verify code signature for mac release action before sending for notarization

[kjhollen]

Most relevant area for this enhancement?

Build process

Feature to enhance

macOS release building

Enhancement details

Enhancement description

Add a step in the release.yml workflow for macOS that checks the code signature before sending the binary to be notarized, so that we have an opportunity to see more output if the process fails. Currently, mac builds fail when notarytool runs, but the logs don't provide enough information to debug effectively.

Benefits

Easier to release new builds for macOS users.

Challenges

Pretty straightforward, I think—see suggested solution in next section.

Additional context

Likely solution is to add this or something similar to the release-macos job:

- name: Verify code signature
  run: |
    codesign -vvv --deep --strict "app/build/compose/binaries/main/Processing.app"
    file "app/build/compose/binaries/main/Processing.app/Contents/MacOS/Processing"

I'll test this out locally & submit a PR if the error output from adding this step is useful.

(with thanks to @SableRaf & Claude for the suggestion)

Would you like to help implement this enhancement?

Yes, I’d like to help with this

[kjhollen]

Ok, verified that this will almost give the right info, codesign command should be:

codesign --verify --deep --strict --verbose=2 "app/build/compose/binaries/main/Processing.app"

leaving out --verbose=2 will not include a list of files that were missing or invalid, which makes the error message less helpful. I'll turn this into a PR shortly.