Add Apple certificates to Github CI

[matthew-brett]

See ./tools/macos_install_certificates.sh, pointing to docs at https://docs.github.com/en/actions/use-cases-and-examples/deploying/installing-an-apple-certificate-on-macos-runners-for-xcode-development#add-a-step-to-your-workflow .

We need an application certificate and an installer certificate - see https://help.apple.com/xcode/mac/current/#/dev154b28f09

I think this corresponds to:

• Developer ID Application: Sign a macOS app before distributing it outside the Mac App Store.
• Developer ID Installer : Sign and distribute a Mac Installer Package, containing your signed app, outside the Mac App Store.

@larsoner - is that right?

[larsoner]

@hoechenberger set it up for MNE -- @hoechenberger can you comment on the above Apple certificate stuff ☝ ?

[hoechenberger]

Thanks for pinging me, Eric.

@matthew-brett , you're absolutely right. These are the two certificates I'm currently using, first in XCode:

And here in Keychain Access:

The MNE-Python macOS installers (.pkg) are currently signed with those.

The basic process is:

• Sign your executables or .app bundles with Developer ID Application
• Sign the installer .pkg with Developer ID Installer (or, if you're not using an installer but a .dmg, sign it with Developer ID Application)
• Submit for notarization
• Staple the notarization ticket onto your .pkg or .dmg

Please let me know if you need any additional information.

Also cc'ing @cbrnr

Thanks,
Richard