Add Codesigning and move data outside of app directory

WAIL.spec

@@ -0,0 +1,45 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+
+a = Analysis(
+    ['bundledApps/WAIL.py'],
+    pathex=['bundledApps'],
+    binaries=[],
+    datas=[],
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='WAIL',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=False,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch='universal2',
+    codesign_identity=87FC5BD9729DA162BF0B9767F8847AED82F88839,
+    entitlements_file=./test_location.txt,
+    icon=['build/icons/wail_blue.icns'],
+)
+app = BUNDLE(
+    exe,
+    name='WAIL.app',
+    icon='./build/icons/wail_blue.icns',
+    bundle_identifier=None,
+)

build/Info.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>CFBundleShortVersionString</key>
-	<string>2025.03.03</string>
+	<string>2025.03.12</string>
 	<key>NSHumanReadableCopyright</key>
 	<string>Copyright © Mat Kelly - Web Archiving Integration Layer (WAIL)</string>
 	<key>CFBundleExecutable</key>

build/entitlements.plist

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <!-- These are required for binaries built by PyInstaller -->
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+        <true/>
+        <key>com.apple.security.cs.disable-library-validation</key>
+        <true/>
+</dict>
+</plist>

bundledApps/MAKEFILE.sh

@@ -4,6 +4,7 @@
 # http://matkelly.com/wail/
 
 DIRECTORY="/Applications/WAIL.app/"
+MATS_DEV_ID="Matthew Kelly (843256YZYD)"
 
 trap exit INT
 
@@ -95,8 +96,16 @@ createBinary ()
     echo "🍎 Building native single-architecture binary"
   fi
 
-  pyinstaller -p bundledApps ./bundledApps/WAIL.py --onefile --windowed --clean "${archflag[@]}" --icon="./build/icons/wail_blue.icns"
-  # Replace default version and icon information from pyinstaller 
+  if ! $GITHUB_ACTIONS ; then
+    echo "Building an initially signed binary, as we are not running under GitHub Actions"
+    pyinstaller --codesign-identity="87FC5BD9729DA162BF0B9767F8847AED82F88839" --osx-entitlements-file="./build/entitlements.plist" -p bundledApps ./bundledApps/WAIL.py --onefile --windowed --clean "${archflag[@]}" --icon="./build/icons/wail_blue.icns"
+  else
+    # TODO: make this work for _other_ users to build the app as well, not just Mat with his codesigning creds
+    echo "Building without codesigning"
+    pyinstaller -p bundledApps ./bundledApps/WAIL.py --onefile --windowed --clean "${archflag[@]}" --icon="./build/icons/wail_blue.icns"
+  fi
+
+  # Replace default version and icon information from pyinstaller
   cp ./build/Info.plist ./dist/WAIL.app/Contents/Info.plist
   # Copy the bundledApps and support directories to inside WAIL.app/
   cp -r ./bundledApps ./support ./build ./config ./archives ./archiveIndexes ./dist/WAIL.app/
@@ -179,7 +188,8 @@ optimizeforMac ()
 buildDiskImage ()
 {
   echo "Building Disk Image"
-  # Create a dmg
+  # Move back to source directory and build the DMG based on the .app generated
+  cd $builddir
   dmgbuild -s ./build/dmgbuild_settings.py "WAIL" WAIL.dmg
 }
 
@@ -200,9 +210,31 @@ doFinalCleanupBeforeMove ()
   # TODO: remove MAKEFILE from binary and other cruft that is fine in src but not in the .app
 }
 
+resignBinary ()
+{
+  echo "Check if running in GitHub Actions, if so, don't resign"
+
+  if $GITHUB_ACTIONS ; then
+    echo "Currently running it GitHub Actions, don't fit signing...for now"
+    return 1
+  fi
+
+  echo "Fix signing"
+  # We moved the bundledApps into the WAIL.app after signing, so let's move them
+  # again (?) and resign to get round the "unsealed contents present in the bundle root" error
+  # See #48 in the WAIL repo for more info
+  cd /Applications/WAIL.app
+  mv archives bundledApps support archiveIndexes build config ./Contents/
+  codesign --force --deep --sign "Developer ID Application: $MATS_DEV_ID" /Applications/WAIL.app
+  echo "Verifying codesigning"
+  codesign -vv --strict /Applications/WAIL.app
+}
+
 makeWAIL ()
 {
   echo "Running makeWAIL()"
+  builddir=$PWD
+
   installRequirements
   decompressJDKModules
   createBinary
@@ -212,6 +244,9 @@ makeWAIL ()
   doFinalCleanupBeforeMove
   mvProducts
   cleanupByproducts
+
+  resignBinary
+
   mvWARCsBackFromTemp
 
   # install binary, create dmg, or both? (i/d/b)

bundledApps/WAIL.py

@@ -1890,7 +1890,7 @@ def generate_path_index(self):
     def generate_cdx() -> None:
         dest = f"{config.wail_path}/archiveIndexes/index.cdx"
 
-        warcs_path = f"{config.wail_path}/archives/"
+        warcs_path = config.warcs_folder
         cdx_file_path_pre = f"{config.wail_path}/archiveIndexes/"
         cdx_indexer_path = (
             f"{config.wail_path}/bundledApps/tomcat/webapps/bin/cdx-indexer"

bundledApps/WAILConfig.py

@@ -6,6 +6,9 @@
 import re
 import sys
 import wx
+
+from pathlib import Path
+
 if os.name == 'nt':
     from win32com.client import Dispatch
 
@@ -231,13 +234,14 @@
 
 if "darwin" in sys.platform:  # macOS-specific code
     # This should be dynamic but doesn't work with WAIL binary
-    wail_path = '/Applications/WAIL.app'
+    wail_path = '/Applications/WAIL.app/Contents'
     heritrix_path = f'{wail_path}/bundledApps/heritrix-3.7.0/'
     heritrix_bin_path = f'sh {heritrix_path}bin/heritrix'
     heritrix_job_path = f'{heritrix_path}jobs/'
     font_size = 10
     tomcat_path = f'{wail_path}/bundledApps/tomcat'
-    warcs_folder = f'{wail_path}/archives'
+    # warcs_folder = f'{wail_path}/archives'
+    warcs_folder = f'{Path.home()}/archives'
     tomcat_path_start = f'{tomcat_path}/bin/startup.sh'
     tomcat_path_stop = f'{tomcat_path}/bin/shutdown.sh'
 

bundledApps/tomcat/webapps/ROOT/WEB-INF/CDXCollection.xml

@@ -41,9 +41,12 @@
 
 <!--
 	A single CDX SearchResultSource example.
+	Prior value was ${wail.basedir}/archiveIndexes/index.cdx , but the variable in the path
+	causes the index to not be accessing from OpenWayback web UI, so hard-code the path for now
+	20250312
 -->
           <bean class="org.archive.wayback.resourceindex.cdx.CDXIndex">
-            <property name="path" value="${wail.basedir}/archiveIndexes/index.cdx" />
+            <property name="path" value="/Applications/WAIL.app/Contents/archiveIndexes/index.cdx" />
           </bean>
 
 <!--

bundledApps/tomcat/webapps/ROOT/WEB-INF/wayback.xml

@@ -15,8 +15,8 @@
     <property name="properties">
       <value>
         <!-- Customize these basic placeholders. -->
-        wail.basedir=/Applications/WAIL.app
-        wayback.basedir.default=/Applications/WAIL.app/bundledApps/tomcat/webapps/ROOT
+        wail.basedir=/Applications/WAIL.app/Contents
+        wayback.basedir.default=/Applications/WAIL.app/Contents/bundledApps/tomcat/webapps/ROOT
         wayback.url.scheme.default=http
         wayback.url.host.default=localhost
         wayback.url.port.default=8080