macdeployqt: Make sure the app binary is signed after any other binarie

This avoids a codesign verification error that may appear as
"nested code is modified or invalid".

This commit was originally created by
    https://github.com/tsteven4

#125

Pick-to: 6.5 6.8 6.10
Change-Id: Ifa0b4ed9da1d7b36cb54f9d2fa6aee48c1fe519c
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>

Author: kkoehne

src/tools/macdeployqt/shared/shared.cpp

@@ -1447,6 +1447,17 @@ QSet<QString> codesignBundle(const QString &identity,
     QString appBundleAbsolutePath = QFileInfo(appBundlePath).absoluteFilePath();
     QString rootBinariesPath = appBundleAbsolutePath + "/Contents/MacOS/";
     QStringList foundRootBinaries = QDir(rootBinariesPath).entryList(QStringList() << "*", QDir::Files);
+
+    // The app binary must be signed last.
+    QString appBinary = findAppBinary(appBundleAbsolutePath);
+    QString appBinaryName = QFileInfo(appBinary).fileName();
+    if (int appBinaryIdx = foundRootBinaries.indexOf(appBinaryName); appBinaryIdx > 0) {
+      foundRootBinaries.swapItemsAt(0, appBinaryIdx);
+      LogDebug() << "swapped appBinary to start of list";
+    }
+    LogDebug() << "App binary is" << appBinaryName;
+    LogDebug() << "Binaries in" << rootBinariesPath << "are" << foundRootBinaries;
+
     for (const QString &binary : foundRootBinaries) {
         QString binaryPath = rootBinariesPath + binary;
         pendingBinaries.push(binaryPath);