fix: local macos bundle signing

[bytehow]

Problem description

Copying discussion from Discord thread

I'm building on macos, on the head commit on master (a76eae2c11d2249a7ab6c938cab0dcd8fc750b22) and there seems to be a codesigning issue.

System log:

default    17:51:18.787623-0700    kernel    CODE SIGNING: cs_invalid_page(0x102574000): p=72113[imhex] final status 0x23020200, denying page sending SIGKILL
default    17:51:18.787630-0700    kernel    CODE SIGNING: process 72113[imhex]: rejecting invalid page at address 0x102574000 from offset 0x0 in file "/Users/me/code/ImHex/build/install/imhex.app/Contents/Frameworks/libfreetype.6.dylib" (cs_mtime:1759106769.980204518 == mtime:1759106769.980204518) (signed:1 validated:1 tainted:1 nx:0 wpmapped:0 dirty:0 depth:0)

libfreetype is fine from homebrew, but broken in bundle:

➜  ImHex git:(master) ✗ codesign --verify --verbose=4 /opt/homebrew/Cellar/freetype/2.13.3/lib/libfreetype.6.dylib
/opt/homebrew/Cellar/freetype/2.13.3/lib/libfreetype.6.dylib: valid on disk
/opt/homebrew/Cellar/freetype/2.13.3/lib/libfreetype.6.dylib: satisfies its Designated Requirement

➜  ImHex git:(master) ✗ codesign --verify --verbose=4 /Users/me/code/ImHex/build/install/imhex.app/Contents/Frameworks/libfreetype.6.dylib
/Users/me/code/ImHex/build/install/imhex.app/Contents/Frameworks/libfreetype.6.dylib: invalid signature (code or signature have been modified)
In architecture: arm64

Code siging isn't happening at all actually on macOS actually for two reasons, since June 2024 I think. This commit uses the wrong path for Entlitlements.plist:

install(CODE "execute_process(COMMAND ${CODESIGN_PATH} --force --deep --entitlements ${CMAKE_SOURCE_DIR}/resources/macos/Entitlements.plist --sign - ${CMAKE_INSTALL_PREFIX}/${BUNDLE_NAME} COMMAND_ERROR_IS_FATAL ANY)")

The actual path is ${CMAKE_SOURCE_DIR}/resources/dist/macos/Entitlements.plist

Also this entire block depends on IMHEX_RESIGN_BUNDLE being set but nothing sets that. This isn't a problem on GitHub actions build because GitHub actions seem to manually call the codesign utility

Implementation description

• Update entitlements plist path in createPackage macro
• Update macos readme to match GitHub actions. Adds missing lib paths, and introduces IMHEX_RESIGN_BUNDLE cmake option

Additional things

If this change is merged, will this remove the need for an additional code signing step in the GitHub actions workflow? I think it would just be able to set -DIMHEX_RESIGN_BUNDLE=ON and be done with it, but I'm not sure how to test GitHub actions to confirm

[adierking]

Thanks for posting this and updating the build instructions! I was hitting errors trying to do a local build and IMHEX_SYSTEM_LIBRARY_PATH is what I was missing. I can confirm the code signing change here works too, it would be great to see this merged.