Translocation fix (#273)

Some mac machines seem to use translocation on the setup application bundle even though the application and the disk image itself is signed. This fix places all of the setup files in the Resources folder of the setup application. This way, even if translocation occurs, setup still has access to all of the setup files it needs.

.github/workflows/build.yml

@@ -147,9 +147,14 @@ jobs:
           file(TO_CMAKE_PATH "$ENV{RUNNER_WORKSPACE}" RUNNER_WORKSPACE)
           set(INSTALL_DIR "${NAME_NO_SPACES}")
           file(TO_NATIVE_PATH "${RUNNER_WORKSPACE}/${INSTALL_DIR}" PREFIX)
-          file(APPEND "$ENV{GITHUB_OUTPUT}" "install_prefix=${PREFIX}\n")
+          file(APPEND "$ENV{GITHUB_OUTPUT}" "install_prefix_setup=${PREFIX}\n")
           file(APPEND "$ENV{GITHUB_OUTPUT}" "install_dir=${INSTALL_DIR}\n")
-
+          if(APPLE)
+              file(APPEND "$ENV{GITHUB_OUTPUT}" "install_prefix=${PREFIX}/Setup\ EAR\ Production\ Suite.app/Contents/Resources\n")
+          else()
+              file(APPEND "$ENV{GITHUB_OUTPUT}" "install_prefix=${PREFIX}\n")
+          endif()
+          
       - name: 'Windows: set up developer environment'
         uses: ilammy/msvc-dev-cmd@v1
         if: matrix.config.os == 'windows-latest'
@@ -202,7 +207,7 @@ jobs:
 
       - name: 'unix: Tar output dir.'
         if: ${{ matrix.config.package && !startsWith(matrix.config.os, 'windows') }}
-        run: tar -cvf ${{ steps.cmake_install_prefix.outputs.install_dir }}.tar -C ${{ steps.cmake_install_prefix.outputs.install_prefix }} .
+        run: tar -cvf ${{ steps.cmake_install_prefix.outputs.install_dir }}.tar -C ${{ steps.cmake_install_prefix.outputs.install_prefix_setup }} .
 
       - name: 'unix: Upload Tar as build artifact.'
         if: ${{ matrix.config.package && !startsWith(matrix.config.os, 'windows') }}
@@ -216,7 +221,7 @@ jobs:
         uses: actions/upload-artifact@v2
         with:
           name: ${{ steps.cmake_install_prefix.outputs.install_dir }}
-          path: ${{ steps.cmake_install_prefix.outputs.install_prefix }}
+          path: ${{ steps.cmake_install_prefix.outputs.install_prefix_setup }}
 
       - name: 'Windows Disk Space'
         if: matrix.config.os == 'windows-latest'

.gitignore

@@ -15,4 +15,8 @@ docs/venv
 reaper-adm-extension/test/reaper_adm/data/UserPlugins/
 shared/version/eps_version.cpp
 submodules/visr
-submodules/VST3
+submodules/VST3
+packaging/codesign/*.dmg
+packaging/codesign/*.tar
+packaging/codesign/*.zip
+packaging/codesign/tmp

CHANGELOG.md

@@ -1,3 +1,7 @@
+Version 1.1.0b
+
+* Fix installation on MacOS where Gatekeeper enforces translocation [#273](https://github.com/ebu/ear-production-suite/pull/273)
+
 Version 1.1.0
 
 * Support for 128 channels when using REAPER >=v7.0 [#244](https://github.com/ebu/ear-production-suite/issues/244) [#254](https://github.com/ebu/ear-production-suite/pull/254) [#267](https://github.com/ebu/ear-production-suite/pull/267)

CMakeLists.txt

@@ -52,6 +52,7 @@ set(EPS_SHARED_DIR ${CMAKE_CURRENT_SOURCE_DIR}/shared)
 set(JUCE_SUPPORT_RESOURCES ${CMAKE_CURRENT_SOURCE_DIR}/shared/resources)
 add_subdirectory(${EPS_SHARED_DIR}/version)
 
+set(EPS_PLUGIN_TARGETS "" CACHE INTERNAL "")
 add_subdirectory(ear-production-suite-plugins)
 add_subdirectory(reaper-adm-extension)
 add_subdirectory(reaper-adm-export-source-plugin)

cmake_modules/get_git_version.cmake

@@ -19,12 +19,14 @@ endfunction()
 function(update_version_from_git NUMERIC_VERSION DESCRIPTIVE_VERSION)
   find_package(Git)
   if(Git_FOUND)
+
+    #TODO: This is very similar to code in shared/version/gen_version.cmake - consolidate!
 
     git_describe(_GIT_REVISION --tags --abbrev=4 --dirty --match v[0-9]*)
     string(REGEX REPLACE "^v([0-9]+)\\..*" "\\1" VERSION_MAJOR "${_GIT_REVISION}")
     string(REGEX REPLACE "^v[0-9]+\\.([0-9]+).*" "\\1" VERSION_MINOR "${_GIT_REVISION}")
     string(REGEX REPLACE "^v[0-9]+\\.[0-9]+\\.([0-9]+).*" "\\1" VERSION_PATCH "${_GIT_REVISION}")
-    string(REGEX REPLACE "^v[0-9]+\\.[0-9]+\\.[0-9]+-(.*)" "\\1" VERSION_TWEAK "${_GIT_REVISION}")
+    string(REGEX REPLACE "^v[0-9]+\\.[0-9]+\\.[0-9]+(.*)" "\\1" VERSION_TWEAK "${_GIT_REVISION}")
 
     if(_GIT_REVISION)
       set(${NUMERIC_VERSION}_MAJOR ${VERSION_MAJOR} PARENT_SCOPE)
@@ -36,7 +38,7 @@ function(update_version_from_git NUMERIC_VERSION DESCRIPTIVE_VERSION)
 
       if(NOT VERSION_TWEAK STREQUAL _GIT_REVISION)
         # Tweak is present
-        set(${DESCRIPTIVE_VERSION} "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_TWEAK}" PARENT_SCOPE)		
+        set(${DESCRIPTIVE_VERSION} "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}${VERSION_TWEAK}" PARENT_SCOPE)		
         if(VERSION_TWEAK MATCHES "^[0-9]+$")	  
           # Tweak is numeric
           set(${NUMERIC_VERSION}_TWEAK ${VERSION_TWEAK} PARENT_SCOPE)

cmake_modules/juce_helpers.cmake

@@ -1,6 +1,6 @@
 function(add_juce_vst3_plugin PLUGIN_NAME)
   set(options)
-  set(oneValueArgs IDE_FOLDER DESCRIPTION DISPLAY_NAME OUTPUT_NAME CODE_PREFIX CODE_SUFFIX)
+  set(oneValueArgs IDE_FOLDER DESCRIPTION DISPLAY_NAME OUTPUT_NAME CODE_PREFIX CODE_SUFFIX IS_EPS_PLUGIN)
   set(multiValueArgs SOURCES)
   cmake_parse_arguments(PLUGIN "${options}" "${oneValueArgs}"
                         "${multiValueArgs}" ${ARGN} )
@@ -38,6 +38,11 @@ function(add_juce_vst3_plugin PLUGIN_NAME)
   target_include_directories(${PLUGIN_NAME}_VST3 PRIVATE ${_SUPPORT_PATH}/ ${EPS_SHARED_DIR})
   target_link_libraries(${PLUGIN_NAME}_VST3 PRIVATE Juce::VST3)
 
+  if(PLUGIN_IS_EPS_PLUGIN)
+    list(APPEND EPS_PLUGIN_TARGETS ${PLUGIN_NAME}_VST3)
+    set(EPS_PLUGIN_TARGETS ${EPS_PLUGIN_TARGETS} CACHE INTERNAL "")
+  endif()
+
   set_target_properties(${PLUGIN_NAME}_VST3 PROPERTIES
     BUNDLE TRUE
     OUTPUT_NAME "${PLUGIN_OUTPUT_NAME}"

ear-production-suite-plugins/plugins/CMakeLists.txt

@@ -5,4 +5,3 @@ add_subdirectory(hoa)
 add_subdirectory(scene)
 add_subdirectory(monitoring)
 add_subdirectory(binaural_monitoring)
-

ear-production-suite-plugins/plugins/binaural_monitoring/CMakeLists.txt

@@ -64,8 +64,9 @@ add_juce_vst3_plugin(
 	CODE_SUFFIX "F0" # Speaker Monitoring suffixes start from A0 and increment. For bin, lets use F0 (Note FF is scene)
 	DISPLAY_NAME "EAR Binaural Monitoring"
 	DESCRIPTION "The binaural monitoring plugin"
-	OUTPUT_NAME "EAR Binaural Monitoring")
-
+	OUTPUT_NAME "EAR Binaural Monitoring"
+	IS_EPS_PLUGIN ON)
+
 target_link_libraries(ear_binaural_monitoring_VST3 PRIVATE ear-plugin-base ear-version bear)
 install(TARGETS ear_binaural_monitoring_VST3 COMPONENT Plugins DESTINATION "${EPS_PLUGIN_INSTALL_PREFIX}ear-production-suite")
 

ear-production-suite-plugins/plugins/direct_speakers/CMakeLists.txt

@@ -71,8 +71,9 @@ add_juce_vst3_plugin(direct_speakers
   CODE_SUFFIX "10"
   DISPLAY_NAME "EAR DirectSpeakers" 
   DESCRIPTION "The metadata input plugin for channel-based audio"
-  OUTPUT_NAME "EAR DirectSpeakers")
-
+  OUTPUT_NAME "EAR DirectSpeakers"
+  IS_EPS_PLUGIN ON)
+
 target_link_libraries(direct_speakers_VST3 PRIVATE ear-plugin-base ear-version)
 target_compile_definitions(direct_speakers_VST3 PRIVATE USE_NEW_DESIGN)
 

ear-production-suite-plugins/plugins/hoa/CMakeLists.txt

@@ -67,8 +67,9 @@ add_juce_vst3_plugin(hoa
   CODE_SUFFIX "12"
   DISPLAY_NAME "EAR HOA" 
   DESCRIPTION "The metadata input plugin for scene-based audio"
-  OUTPUT_NAME "EAR HOA")
-
+  OUTPUT_NAME "EAR HOA"
+  IS_EPS_PLUGIN ON)
+
 target_link_libraries(hoa_VST3 PRIVATE ear-plugin-base ear-version)
 
 install_juce_vst3_plugin(hoa "${EPS_PLUGIN_INSTALL_PREFIX}ear-production-suite")

ear-production-suite-plugins/plugins/monitoring/CMakeLists.txt

@@ -45,18 +45,20 @@ function(add_monitoring_plugin SPEAKER_LAYOUT SPEAKER_LAYOUT_NAME AUDIO_PACK_FOR
   add_juce_vst3_plugin(
     ear_monitoring_${SPEAKER_LAYOUT}
     SOURCES ${SOURCES_MONITORING} ${HEADERS_MONITORING}
-	CODE_SUFFIX ${PLUGIN_CODE_SUFFIX}
+    CODE_SUFFIX ${PLUGIN_CODE_SUFFIX}
     DISPLAY_NAME "EAR Monitoring ${SPEAKER_LAYOUT}"
     DESCRIPTION "The monitoring plugin (${SPEAKER_LAYOUT})"
     OUTPUT_NAME "EAR Monitoring ${SPEAKER_LAYOUT}"
     IDE_FOLDER ${IDE_FOLDER_PLUGINS}
-  )
+    IS_EPS_PLUGIN ON)
+
   target_compile_definitions(
     ear_monitoring_${SPEAKER_LAYOUT}_VST3 PRIVATE
     SPEAKER_LAYOUT="${SPEAKER_LAYOUT}"
     SPEAKER_LAYOUT_NAME="${SPEAKER_LAYOUT_NAME}"
-	AUDIO_PACK_FORMAT_ID="${AUDIO_PACK_FORMAT_ID}"
+    AUDIO_PACK_FORMAT_ID="${AUDIO_PACK_FORMAT_ID}"
     )
+
   target_link_libraries(ear_monitoring_${SPEAKER_LAYOUT}_VST3 PRIVATE ear-plugin-base ear-version)
   install_juce_vst3_plugin(ear_monitoring_${SPEAKER_LAYOUT} "${EPS_PLUGIN_INSTALL_PREFIX}ear-production-suite")
 endfunction()

ear-production-suite-plugins/plugins/object/CMakeLists.txt

@@ -72,8 +72,9 @@ add_juce_vst3_plugin(object
   CODE_SUFFIX "11"
   DISPLAY_NAME "EAR Object"
   DESCRIPTION "The metadata input plugin for objects"
-  OUTPUT_NAME "EAR Object")
-
+  OUTPUT_NAME "EAR Object"
+  IS_EPS_PLUGIN ON)
+
 target_include_directories(object_VST3 PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
 target_link_libraries(object_VST3 PRIVATE ear-plugin-base ear-version)
 install_juce_vst3_plugin(object "${EPS_PLUGIN_INSTALL_PREFIX}ear-production-suite")

ear-production-suite-plugins/plugins/scene/CMakeLists.txt

@@ -96,8 +96,9 @@ add_juce_vst3_plugin(scene
   CODE_SUFFIX "FF"  
   DISPLAY_NAME "EAR Scene"
   DESCRIPTION "The scene plugin"
-  OUTPUT_NAME "EAR Scene")
-
+  OUTPUT_NAME "EAR Scene"
+  IS_EPS_PLUGIN ON)
+
 target_link_libraries(scene_VST3 PRIVATE ear-plugin-base ear-version)
 install_juce_vst3_plugin(scene "${EPS_PLUGIN_INSTALL_PREFIX}ear-production-suite")
 

packaging/CMakeLists.txt

@@ -30,37 +30,50 @@ add_custom_target(generate-package-docs
             "${CMAKE_CURRENT_LIST_DIR}/README.pdf"
             "${CMAKE_CURRENT_LIST_DIR}/LICENSE.pdf"
         )
-
-install(DIRECTORY 
-		Templates 
-		DESTINATION
-		.)
-
+
+# Common Files (all OS)
+# note: '.' is "Setup EAR Production Suite.app/Contents/Resources" on MacOS
 install(FILES
         README.pdf
         LICENSE.pdf
         DESTINATION
         .)
-
-if(NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "Linux")
-	if(WIN32)
-		install(FILES
-				install_list.xml
-				uninstall_list.xml
-				DESTINATION
-				./SetupFiles)
-	endif()
-	install(TARGETS
-			setup
-			DESTINATION
-			.)
-endif()
-
 install(TARGETS
         project_upgrade
         project_upgrade_gui
         DESTINATION
         ./Tools)
+install(DIRECTORY 
+        Templates 
+        DESTINATION
+        .)
+
+if(APPLE)
+    # '.' is currectly Resources dir. Need these installing at base dir too.
+    install(FILES
+            README.pdf
+            LICENSE.pdf
+            DESTINATION
+            ../../../)
+    # Back-up to base dir for setup install location
+    install(TARGETS
+            setup
+            DESTINATION
+            ../../../)
+endif()
+
+if(WIN32)
+    # Win tidies manifests in to a subdir. Note MacOS doesn't need as already has manifests in bundle (as a build-time copy step).
+    install(FILES
+            install_list.xml
+            uninstall_list.xml
+            DESTINATION
+            ./SetupFiles)
+    install(TARGETS
+            setup
+            DESTINATION
+            .)
+endif()
 
 set(CPACK_GENERATOR "ZIP")
 set(CPACK_PACKAGE_NAME "EAR Production Suite")

packaging/README.md.in

@@ -1,4 +1,4 @@
-# EAR Production Suite (v1.1.0 release)
+# EAR Production Suite (v1.1.0b release)
 
 The latest builds of the EAR Production Suite are available under [GitHub Releases](https://github.com/ebu/ear-production-suite/releases) or from the [EAR Production Suite website.](https://ear-production-suite.ebu.io/)
 Please download the files from there. The EAR Production Suite (EPS) download package comprises of multiple components:
@@ -11,6 +11,8 @@ Please download the files from there. The EAR Production Suite (EPS) download pa
 - Setup application
 
 ## Release notes
+v1.1.0b is a minor update to v1.1.0 which addresses installation issues on some Macs where Gatekeeper is enforcing app translocation (also known as Gatekeeper path randomisation.) This should not occur with signed disk images, but in some rare cases it still appears to happen. This fix does not affect the Windows or Linux builds, and only affects the setup application on MacOS.
+
 v1.1.0 supports 128 channels in REAPER v7.0 or greater and improved compatibility with ADM generated by third-party tools. It also includes various bug fixes, performance fixes, and other feature improvements. Please see detailed changelog below.
 
 ### Known issues
@@ -50,16 +52,16 @@ You may install the EPS manually if you prefer (note that this is the only optio
 
 1. Install [REAPER](https://www.reaper.fm/download.php) if you don't already have it.
 2. Ensure REAPER is not running.
-3. From the release package, copy the **VST plug-ins** from the `VST3` directory of the package into your common VST folder. 
+3. From the release package, copy the **VST plug-ins** from the `VST3` directory of the package (or within `Setup EAR Production Suite.app/Contents/Resources` on MacOS) into your common VST folder. 
     - Windows: `C:\Program Files\Common Files\VST3\`
     - MacOS: `~/Library/Audio/Plug-Ins/VST3/`
     - Linux: `~/.vst3/`
-4. From the release package, copy the REAPER ADM **Extension** from the `UserPlugins` directory of the package into the REAPER UserPlugins folder. Ensure you include the `ADMPresets` subdirectory.
+4. From the release package, copy the REAPER ADM **Extension** from the `UserPlugins` directory of the package (or within `Setup EAR Production Suite.app/Contents/Resources` on MacOS) into the REAPER UserPlugins folder. Ensure you include the `ADMPresets` subdirectory.
     - Windows: `C:\Users\(username)\AppData\Roaming\REAPER\UserPlugins\`
           Note: If you have a previous version of the REAPER Extension installed to `C:\Program Files\REAPER (x64)\Plugins\reaper_adm.dll`, then this should be deleted on installation of the latest version.
     - MacOS: `~/Library/Application Support/REAPER/UserPlugins/`
     - Linux: `~/.config/REAPER/UserPlugins/`
-5. (Optional) From the release package, copy the `Tools` and `Templates` directories of the package into an `EAR Production Suite` directory in the relevant location listed below. This is the folder used by the "Browse tools and templates..." function of the EPS.
+5. (Optional) From the release package, copy the `Tools` and `Templates` directories of the package (or from within `Setup EAR Production Suite.app/Contents/Resources` on MacOS) into an `EAR Production Suite` directory in the relevant location listed below. This is the folder used by the "Browse tools and templates..." function of the EPS.
     - Windows: `C:\Users\(username)\AppData\Roaming\EAR Production Suite\`
     - MacOS: `~/Library/Application Support/EAR Production Suite/`
     - Linux: `~/.config/EAR Production Suite/`

packaging/codesign/codesign.py

@@ -3,32 +3,42 @@
 import os
 from glob import glob
 
+def status(message):
+    print("\n>>>>>>>>>> " + message + "\n")
+
 def sign(certificate):
     # Sign all plugins
-    plugins = glob(os.path.join("tmp/VST3/ear-production-suite", "*.vst3"))
-    plugins.append("tmp/VST3/ADM Export Source.vst3")
+    status("Signing plugins...")
+    plugins = glob(os.path.join("tmp/Setup EAR Production Suite.app/Contents/Resources/VST3/ear-production-suite", "*.vst3"))
+    plugins.append("tmp/Setup EAR Production Suite.app/Contents/Resources/VST3/ADM Export Source.vst3")
     for p in plugins:
+        print("    " + p)
         subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime", "-s", certificate, p])
 
-    # Sign setup app bundle
-    subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
-                    "-s", certificate, "tmp/Setup EAR Production Suite.app"])
-
-    # Sign project upgrade gui app bundle
-    subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
-                    "-s", certificate, "tmp/Tools/Project Upgrade Utility GUI.app"])
-
     # REAPER extension is naked dylib so no Info.plist to derive identifier from, specify on command line
+    status("Signing reaper extension...")
     subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
                     "-i", "ch.ebu.eps.reaper_adm",
-                    "-s", certificate, "tmp/UserPlugins/reaper_adm.dylib"])
+                    "-s", certificate, "tmp/Setup EAR Production Suite.app/Contents/Resources/UserPlugins/reaper_adm.dylib"])
+
+    # Sign project upgrade gui app bundle
+    status("Signing project upgrade gui app...")
+    subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
+                    "-s", certificate, "tmp/Setup EAR Production Suite.app/Contents/Resources/Tools/Project Upgrade Utility GUI.app"])
 
     # Project upgrade command line exe has no Info.plist to derive identifier from, specify on command line
+    status("Signing project upgrade cli tool...")
     subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
                     "-i", "ch.ebu.eps.reaper_project_upgrade",
-                    "-s", certificate, "tmp/Tools/project_upgrade"])
+                    "-s", certificate, "tmp/Setup EAR Production Suite.app/Contents/Resources/Tools/project_upgrade"])
+
+    # Sign setup app bundle
+    status("Signing setup app...")
+    subprocess.run(["xcrun", "codesign", "--timestamp", "--options", "runtime",
+                    "-s", certificate, "tmp/Setup EAR Production Suite.app"])
 
 def extract(fileName):
+    status("Extracting...")
     subprocess.run(["tar", "-xvf", fileName])
     tarFile = fileName.replace("zip", "tar")
     subprocess.run(["rm", "-rf", "tmp/"])
@@ -37,11 +47,13 @@ def extract(fileName):
     subprocess.run(["rm", tarFile])
 
 def createDmg(outputname):
+    status("Creating disk image...")
     dmgFile = outputname + ".dmg"
     volName = outputname
     subprocess.run(["hdiutil", "create", "-volname", volName, "-srcfolder", "./tmp", "-ov", "-format", "UDZO", dmgFile])
 
 def signDmg(certificate, outputname):
+    status("Signing disk image...")
     dmgFile = outputname + ".dmg"
     subprocess.run(["xcrun", "codesign", "-s", certificate, dmgFile])
 

packaging/release_process.txt

@@ -11,9 +11,10 @@ Tag it with version (e.g, git tag -a v0.8.0-EPS-beta -m "v0.8.0 beta release")
 Push tag (e.g, git push origin v0.8.0-EPS-beta)
 Close all PRs and related issues
 Allow CI to build it
-Download MacOS "universal" artefact and Windows artefact
+Download MacOS "universal" artefact, Windows artefact, and Linux artefact
 For MacOS artefact: Sign it, Notorise it, and staple
 Create a release from the tag on GitHub - include change summary in notes
 Upload signed MacOS version as release asset
 Upload Windows version as release asset
-Update website + push
+Upload Linux version as release asset
+Update website (version_info.json) + push