Update windows and apple signing process (#4806)

2026-09-25 04:09:44 +03:00 · 2024-09-05 09:15:12 -05:00
parent 308fc972f7
commit 39361bd24e
14 changed files with 456 additions and 68 deletions
@@ -23,6 +23,12 @@ on:
        required: true
        default: snapshots
    secrets:
+        APPLE_CERTS_BASE64:
+            required: true
+        APPLE_CERTS_BASE64_PASSWD:
+            required: true
+        KEYCHAIN_PASSWD:
+            required: true
        AZURE_TENANT_ID:
            required: true
        AZURE_CLIENT_ID:
@@ -53,13 +59,15 @@ jobs:
        run: |
          if [[ '${{ env.signing_secret }}' == '' ]]
          then
-            SIGN_VAL=$(echo "false")
+            SIGN_VAL=$(echo 'notexists')
          else
-            SIGN_VAL=$(echo "true")
+            SIGN_VAL=$(echo 'exists')
          fi
          echo "BINSIGN=$SIGN_VAL" >> $GITHUB_OUTPUT
        shell: bash

+      - run: echo "signing is ${{ steps.set-signing-state.outputs.BINSIGN }}."
+
  build_and_test_win:
  # Windows w/ MSVC + CMake
  #
@@ -114,7 +122,27 @@ jobs:
        run: 7z x ${{ steps.set-file-base.outputs.FILE_BASE }}.zip
        shell: bash

+      - name: Install TrustedSigning (Windows)
+        run: |
+            Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile .\nuget.exe
+            .\nuget.exe install Microsoft.Windows.SDK.BuildTools -Version 10.0.22621.3233 -x
+            .\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -x
+        shell: pwsh
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
+      - name: create-json
+        id: create-json
+        uses: jsdaniell/create-json@v1.2.3
+        with:
+            name: "credentials.json"
+            dir: 'hdfsrc'
+            json: '{"Endpoint": "${{ secrets.AZURE_ENDPOINT }}","CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}","CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}"}'
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
      - name: Run ctest (Windows)
+        env:
+          BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
+          SIGNTOOLDIR: ${{ github.workspace }}/Microsoft.Windows.SDK.BuildTools/bin/10.0.22621.0/x64
        run: |
          cd "${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}"
          cmake --workflow --preset=${{ inputs.preset_name }}-MSVC --fresh
@@ -134,7 +162,7 @@ jobs:
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
-        if: ${{ needs.check-secret.outputs.sign-state == 'true' }}
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}

      - name: Publish binary (Windows)
        id: publish-ctest-binary
@@ -323,6 +351,28 @@ jobs:
        with:
          version: "1.9.7"

+      - name: Install the Apple certificate and provisioning profile
+        shell: bash
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+          P12_PASSWORD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+          KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+        run: |
+            # create variables
+            CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+            KEYCHAIN_FILE=${{ vars.KEYCHAIN_NAME }}.keychain
+            # import certificate from secrets
+            echo $BUILD_CERTIFICATE_BASE64 | base64 --decode > $CERTIFICATE_PATH
+            security -v create-keychain -p $KEYCHAIN_PASSWD $KEYCHAIN_FILE
+            security -v list-keychain -d user -s $KEYCHAIN_FILE
+            security -v list-keychains
+            security -v set-keychain-settings -lut 21600 $KEYCHAIN_FILE
+            security -v unlock-keychain -p $KEYCHAIN_PASSWD $KEYCHAIN_FILE
+            # import certificate to keychain
+            security -v import $CERTIFICATE_PATH -P $P12_PASSWORD -A -t cert -f pkcs12 -k $KEYCHAIN_FILE
+            security -v set-key-partition-list -S apple-tool:,codesign:,apple: -k $KEYCHAIN_PASSWD $KEYCHAIN_FILE
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
      - name: Set up JDK 19
        uses: actions/setup-java@v4
        with:
@@ -367,11 +417,100 @@ jobs:

      - name: Run ctest (MacOS_latest)
        id: run-ctest
+        env:
+          BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
+          SIGNER: ${{ vars.SIGNER }}
        run: |
          cd "${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}"
-          cmake --workflow --preset=${{ inputs.preset_name }}-MACOS-Clang --fresh
+          cmake --workflow --preset=${{ inputs.preset_name }}-macos-Clang --fresh
        shell: bash

+      - name: Sign dmg (MacOS_latest)
+        id: sign-dmg
+        env:
+          KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+          KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
+          SIGNER: ${{ vars.SIGNER }}
+          NOTARY_USER: ${{ vars.NOTARY_USER }}
+          NOTARY_KEY: ${{ vars.NOTARY_KEY }}
+        run: |
+          /usr/bin/codesign --force --timestamp --options runtime --entitlements ${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}/config/cmake/distribution.entitlements --verbose=4 --strict --sign ${{ env.SIGNER }} --deep ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Check dmg timestamp (MacOS_latest)
+        run: |
+          /usr/bin/codesign -dvv ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Verify dmg (MacOS_latest)
+        run: |
+          /usr/bin/hdiutil verify ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Notarize dmg (MacOS_latest)
+        id: notarize-dmg
+        env:
+          KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+          KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
+          SIGNER: ${{ vars.SIGNER }}
+          NOTARY_USER: ${{ vars.NOTARY_USER }}
+          NOTARY_KEY: ${{ vars.NOTARY_KEY }}
+        run: |
+          jsonout=$(/usr/bin/xcrun notarytool submit --wait --output-format json --apple-id ${{ env.NOTARY_USER }} --password ${{ env.NOTARY_KEY }} --team-id ${{ env.SIGNER }} ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg)
+          echo "JSONOUT=$jsonout" >> $GITHUB_OUTPUT
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Get ID token (MacOS_latest)
+        id: get-id-token
+        run: |
+          echo "notary result is ${{ fromJson(steps.notarize-dmg.outputs.JSONOUT) }}"
+          token=${{ fromJson(steps.notarize-dmg.outputs.JSONOUT).id }}
+          echo "ID_TOKEN=$token" >> "$GITHUB_OUTPUT"
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: post notary check (MacOS_latest)
+        id: post-notary
+        env:
+          KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+          KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
+          SIGNER: ${{ vars.SIGNER }}
+          NOTARY_USER: ${{ vars.NOTARY_USER }}
+          NOTARY_KEY: ${{ vars.NOTARY_KEY }}
+        run: |
+          {
+            echo 'NOTARYOUT<<EOF'
+            /usr/bin/xcrun notarytool info --apple-id ${{ env.NOTARY_USER }} --password ${{ env.NOTARY_KEY }} --team-id ${{ env.SIGNER }} ${{ steps.get-id-token.outputs.ID_TOKEN }}
+            echo EOF
+          } >> $GITHUB_OUTPUT
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Get notary info (MacOS_latest)
+        id: get-notary-info
+        run: |
+          echo "notary info is ${{ steps.post-notary.outputs.NOTARYOUT }}."
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+
+      - name: Staple dmg (MacOS_latest)
+        id: staple-dmg
+        env:
+          KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+          KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
+          SIGNER: ${{ vars.SIGNER }}
+          NOTARY_USER: ${{ vars.NOTARY_USER }}
+          NOTARY_KEY: ${{ vars.NOTARY_KEY }}
+        run: |
+          /usr/bin/xcrun stapler staple ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+        shell: bash
+        continue-on-error: true
+
      - name: Publish binary (MacOS_latest)
        id: publish-ctest-binary
        run: |
@@ -379,8 +518,8 @@ jobs:
          mkdir "${{ runner.workspace }}/build/hdf5"
          cp ${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}/COPYING ${{ runner.workspace }}/build/hdf5
          cp ${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}/COPYING_LBNL_HDF5 ${{ runner.workspace }}/build/hdf5
-          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-Clang/README.md ${{ runner.workspace }}/build/hdf5
-          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-Clang/*.tar.gz ${{ runner.workspace }}/build/hdf5
+          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/README.md ${{ runner.workspace }}/build/hdf5
+          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.tar.gz ${{ runner.workspace }}/build/hdf5
          cd "${{ runner.workspace }}/build"
          tar -zcvf ${{ steps.set-file-base.outputs.FILE_BASE }}-macos14_clang.tar.gz hdf5
        shell: bash
@@ -392,8 +531,8 @@ jobs:
          mkdir "${{ runner.workspace }}/builddmg/hdf5"
          cp ${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}/COPYING ${{ runner.workspace }}/builddmg/hdf5
          cp ${{ runner.workspace }}/hdf5/${{ steps.set-file-base.outputs.SOURCE_BASE }}/COPYING_LBNL_HDF5 ${{ runner.workspace }}/builddmg/hdf5
-          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-Clang/README.md ${{ runner.workspace }}/builddmg/hdf5
-          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-Clang/*.dmg ${{ runner.workspace }}/builddmg/hdf5
+          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/README.md ${{ runner.workspace }}/builddmg/hdf5
+          cp ${{ runner.workspace }}/hdf5/build/${{ inputs.preset_name }}-macos-Clang/*.dmg ${{ runner.workspace }}/builddmg/hdf5
          cd "${{ runner.workspace }}/builddmg"
          tar -zcvf ${{ steps.set-file-base.outputs.FILE_BASE }}-macos14_clang.arm64.dmg.tar.gz hdf5
        shell: bash
@@ -568,7 +707,7 @@ jobs:
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
-        if: ${{ needs.check-secret.outputs.sign-state == 'true' }}
+        if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}

      - name: Publish binary (Windows_intel)
        id: publish-ctest-binary
@@ -45,6 +45,9 @@ jobs:
 #      use_tag: snapshot
      use_environ: snapshots
    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
@@ -186,7 +186,7 @@ jobs:
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}.zip >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
-          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.arm64.dmg.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
+          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.dmg.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.deb.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
          sha256sum ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.rpm.tar.gz >> ${{ steps.get-file-base.outputs.FILE_BASE }}.sha256sums.txt
@@ -232,7 +232,7 @@ jobs:
              ${{ steps.get-file-base.outputs.FILE_BASE }}.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}.zip
              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.tar.gz
-              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.arm64.dmg.tar.gz
+              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.dmg.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.deb.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.rpm.tar.gz
@@ -261,7 +261,7 @@ jobs:
              hdf5.tar.gz
              hdf5.zip
              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.tar.gz
-              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.arm64.dmg.tar.gz
+              ${{ steps.get-file-base.outputs.FILE_BASE }}-macos14_clang.dmg.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.deb.tar.gz
              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204_gcc.rpm.tar.gz
@@ -41,6 +41,9 @@ jobs:
      snap_name: hdf5-${{ needs.call-workflow-tarball.outputs.source_base }}
      use_environ: release
    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
@@ -268,6 +268,11 @@ if (NOT HDF5_EXTERNALLY_CONFIGURED AND NOT HDF5_NO_PACKAGES)
  endif ()
  set (CPACK_PACKAGE_ICON "${HDF_RESOURCES_DIR}/hdf.bmp")

+  set (CPACK_ORIG_SOURCE_DIR ${CMAKE_SOURCE_DIR})
+  if ("$ENV{BINSIGN}" STREQUAL "exists")
+    set (CPACK_PRE_BUILD_SCRIPTS ${CMAKE_SOURCE_DIR}/config/cmake/SignPackageFiles.cmake)
+  endif ()
+
  set (CPACK_GENERATOR "TGZ")
  if (WIN32)
    set (CPACK_GENERATOR "ZIP")
@@ -155,6 +155,26 @@
        "ci-StdShar"
      ]
    },
+    {
+      "name": "ci-StdShar-macos-Clang",
+      "description": "Clang Standard Config for macos (Release)",
+      "inherits": [
+        "ci-macos-Release-Clang",
+        "ci-CPP",
+        "ci-Java",
+        "ci-StdShar"
+      ]
+    },
+    {
+      "name": "ci-StdShar-macos-GNUC",
+      "description": "GNUC Standard Config for macos (Release)",
+      "inherits": [
+        "ci-macos-Release-GNUC",
+        "ci-CPP",
+        "ci-Java",
+        "ci-StdShar"
+      ]
+    },
    {
      "name": "ci-StdShar-GNUC",
      "description": "GNUC Standard Config for x64 (Release)",
@@ -203,6 +223,23 @@
        "ci-x64-Release-Clang"
      ]
    },
+    {
+      "name": "ci-StdShar-macos-Clang",
+      "description": "Clang Standard Build for macos (Release)",
+      "configurePreset": "ci-StdShar-macos-Clang",
+      "inherits": [
+        "ci-macos-Release-Clang"
+      ]
+    },
+    {
+      "name": "ci-StdShar-macos-GNUC",
+      "description": "GNUC Standard Build for macos (Release)",
+      "configurePreset": "ci-StdShar-macos-GNUC",
+      "verbose": true,
+      "inherits": [
+        "ci-macos-Release-GNUC"
+      ]
+    },
    {
      "name": "ci-StdShar-GNUC",
      "description": "GNUC Standard Build for x64 (Release)",
@@ -252,22 +289,24 @@
      ]
    },
    {
-      "name": "ci-StdShar-MACOS-Clang",
-      "configurePreset": "ci-StdShar-Clang",
+      "name": "ci-StdShar-macos-Clang",
+      "configurePreset": "ci-StdShar-macos-Clang",
      "inherits": [
-        "ci-x64-Release-Clang"
+        "ci-macos-Release-Clang"
      ],
      "execution": {
        "noTestsAction": "error",
        "timeout": 180,
        "jobs": 2
-      },
-      "condition": {
-        "type": "equals",
-        "lhs": "${hostSystemName}",
-        "rhs": "Darwin"
      }
    },
+    {
+      "name": "ci-StdShar-macos-GNUC",
+      "configurePreset": "ci-StdShar-macos-GNUC",
+      "inherits": [
+        "ci-macos-Release-GNUC"
+      ]
+    },
    {
      "name": "ci-StdShar-GNUC",
      "configurePreset": "ci-StdShar-GNUC",
@@ -318,6 +357,16 @@
      "configurePreset": "ci-StdShar-Clang",
      "inherits": "ci-x64-Release-Clang"
    },
+    {
+      "name": "ci-StdShar-macos-Clang",
+      "configurePreset": "ci-StdShar-macos-Clang",
+      "inherits": "ci-macos-Release-Clang"
+    },
+    {
+      "name": "ci-StdShar-macos-GNUC",
+      "configurePreset": "ci-StdShar-macos-GNUC",
+      "inherits": "ci-macos-Release-GNUC"
+    },
    {
      "name": "ci-StdShar-GNUC",
      "configurePreset": "ci-StdShar-GNUC",
@@ -354,12 +403,12 @@
      ]
    },
    {
-      "name": "ci-StdShar-MACOS-Clang",
+      "name": "ci-StdShar-macos-Clang",
      "steps": [
-        {"type": "configure", "name": "ci-StdShar-Clang"},
-        {"type": "build", "name": "ci-StdShar-Clang"},
-        {"type": "test", "name": "ci-StdShar-MACOS-Clang"},
-        {"type": "package", "name": "ci-StdShar-Clang"}
+        {"type": "configure", "name": "ci-StdShar-macos-Clang"},
+        {"type": "build", "name": "ci-StdShar-macos-Clang"},
+        {"type": "test", "name": "ci-StdShar-macos-Clang"},
+        {"type": "package", "name": "ci-StdShar-macos-Clang"}
      ]
    },
    {
@@ -371,6 +420,15 @@
        {"type": "package", "name": "ci-StdShar-GNUC"}
      ]
    },
+    {
+      "name": "ci-StdShar-macos-GNUC",
+      "steps": [
+        {"type": "configure", "name": "ci-StdShar-macos-GNUC"},
+        {"type": "build", "name": "ci-StdShar-macos-GNUC"},
+        {"type": "test", "name": "ci-StdShar-macos-GNUC"},
+        {"type": "package", "name": "ci-StdShar-macos-GNUC"}
+      ]
+    },
    {
      "name": "ci-StdShar-GNUC-S3",
      "steps": [
@@ -10,7 +10,7 @@
      "binaryDir": "${sourceParentDir}/build/${presetName}",
      "installDir": "${sourceParentDir}/install/${presetName}"
    },
-   {
+    {
      "name": "ci-x64",
      "architecture": {
        "value": "x64",
@@ -21,7 +21,15 @@
    {
      "name": "ci-x86",
      "architecture": {
-        "value": "x86",
+        "value": "Win32",
+        "strategy": "external"
+      },
+      "hidden": true
+    },
+    {
+      "name": "ci-arm64",
+      "architecture": {
+        "value": "ARM64",
        "strategy": "external"
      },
      "hidden": true
@@ -48,25 +56,29 @@
        "CMAKE_C_COMPILER": "cl",
        "CMAKE_CXX_COMPILER": "cl"
      },
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
-      },
      "condition": {
        "type": "equals",
        "lhs": "${hostSystemName}",
        "rhs": "Windows"
      }
    },
+    {
+      "name": "ci-macos",
+      "hidden": true,
+      "cacheVariables": {
+        "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64"
+      },
+      "condition": {
+        "type": "equals",
+        "lhs": "${hostSystemName}",
+        "rhs": "Darwin"
+      }
+    },
    {
      "name": "ci-Clang",
      "hidden": true,
      "cacheVariables": {
        "CMAKE_TOOLCHAIN_FILE": "config/toolchain/clang.cmake"
-      },
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
      }
    },
    {
@@ -79,29 +91,17 @@
        "type": "equals",
        "lhs": "${hostSystemName}",
        "rhs": "Linux"
-      },
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
      }
    },
    {
      "name": "ci-Intel",
-      "hidden": true,
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
-      }
+      "hidden": true
    },
    {
      "name": "ci-Fortran",
      "hidden": true,
      "cacheVariables": {
        "HDF5_BUILD_FORTRAN": "ON"
-      },
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
      }
    },
    {
@@ -129,10 +129,6 @@
      "hidden": true,
      "cacheVariables": {
        "HDF5_BUILD_JAVA": "ON"
-      },
-      "toolset": {
-        "value": "host=x64",
-        "strategy": "external"
      }
    },
    {
@@ -201,6 +197,50 @@
        "ci-GNUC"
      ]
    },
+    {
+      "name": "ci-macos-Debug-Clang",
+      "description": "Clang/LLVM for x64 (Debug)",
+      "hidden": true,
+      "inherits": [
+        "ci-base",
+        "ci-macos",
+        "ci-Debug",
+        "ci-Clang"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-Clang",
+      "description": "Clang/LLVM for x64 (Release)",
+      "hidden": true,
+      "inherits": [
+        "ci-base",
+        "ci-macos",
+        "ci-Release",
+        "ci-Clang"
+      ]
+    },
+    {
+      "name": "ci-macos-Debug-GNUC",
+      "description": "GNUC for x64 (Debug)",
+      "hidden": true,
+      "inherits": [
+        "ci-base",
+        "ci-macos",
+        "ci-Debug",
+        "ci-GNUC"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-GNUC",
+      "description": "GNUC for x64 (Release)",
+      "hidden": true,
+      "inherits": [
+        "ci-base",
+        "ci-macos",
+        "ci-Release",
+        "ci-GNUC"
+      ]
+    },
    {
      "name": "ci-x64-Debug-Intel",
      "description": "Intel for x64 (Debug)",
@@ -328,6 +368,38 @@
        "ci-base"
      ]
    },
+    {
+      "name": "ci-macos-Debug-Clang",
+      "configurePreset": "ci-macos-Debug-Clang",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-Clang",
+      "configurePreset": "ci-macos-Release-Clang",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Debug-GNUC",
+      "configurePreset": "ci-macos-Debug-GNUC",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-GNUC",
+      "configurePreset": "ci-macos-Release-GNUC",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
    {
      "name": "ci-x64-Debug-Intel",
      "configurePreset": "ci-x64-Debug-Intel",
@@ -453,6 +525,38 @@
        "ci-base"
      ]
    },
+    {
+      "name": "ci-macos-Debug-Clang",
+      "configurePreset": "ci-macos-Debug-Clang",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-Clang",
+      "configurePreset": "ci-macos-Release-Clang",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Debug-GNUC",
+      "configurePreset": "ci-macos-Debug-GNUC",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
+    {
+      "name": "ci-macos-Release-GNUC",
+      "configurePreset": "ci-macos-Release-GNUC",
+      "hidden": true,
+      "inherits": [
+        "ci-base"
+      ]
+    },
    {
      "name": "ci-x64-Debug-Intel",
      "configurePreset": "ci-x64-Debug-Intel",
@@ -536,6 +640,18 @@
      "hidden": true,
      "inherits": "ci-base"
    },
+    {
+      "name": "ci-macos-Release-Clang",
+      "configurePreset": "ci-macos-Release-Clang",
+      "hidden": true,
+      "inherits": "ci-base"
+    },
+    {
+      "name": "ci-macos-Release-GNUC",
+      "configurePreset": "ci-macos-Release-GNUC",
+      "hidden": true,
+      "inherits": "ci-base"
+    },
    {
      "name": "ci-x64-Release-Intel",
      "configurePreset": "ci-x64-Release-Intel",
@@ -1,5 +1,5 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<?xml version="1.0" ?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
  <key>CFBundleDevelopmentRegion</key>
@@ -16,11 +16,16 @@
  <string>FMWK</string>
  <key>CFBundleSignature</key>
  <string>????</string>
+  <!-- See https://developer.apple.com/app-store/categories/ for list of AppStore categories -->
+  <key>LSApplicationCategoryType</key>
+  <string>public.app-category.utilities</string>
  <key>CFBundleVersion</key>
  <string>@CPACK_PACKAGE_VERSION@</string>
  <key>CFBundleShortVersionString</key>
  <string>@CPACK_SHORT_VERSION_STRING@</string>
+  <key>NSHumanReadableCopyright</key>
+  <string>Copyright 2006 by The HDF Group</string>
  <key>CSResourcesFileMapped</key>
-  <true/>
+  <string>true</string>
 </dict>
 </plist>
@@ -0,0 +1,43 @@
+# This script signs the targets for the package
+message(STATUS "Signing script in ${CPACK_TEMPORARY_INSTALL_DIRECTORY} and ${CPACK_PACKAGE_INSTALL_DIRECTORY}")
+
+# RPM needs ALL_COMPONENTS_IN_ONE added to path between ${CPACK_TEMPORARY_INSTALL_DIRECTORY} and ${CPACK_PACKAGE_INSTALL_DIRECTORY}
+if (CPACK_GENERATOR MATCHES "RPM")
+    set (CPACK_TARGET_FILE_DIRECTORY "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_COMPONENTS_IN_ONE/${CPACK_PACKAGE_INSTALL_DIRECTORY}")
+elseif (CPACK_GENERATOR MATCHES "WIX" OR CPACK_GENERATOR MATCHES "NSIS")
+    set (CPACK_TARGET_FILE_DIRECTORY "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/libraries")
+elseif (CPACK_GENERATOR MATCHES "ZIP")
+    set (CPACK_TARGET_FILE_DIRECTORY "${CPACK_TEMPORARY_INSTALL_DIRECTORY}")
+elseif (CPACK_GENERATOR MATCHES "DragNDrop")
+    set (CPACK_TARGET_FILE_DIRECTORY "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_IN_ONE/${CPACK_PACKAGE_INSTALL_DIRECTORY}")
+else ()
+    set (CPACK_TARGET_FILE_DIRECTORY "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/${CPACK_PACKAGE_INSTALL_DIRECTORY}")
+endif ()
+file (GLOB target_list LIST_DIRECTORIES false "${CPACK_TARGET_FILE_DIRECTORY}/lib/*" "${CPACK_TARGET_FILE_DIRECTORY}/bin/*")
+foreach (targetfile IN LISTS target_list)
+    if (WIN32)
+        # Sign the targets
+        execute_process (COMMAND $ENV{SIGNTOOLDIR}/signtool
+          sign /v /debug /fd SHA256 /tr http://timestamp.acs.microsoft.com /td SHA256
+          /dlib "Microsoft.Trusted.Signing.Client/bin/x64/Azure.CodeSigning.Dlib.dll" /dmdf ${CPACK_ORIG_SOURCE_DIR}/credentials.json
+          ${targetfile}
+        )
+        execute_process (
+          COMMAND ${CMAKE_COMMAND} -E echo "Signing the target ${targetfile}"
+        )
+    elseif (APPLE)
+        # Sign the targets
+        execute_process (COMMAND codesign
+          --force --timestamp --options runtime --entitlements ${CPACK_ORIG_SOURCE_DIR}/config/cmake/distribution.entitlements 
+          --verbose=4 --strict --sign "$ENV{SIGNER}"
+          ${targetfile}
+        )
+        execute_process (
+          COMMAND ${CMAKE_COMMAND} -E echo "Signing the target ${targetfile}"
+        )
+    else ()
+        execute_process (
+          COMMAND ${CMAKE_COMMAND} -E echo "Signing the target ${targetfile}"
+        )
+    endif ()
+endforeach ()
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+</dict>
+</plist>
@@ -137,7 +137,7 @@ set (CTEST_CONFIGURE_COMMAND

 #-----------------------------------------------------------------------------
 ## -- set output to english
-set ($ENV{LC_MESSAGES}  "en_EN")
+set (ENV{LC_MESSAGES} "en_EN")

 #-----------------------------------------------------------------------------
  configure_file(${CTEST_SOURCE_DIRECTORY}/config/cmake/CTestCustom.cmake ${CTEST_BINARY_DIRECTORY}/CTestCustom.cmake)
@@ -51,15 +51,15 @@ endif ()
 set (BUILD_OPTIONS "${ADD_BUILD_OPTIONS} -DSITE:STRING=${CTEST_SITE} -DBUILDNAME:STRING=${CTEST_BUILD_NAME}")

 # Launchers work only with Makefile and Ninja generators.
-if(NOT "${CTEST_CMAKE_GENERATOR}" MATCHES "Make|Ninja" OR LOCAL_SKIP_TEST)
-  set(CTEST_USE_LAUNCHERS 0)
-  set(ENV{CTEST_USE_LAUNCHERS_DEFAULT} 0)
-  set(BUILD_OPTIONS "${BUILD_OPTIONS} -DCTEST_USE_LAUNCHERS:BOOL=OFF")
-else()
-  set(CTEST_USE_LAUNCHERS 1)
-  set(ENV{CTEST_USE_LAUNCHERS_DEFAULT} 1)
-  set(BUILD_OPTIONS "${BUILD_OPTIONS} -DCTEST_USE_LAUNCHERS:BOOL=ON")
-endif()
+if (NOT "${CTEST_CMAKE_GENERATOR}" MATCHES "Make|Ninja" OR LOCAL_SKIP_TEST)
+  set (CTEST_USE_LAUNCHERS 0)
+  set (ENV{CTEST_USE_LAUNCHERS_DEFAULT} 0)
+  set (BUILD_OPTIONS "${BUILD_OPTIONS} -DCTEST_USE_LAUNCHERS:BOOL=OFF")
+else ()
+  set (CTEST_USE_LAUNCHERS 1)
+  set (ENV{CTEST_USE_LAUNCHERS_DEFAULT} 1)
+  set (BUILD_OPTIONS "${BUILD_OPTIONS} -DCTEST_USE_LAUNCHERS:BOOL=ON")
+endif ()

 #-----------------------------------------------------------------------------
 # MAC machines need special option
@@ -206,7 +206,7 @@ endif ()

 #-----------------------------------------------------------------------------
 ## -- set output to english
-set ($ENV{LC_MESSAGES}  "en_EN")
+set (ENV{LC_MESSAGES} "en_EN")

 # Print summary information.
 foreach (v
@@ -1,4 +1,4 @@
-set(TOOLCHAIN_PREFIX x86_64-w64-mingw32)
+set (TOOLCHAIN_PREFIX x86_64-w64-mingw32)
 set (CMAKE_SYSTEM_NAME Windows)
 set (CMAKE_C_COMPILER ${TOOLCHAIN_PREFIX}-gcc)
 set (CMAKE_CXX_COMPILER ${TOOLCHAIN_PREFIX}-g++)
@@ -22,7 +22,7 @@ I. Preconditions

   1. We suggest you obtain the latest CMake for your platform from the Kitware
      web site. The HDF5 1.15.x product requires a minimum CMake version
-      of 3.18. If you are using VS2022, the minimum version is 3.21.
+      of 3.18. If you are using VS2022, the minimum CMake version is 3.21.

   2. You have installed the HDF5 library built with CMake, by executing
      the HDF Install Utility (the *.msi file in the binary package for