Skip to content

Publish signed macOS PKG installers#434

Merged
jaimergp merged 42 commits intomainfrom
macos-pkg
Mar 9, 2026
Merged

Publish signed macOS PKG installers#434
jaimergp merged 42 commits intomainfrom
macos-pkg

Conversation

@jaimergp
Copy link
Copy Markdown
Member

@jaimergp jaimergp commented Mar 2, 2023

Closes #429

Tasklist

  • Enable PKG artifactsx
  • Custom background
  • Custom welcome text
  • Custom readme text (if any)
  • Custom conclusion text (if any)
  • Set up certificates
  • Signing
  • Notarization
  • Validation
  • Tests

Welcome screenshot:

image

image

@jaimergp
Copy link
Copy Markdown
Member Author

jaimergp commented Mar 2, 2023

The artifacts are available and include the PKG installers. This PR is not done (see description), but those should be functional already. Please let me know if you have any feedback!

@psobolewskiPhD
Copy link
Copy Markdown
Member

psobolewskiPhD commented Feb 15, 2024

Looks great!
But, the artifacts are expired 😢
edit: nvm, they're here https://github.com/conda-forge/miniforge/actions/runs/7915666236
BTW bit of a bummer that they require admin to run 😢 that could just be an issue with the apple pkg installer though.

@jaimergp
Copy link
Copy Markdown
Member Author

Check these ones: https://github.com/conda-forge/miniforge/actions/runs/7915666236

I don't think they require superuser per se, but maybe there's a bug. Let me know.

@psobolewskiPhD
Copy link
Copy Markdown
Member

Yea I found the right artifacts, tried the mini forge-arm64 and it did require admin.
I will try to test on my personal machine later where I have admin, but I can't on my work one.

@yuvipanda
Copy link
Copy Markdown
Contributor

So first, it doesn't wanna open because it's not signed and apple hates us.

Screen Shot 2024-02-15 at 10 09 00 AM

I went into security settings and allowed it explicitly (required admin), so the dialog box got less scary:
image

It allowed me to install it just on my home directory
image

Failed the first time because I already have it installed
image

But it works now, after!

So I suppose it needs to be signed?

Thanks for working on this, @jaimergp!

@jaimergp
Copy link
Copy Markdown
Member Author

Yes, the signing machinery is there in constructor (thanks napari!), we just need the Apple certificate from NumFocus.

@jaimergp
Copy link
Copy Markdown
Member Author

Also, if you have feedback about the messaging, we can customize some steps.

@yuvipanda
Copy link
Copy Markdown
Contributor

Only suggestion is to maybe have something in there about pre-existing installations? But that's very minor, as the target audience for this probably does not have pre-existing installations.

@hmaarrfk
Copy link
Copy Markdown
Contributor

as the target audience for this probably does not have pre-existing installations.

I think this is a fair first approximation.

However, I think we get many questions on this issue tracker where people have trouble installing miniforge when Miniconda or Anaconda is already installed (and to a lesser extent when miniforge or mambaforge is already installed).

Comment thread scripts/build.sh Outdated
Comment thread Miniforge3/construct.yaml Outdated
- __osx >=10.13 # [osx]

# macOS PKG options
installer_type: all # [osx]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make this an option using an environment variable.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See 0b6566f

@jaimergp
Copy link
Copy Markdown
Member Author

jaimergp commented Feb 6, 2026

Ok, for anyone interested in trying these out, the PKGs at https://github.com/conda-forge/miniforge/actions/runs/21754318045?pr=434 are now signed and notarized, which means that macOS won't bug you when you try to open them.

@jaimergp jaimergp marked this pull request as ready for review February 6, 2026 14:52
@jaimergp jaimergp requested a review from a team as a code owner February 6, 2026 14:52
@psobolewskiPhD
Copy link
Copy Markdown
Member

Love this!
The artifact was a zip with the pkg, which ran without issue and without admin required 🎉
After completion (very fast), the pkg went to trash leaving behind a .sh script.
However I wasn't prompted for anything related to the shell init or about the script.

@jaimergp
Copy link
Copy Markdown
Member Author

jaimergp commented Feb 6, 2026

The shell script is just the other installer option (better for CLI and unattended runs like CI), nothing to do with PKG. It's just there because the GHA artifact glob picked both.

However I wasn't prompted for anything related to the shell init or about the script.

There's an optional screen you can go to to "customize the install" and in there there are some optional "components", which is the way we offer some options via PKG.

@jaimergp
Copy link
Copy Markdown
Member Author

@conda-forge/miniforge, this is ready for review now 🙏

@hmaarrfk
Copy link
Copy Markdown
Contributor

I don’t have a Mac so I’m unable to review the user interactions.

@jaimergp
Copy link
Copy Markdown
Member Author

Hey @hmaarrfk, I'd be willing to schedule a videocall or something where I can share my screen and let you review it, if that's something you want to do. Otherwise we can also let someone else in the team take a look.

@hmaarrfk
Copy link
Copy Markdown
Contributor

Im leaning toward maybe a screen recording and you updating the top level comment.

If this is "an other option" I'm happy to try it as well and see what users think without much direct review from me.

@jaimergp
Copy link
Copy Markdown
Member Author

@hmaarrfk
Copy link
Copy Markdown
Contributor

Got it this looks cool and great.

The checklist adds a few customizations that I don't know if they made it or not in your final version.

Just looking for confirmation if the latest checklist is correct.

Now I'm thinking. How can we make this for Linux...... I hate the shell only option.

@jaimergp
Copy link
Copy Markdown
Member Author

I didn't customize much, just the "background" which is the anvil logo you see on the bottom left corner. Everything else is the "default". I think it's a good way to get started, though.

@jaimergp
Copy link
Copy Markdown
Member Author

Now I'm thinking. How can we make this for Linux...... I hate the shell only option.

I'm not aware of any standard graphical installer for Linux (or at least, not a generic cross-distro one), and constructor doesn't support anything else anyway, so for now we don't have any options there.

Copy link
Copy Markdown
Contributor

@hmaarrfk hmaarrfk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let’s leave this open until march 1

@hmaarrfk
Copy link
Copy Markdown
Contributor

final question.

Can you confirm that the artifacts will be uploaded on tags?

@jaimergp
Copy link
Copy Markdown
Member Author

jaimergp commented Mar 3, 2026

I think the glob in this line covers the new .pkg files too:

file: build/M*forge*

@jaimergp jaimergp merged commit 85754d8 into main Mar 9, 2026
9 checks passed
@hmaarrfk
Copy link
Copy Markdown
Contributor

hmaarrfk commented Mar 9, 2026

Awesome

@hmaarrfk
Copy link
Copy Markdown
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Generate .pkg installers for Mac OS

5 participants