ci: Extend packaging pipeline to sign macOS binaries automatically

Add signing and notarization on macOS in a dedicated job that runs with
access to a code signing certificate and notarization credentials.

.gitlab-ci.yml

@@ -1252,6 +1252,16 @@ b:macos-package:
         - .run_only_for_package
     needs:
         - p:doc-package
+
+k:macos-package:
+    extends:
+        - .macos_sign
+        - .cmake_sign_macos
+        - .cmake_release_artifacts
+        - .macos_sign_tags
+        - .run_only_for_package
+    needs:
+        - b:macos-package
     variables:
         CMAKE_CI_ARTIFACTS_NAME: "artifacts-macos-universal"
 
@@ -1260,7 +1270,7 @@ u:macos-package:
         - .rsync_upload_package
         - .run_only_for_package
     needs:
-        - b:macos-package
+        - k:macos-package
 
 b:macos10.10-package:
     extends:
@@ -1271,6 +1281,16 @@ b:macos10.10-package:
         - .run_only_for_package
     needs:
         - p:doc-package
+
+k:macos10.10-package:
+    extends:
+        - .macos_sign
+        - .cmake_sign_macos
+        - .cmake_release_artifacts
+        - .macos_sign_tags
+        - .run_only_for_package
+    needs:
+        - b:macos10.10-package
     variables:
         CMAKE_CI_ARTIFACTS_NAME: "artifacts-macos10.10-universal"
 
@@ -1279,7 +1299,7 @@ u:macos10.10-package:
         - .rsync_upload_package
         - .run_only_for_package
     needs:
-        - b:macos10.10-package
+        - k:macos10.10-package
 
 # Windows x86_64 jobs
 

.gitlab/artifacts.yml

@@ -122,8 +122,6 @@
             # Any source packages made.
             - ${CMAKE_CI_BUILD_DIR}/cmake-*.tar.gz
             - ${CMAKE_CI_BUILD_DIR}/cmake-*.zip
-            # Any unsigned packages made.
-            - ${CMAKE_CI_BUILD_DIR}/unsigned/cmake-*
         reports:
             annotations:
                 - ${CMAKE_CI_BUILD_DIR}/annotations.json

.gitlab/ci/package_macos.sh

@@ -1,12 +1,2 @@
 cd build
-cpack -G TGZ
 cpack -G DragNDrop
-
-case "$CMAKE_CI_PACKAGE" in
-    dev)
-        ;;
-    *)
-        mkdir -p unsigned
-        mv cmake-*-macos*-universal.* unsigned/
-        ;;
-esac

.gitlab/ci/package_macos_sign.sh

@@ -0,0 +1 @@
+Utilities/Release/macos/sign-notarize.bash -- build/cmake-*-macos*-universal.dmg

.gitlab/os-macos.yml

@@ -79,6 +79,11 @@
         CTEST_NO_WARNINGS_ALLOWED: 1
         CMAKE_CI_NO_INSTALL: 1
 
+.macos_sign:
+    variables:
+        GIT_CLONE_PATH: "$CI_BUILDS_DIR/cmake ci"
+        CMAKE_CONFIGURATION: macos_sign
+
 ### External testing
 
 .macos_x86_64_xcode:
@@ -181,6 +186,13 @@
         - nonconcurrent
         - finder
 
+.macos_sign_tags:
+    tags:
+        - cmake # Since this is a bare runner, pin to a project.
+        - shell
+        - sign-macos-v1
+        - nonconcurrent
+
 ## macOS-specific scripts
 
 .before_script_macos: &before_script_macos
@@ -232,3 +244,12 @@
         - sccache --show-stats
 
     interruptible: true
+
+.cmake_sign_macos:
+    stage: package
+    environment:
+        name: sign-macos
+    script:
+        - source .gitlab/ci/env.sh
+        - source .gitlab/ci/package_macos_sign.sh
+    interruptible: true