Begin work toward better macOS .pkg

Author: pjkundert

GNUmakefile

@@ -599,6 +599,14 @@ dist/SLIP-39.app-checkids:	SLIP-39.spec
 #   - Find each dependent key, and look at its SHA fingerprint, and then see if you have
 #     that one in your System keychain, downloading all the named keys from apple 'til
 #     you find the one with the matching fingerprint.  Grr...  Repeat 'til check-signature works.
+# * To be accepted by the Mac App Store, your App must be signed, and have an entitlements.plist
+#   containing:
+#     <key>com.apple.security.app-sandbox</key> <true/>
+#   - This causes PyInstaller created apps to crash, because they can't execute the Python interpreter
+#     recursively (?) https://github.com/pyinstaller/pyinstaller/issues/2198
+#   - Here is an up-to-date diary of the woes encountered: https://github.com/pyinstaller/pyinstaller/issues/7123
+#     - A summary of the solutions is here: https://github.com/nyavramov/python_app_mac_app_store
+# 
 dist/SLIP-39.app: 		SLIP-39-macOS.spec \
 				SLIP-39.metadata/entitlements.plist \
 				images/SLIP-39.icns
@@ -650,7 +658,6 @@ SLIP-39-macOS.spec: SLIP-39.py
 	pyinstaller --noconfirm --windowed --onefile \
 	    --codesign-identity "$(DEVID)" \
 	    --osx-bundle-identifier "$(BUNDLEID)" \
-	    --osx-entitlements-file ./SLIP-39.metadata/entitlements.plist \
 	    --collect-data shamir_mnemonic \
 	    --hidden-import slip39 \
 	    --collect-data slip39 \

SLIP-39-macOS.spec

@@ -5,6 +5,7 @@ datas = []
 datas += collect_data_files('shamir_mnemonic')
 datas += collect_data_files('slip39')
 
+block_cipher = None
 
 a = Analysis(
     ['SLIP-39.py'],
@@ -16,9 +17,17 @@ a = Analysis(
     hooksconfig={},
     runtime_hooks=[],
     excludes=[],
+    win_no_prefer_redirects=False,
+    win_private_assemblies=False,
+    cipher=block_cipher,
     noarchive=False,
 )
-pyz = PYZ(a.pure)
+
+pyz = PYZ(
+    a.pure,
+    a.zipped_data,
+    cipher=block_cipher,
+)
 
 exe = EXE(
     pyz,
@@ -38,19 +47,28 @@ exe = EXE(
     argv_emulation=False,
     target_arch=None,
     codesign_identity='DDB5489E29389E9081E0A2FD83B6555D1B101829',
-    entitlements_file='./SLIP-39.metadata/entitlements.plist',
+    entitlements_file=None,
+    icon='images/SLIP-39.icns',
 )
+
 app = BUNDLE(
     exe,
     name='SLIP-39.app',
     icon='images/SLIP-39.icns',
     version='11.1.1',
     info_plist={
+        'NSPrincipalClass': 'NSApplication',
+        'NSAppleScriptEnabled': False,
+        'LSBackgroundOnly': False,
+        'NSRequiresAquaSystemAppearance': 'No',
+        'CFBundleSupportedPlatforms': ['MacOSX'],
+        'CFBundleIdentifier': 'ca.kundert.perry.SLIP39',
         'CFBundleVersion':'11.1.1',
         'CFBundlePackageType':'APPL',
         'LSApplicationCategoryType':'public.app-category.utilities',
-        'LSMinimumSystemVersion':'10.15.0',
+        'LSMinimumSystemVersion':'10.15',
         'NSHumanReadableCopyright':"Copyright © 2023 Perry Kundert.",
+        'ITSAppUsesNonExemptEncryption': False,
     },
     bundle_identifier='ca.kundert.perry.SLIP39',
 )

SLIP-39.metadata/entitlements.plist

@@ -2,11 +2,9 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <!--
-    <key>com.apple.security.app-sandbox</key>				<true/>
-      -->	
     <key>com.apple.security.files.user-selected.read-write</key>	<true/>
     <!-- These are required for binaries built by PyInstaller -->
+    <key>com.apple.security.app-sandbox</key>				<true/>
     <key>com.apple.security.cs.allow-jit</key>				<true/>
     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>	<true/>
     <key>com.apple.security.cs.disable-library-validation</key>		<true/>