Signing Guppy for MacOS

[joshwcomeau]

This is something we've spoken about on Gitter, but I thought I'd create an issue so that we can track it.

When downloading Guppy now on MacOS, the app won't open if you double-click it:

Savvy users will know that they can right-click and "open" to get around this. While aspiring programmers are more often than not still proficient with using computers, there is certainly still a subset who will be blocked by this. We want Guppy's onboarding to be as low-friction as possible.

This involves the purchase of an Apple Developer account, which I purchased a few days ago. I will begin setting up code signing shortly.

More info:
https://electronjs.org/docs/tutorial/code-signing

[mathieudutour]

If you are interested, I have a script to automatically sign and create a new release on GH when pushing a branch named __release-production-COMMIT_SHA in https://github.com/kactus-io/kactus.

The gist is to

• store the .p12 on a private repo, download it and add it to the circleCI (or travis) keychain (https://github.com/kactus-io/kactus/blob/master/script/setup-macos-keychain)
• do the previous step only on the CI and if it's not a fork (https://github.com/kactus-io/kactus/blob/master/script/build.ts#L66-L71)
• build and sign the app (https://github.com/kactus-io/kactus/blob/master/script/build.ts#L132)
• zip the app
• create a draft release, upload the zip, publish the release (https://github.com/kactus-io/kactus/blob/master/script/github.ts)

[joshwcomeau]

Thanks @mathieudutour! Interesting idea to have a hook on specific branch names. Thanks for sharing, will look into that once the initial version is signed.