ci: fix macOS codesigning #3408
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Jared Van Bortel <[email protected]>
manyoso
approved these changes
Jan 23, 2025
cgivre
pushed a commit
to cgivre/gpt4all
that referenced
this pull request
Feb 4, 2025
Signed-off-by: Jared Van Bortel <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On Sequoia, GPT4All builds made in CI crashed after #3391.
My local builds were signed successfully because I was not using
-DBUILD_UNIVERSAL=ON. I do not really understand why that option affects code signing, but that's not important. This does however explain why I didn't catch this when I originally tested the build and verified that it was signed, even though I never run theinstalltarget.What is important is that the way #2443 signs binaries in a way that is antithetical to the spirit of CMake: Instead of each task taking input and producing separate output files, forming an explicit dependency, there is a task manually added to the
installtarget that signs the source binaries in the build dir before copying them, in place.This means that running the
installtarget before starting the package target (i.e., as an explicit and separate command) is necessary to produce a signed version of GPT4All. This was confirmed here. This was removed in #3391, but is now added back as a workaround until we can fix it properly.As a bonus, this PR fixes a regression in the default install prefix caused by #3391 - otherwise, it is skipped the first time cmake is run, and already initialized the second time so it is not overridden. Which would cause the install step to fail without extra configuration (such as DESTDIR or --prefix) when using GPT4ALL_GEN_CPACK_CONFIG.