Add a per-user macOS .pkg installer - #248
Merged
Merged
Conversation
Packages the already-built, signed, notarized .plugin bundle into a double-click .pkg using pkgbuild + productbuild, targeting the installing user's ~/Library/Application Support/obs-studio/plugins with no admin password (Distribution <domains enable_currentUserHome="true" enable_localSystem="false"/> plus a relative pkgbuild --install-location). Validates the input bundle is present, signed, and carries its engine before packaging; refuses --notarize without --sign at argument time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The macOS artifact was a zip that a person had to unzip and hand-place into
~/Library/Application Support/obs-studio/plugins/— a directory Finder hides by default. The owner's ask: "a much more professional and easier way for less technical people."What
scripts/make-macos-installer.sh— takes an already signed and notarized.pluginbundle and produces a signed, notarized, stapled.pkg.Per-user install, no admin password. A
.pkgruns as root, so$HOMEin a postinstall script is root's home — the classic way to silently install to the wrong place. This uses the supported mechanism instead:with a relative
--install-locationthat resolves against the chosen domain root.Signed with Developer ID Installer — a different certificate from the Application one that signs the bundle.
Verified by actually installing it
Not by inspection:
/Users/jwallace/…— user home, not root's, not system-widecodesign --verify --strictafter installstapler validateafter installspctl --assesssource=Notarized Developer IDThe ticket surviving matters: a packaging step that re-copies contents carelessly can drop it, leaving testers with a bundle that needs a network check on first launch and fails offline.
Not yet verified
The GUI double-click flow — this was installed via the
installerCLI, which uses the same mechanism but skips the Installer.app UI.🤖 Generated with Claude Code