Let's just sign the app ourselves since we need to unpack/repack the JARS anyways

Author: johnmay

.github/workflows/packaging.yml

@@ -78,8 +78,8 @@ jobs:
         env:
           MAVEN_ARGS: "--batch-mode --no-transfer-progress -Dstyle.color=always"
         run: |
-          mvn install -DskipTests -pl '!app-jar' -Papp-bundle -Dcodesign.identity="${{ secrets.MACOS_DEVELOPER_IDENTITY }}"
-          bash app-osx/codesign-deps.sh ${{ secrets.MACOS_DEVELOPER_IDENTITY }} 
+          mvn install -DskipTests -pl '!app-jar,!app-windows' -Papp-bundle"
+          bash app-osx/codesign-app.sh ${{ secrets.MACOS_DEVELOPER_IDENTITY }} 
           bash app-osx/make-dmg.sh
           mv app-osx/target/*.dmg JChemPaint.dmg
 

app-osx/codesign-deps.sh app-osx/codesign-app.shapp-osx/codesign-deps.sh renamed to app-osx/codesign-app.sh

@@ -39,5 +39,7 @@ for JARFILE in "${JARFILES[@]}"; do
     rm -rf $TMPDIR
 done
 
+codesign --verbose --force --timestamp --options=runtime --entitlements $DIR/entitlements.plist --sign $MACOS_DEVELOPER_IDENTITY --deep $APPNAME
+
 
 

app-osx/pom.xml

@@ -39,9 +39,6 @@
                         <!-- We need to sign some extra parts so we will build DMG our self -->
                         <generate>false</generate>
                       </dmg>
-                      <codesign>
-                        <identity>${codesign.identity}</identity>
-                      </codesign>
                     </configuration>
                     <executions>
                       <execution>