuDdof+rwuEO0NIKo9d1BFyW4OPp1/8vYJvv57X1w4mp4XWUt/4UUtrvKhkFg/k4ZmpTsYY99mAnGtmBCt8VNx5wxMXikHjP8/oPsGatAXYa5Yw0k0ZP0Vp41EItNsGoW1mX8/5Cr7Mk29LMkONnupTw//aeNIf/OXuiKvLSbBzhpIhbKacZlKLXix2ri9N7RudY1eJZQQD9YY3j/SzXnb6x/OGtS3EyR/VUcb5enL2G3Tp3JDVYGWyShuwjc8jBk1WthPAk+EEz4CaJQ3IM/I3tGPuiHvV6zOOIvza3yDS8s5EHlrszpvMsuL++BPNfhNV02vwAxT0eiQd2FNnV0lP93e63qRcw/Zl4x43p91jEKB1BxfeKfWUsQsczdrpTtmNV7IC1dUyAkBFFXfb3yxoJDU35e6f3Ile33PFVcs8rp04Tbv8aQxftEXbiiWtQ8wgbtBS4NyRWk4BoiaufIxqC6fqlq0sL6y2L32b1U3C2Yrpt/CcifUMS52sR9gvV43LYjlnU6KKZAz7Eb8jY6/VAnuwLjGjVFz5Ecr71oDnVRfDDsBSEuLUtFKx0mvkOvuPcYp9y24WLwjN6s1kUhZxLS6TAP3Ipt5pYpQC379IflIE8wiRjWcvf5rhWBw51hPP+G3iJ6C5aW2SBBo2GjzwY0uNPfJ2FOb/85bHVIe2XjW2Krwfc7EfOxdFCPW3lDLOt42+M3eMQxXzZjLVZ+W0wJu5apLj9cJKqNXJBZ7LPcAq3Y2enG49UT3Dbx3XX3GpPMVff++LmX9E+e5JkNzfD4bhYJQYI5QpjJEaJ9AW8F8c3e/Gm+C4z14JGU/kTWycJnm5KnoaR2mrmzZ5StL84nYLhKkyX7qvnQ0bARgxggoqu0aM1sy1TPzGbpb+9NnR3I7KtRz5d9NNjVvZja4jfq56e6GlEaPYpM098QuwW3HM6Q61Gv/F5cci00kcZda7i3QRjyjdMtsaukynfxvrZFHocsKF+37pFbhjrSz5JQbFGSYRlRlhwfz94wQy4BGQLz5WvQj/y5cwjPQ5bc30PFrcwa8w4qN8cgprV4fp0DavyjkeKWswh1s5vyccdO/WXJcmCRP7mh/+MF5Xq9o1qS9oTqZjxFHkwMWvlNrwAKYKZsyPGGaWS9axe8R+6b79YUIE8a48EUv8kGA4HW3LXW2oGiykULo3jY+VnTeDCfuAxmr0U7tiB7UUom2dYpH9aY7FbZUQq5pSpE5CPXSzF0QfFET57Kf3Y1MS4LAn50LNkaWhVSW5nlIIu2hiIpE6TRDXYaDZ2L+UWLrUwGjwyc/wXJmK4+nyzfSuAq06blDJmn8ODkk0ZKml2J4ovBUfIzkIAQeLtteXRQSxAaAGk9QKJmy//MiPRE098x109fTKNwnvDphKRZATBzrDyp0P3Grza8tynVYqUNzFZhLWUEg8VjVMrmW5LklWo3W1SQYDTT6LZS1uBs/Q5M0rz0+AZeHB9yP9PCkBN+KIOxTTtqxRBH3/OBG5SCuaSVi7z4WBSrfpgG/9M2Ll+Tx/OpKZAaloWI/0oJqVLhod4+BdTXGYz2D25PB/qKJtGMvBntsOzerXQjbHEZ9nXtZNZ3RqgsWFwuhd3Ej/5NixJBT3HuDw==
+
 for:
 - matrix:
     only:
@@ -28,8 +37,8 @@ for:
   - cmake --version
   - gcc -v
   install:
-  - brew install jack
+  - chmod +x ${APPVEYOR_BUILD_FOLDER}/scripts/appveyor/install.sh
-  - brew install dylibbundler
+  - ${APPVEYOR_BUILD_FOLDER}/scripts/appveyor/install.sh
   before_build:
   - chmod +x ${APPVEYOR_BUILD_FOLDER}/scripts/appveyor/before_build.sh
   - ${APPVEYOR_BUILD_FOLDER}/scripts/appveyor/before_build.sh

scripts/appveyor/install.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -e
+# do not `set -x` until after processing the secrets
+
+# -- secret --
+echo "* Set up code-signing"
+
+if test -z "${CODESIGN_PASSWORD}"; then
+  echo "! Secrets not available, skip code-signing"
+else
+  echo "1. Extract PKCS12"
+  echo "${CODESIGN_P12}" | base64 -D -o codesign.p12
+  stat codesign.p12
+  echo "2. Extract CA certificate"
+  echo "${SFZTOOLS_CRT}" | base64 -D -o sfztools.crt
+  stat sfztools.crt
+
+  echo "3. Create a new keychain"
+  security create-keychain -p dummypasswd build.keychain
+  echo "4. Configure the new keychain as default"
+  security default-keychain -s build.keychain
+  echo "5. Unlock the new keychain"
+  security unlock-keychain -p dummypasswd build.keychain
+
+  echo "6. Import the code-signing key pair"
+  security import codesign.p12 -k build.keychain -P "${CODESIGN_PASSWORD}" -T /usr/bin/codesign
+  rm -f codesign.p12
+  echo "7. Import the trusted CA certificate"
+  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain sfztools.crt
+  rm -f sfztools.crt
+
+  echo "8. Set up the code-signing ACL"
+  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k dummypasswd build.keychain
+
+  echo "9. Check the code-signing identity"
+  security find-identity -p codesigning build.keychain
+fi
+# -- /secret --
+
+set -x
+
+brew install jack
+brew install dylibbundler