Update codesign script for Hardened Runtime

[kolpanic]

Based on my experience building Sparkle for use in a sandboxed & notarized app (#1266 (comment) and subsequent discussion), the script used to codesign the XPCs should be updated to use the -o runtime flag. In addition, the script should also codesign the executables embedded in Sparkle.framework.

1. The command in codesign_xpc should have "-o", "runtime" added to its arguments.
2. Rename codesign_xpc to codesign_embedded_executable
3. Rename xpc_service(s) to executable(s).
4. Update the installation instructions with the new script name and the necessity to sign the executables embedded in Sparkle.framework

[rob-dodson]

Mojave 10.14.5 will require non Mac App Store apps to be hardened.

[kolpanic]

In that case, the -o runtime switch shouldn't be optional. I'll update the issue description.

[kornelski]

Can you make a PR with this?

[kolpanic]

I'd love to, but I already have a customized fork under my personal account for Coruscation, and I don't want to update it.

(I'd fork to our work org. but I don't have the permission. We also want to try to get the ui-separation-and-xpc branch synced with master so we can use EdDSA signing and build with Xcode 10.2.)

[chess92]

Is there a time estimate when this will be added to the release version of Sparkle? Or a solution that works on the master branch?

I have attempted to build / archive Sparkle with Hardened runtime with no success (using the latest master branch). The only two targets with the Capabilities tab are "Sparkle Test App" and "Autoupdate" and I have them both set to Hardened Runtime.

Edit: Also, the bin directory no longer uses the scripts you mention in your instructions.

[kolpanic]

@chess92 #1266 (comment) is the procedure I used to get Sparkle built for our apps with sandboxing, hardened runtime, and notarization.

[chess92]

ok thank you, I will check it out

[kolpanic]

Looks like point 1 was taken care of by #1391.

We were able to fork the repo to our work org., so I'll do the other points.

[rob-dodson]

Will this update be available via cocoapods?