From 02041f4359b18f20c0cb4028a6c9d700ea6d9f95 Mon Sep 17 00:00:00 2001
From: kate hollenbach <kjhollen@gmail.com>
Date: Sun, 26 Apr 2026 20:23:25 -0700
Subject: [PATCH] fix for #1507 - mac signing issues for release builds

fixes issue with Mac app notarization failure by signing the whole app again
after fileAssocations are made. previously, release builds were failing because
the .icns files for .pde, .pdex, and .pdez were added to the .app file after
signing.
---
 app/build.gradle.kts | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 4f91e6d98..8081a7971 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -186,7 +186,7 @@ tasks.register<Exec>("packageCustomDmg"){
     onlyIf { OperatingSystem.current().isMacOsX }
     group = "compose desktop"
 
-    dependsOn(distributable(), "installCreateDmg")
+    dependsOn("signApp", "installCreateDmg")
 
     val packageName = distributable().packageName.get()
     val dir = distributable().destinationDir.get()
@@ -571,9 +571,35 @@ tasks.register("signResources"){
         }
         file(composeResources("Info.plist")).delete()
     }
+}
 
+/* for mac, perform one final signature of the whole app before submitting
+ * the app for notarization.
+ */
+tasks.register<Exec>("signApp"){
+    onlyIf {
+        OperatingSystem.current().isMacOsX
+            &&
+        compose.desktop.application.nativeDistributions.macOS.signing.sign.get()
+    }
 
+    group = "compose desktop"
+    dependsOn("createDistributable", "setExecutablePermissions")
+
+    val packageName = distributable().packageName.get()
+    val dir = distributable().destinationDir.get()
+    val app = dir.file("$packageName.app").asFile
+
+    commandLine(
+        "codesign",
+        "--timestamp",
+        "--force",
+        "--deep",
+        "--options=runtime",
+        "--sign", "Developer ID Application",
+        app)
 }
+
 tasks.register("setExecutablePermissions") {
     description = "Sets executable permissions on binaries in Processing.app resources"
     group = "compose desktop"