MacOSX notarization goodies

[cmaglie]

Here a prebuild binary to test: https://downloads.arduino.cc/arduino-1.8.11-prerelease1-macosx-signed.zip

Changelog:

• replaced all executables and tools with the corresponding signed version
• rebuild appbundler on a recent mac SDK using the source code here https://github.com/arduino/appbundler/tree/ffa11380989aab78b3dadf1404d4c7a68d6fb772 (thanks @PaulStoffregen, you're a life saver!)
• added gcc and jre2 entitlements properties files

To successfully notarize the Arduino.app the JRE bundled in the app (using the ant flag -DMACOSX_BUNDLED_JVM=...) must be signed and built using a recent mac SDK (>10.9).

The commands used to produce the notarized zip are:

cd /Code/arduino/build
ant -DMACOSX_BUNDLED_JVM=/Library/Java/JavaVirtualMachines/jdk1.8.0_99.jdk/Contents/Home clean dist
rm -fr macosx/work/Arduino.app
unzip macosx/arduino-1.8.11-macosx.zip -d macosx/work/

security unlock-keychain -p XXX /Certs/XXX.keychain
codesign -s "ARDUINO SA" -fv --keychain /Certs/XXX.keychain --options runtime --timestamp --entitlements macosx/jre2.entitlements macosx/work/Arduino.app/Contents/PlugIns/jdk1.8.0_99.jdk
codesign -s "ARDUINO SA" -fv --keychain /Certs/XXX.keychain --options runtime --timestamp --entitlements macosx/jre2.entitlements macosx/work/Arduino.app

cd macosx/work/
zip -q -r ../arduino-1.8.11-macosx-signed.zip .
cd ..
xcrun altool --notarize-app --username user@email --password xxxx-xxxx-xxxx-xxxx --file arduino-1.8.11-macosx-signed.zip --primary-bundle-id "cc.arduino.Arduino"

To check for notarization status:

xcrun altool --notarization-info UUID --username user@email --password xxxx-xxxx-xxxx-xxxx

If everything is ok, the app can be stapled, and the final zip generated again:

xcrun stapler staple macosx/work/Arduino.app
cd macosx/work/
zip -q -r ../arduino-1.8.11-macosx-signed.zip .
cd ..