From c7136b66218fa14e911087e306866ea0e2b5ec40 Mon Sep 17 00:00:00 2001
From: Jean Pierre Cimalando <jp-dev@inbox.ru>
Date: Sat, 14 Nov 2020 16:56:21 +0100
Subject: [PATCH] Perform macOS code-signing

---
 scripts/appveyor/after_build.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/scripts/appveyor/after_build.sh b/scripts/appveyor/after_build.sh
index 2eb8e9af..1934da64 100755
--- a/scripts/appveyor/after_build.sh
+++ b/scripts/appveyor/after_build.sh
@@ -2,6 +2,30 @@
 set -ex
 
 make DESTDIR=${PWD}/${INSTALL_DIR} install
+
+# Perform code-signing
+if test -z "${CODESIGN_PASSWORD}"; then
+  echo "! Secrets not available, skip code-signing"
+else
+  # unlock the keychain
+  security unlock-keychain -p dummypasswd build.keychain
+  # code-sign VST3 and dylibs
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/VST3/sfizz.vst3
+  # code-sign AudioUnit and dylibs
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/Components/sfizz.component
+  codesign --sign "${CODESIGN_IDENTITY}" --deep --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/Components/sfizz.component/Contents/Resources/plugin.vst3
+  # code-sign LV2 and dylibs (note: manual, LV2 are not real bundles)
+  codesign --sign "${CODESIGN_IDENTITY}" --keychain build.keychain --verbose \
+           "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Binary/*.so
+  if ls "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Frameworks/*.dylib &> /dev/null; then
+    codesign --sign "${CODESIGN_IDENTITY}" --keychain build.keychain --verbose \
+             "${INSTALL_DIR}"/Library/Audio/Plug-Ins/LV2/sfizz.lv2/Contents/Frameworks/*.dylib
+  fi
+fi
+
 tar -zcvf "${INSTALL_DIR}.tar.gz" ${INSTALL_DIR}
 
 # Only release a tarball if there is a tag