CPackIFW: add support for signing the generated app bundles on macOS

Adds the CPACK_IFW_PACKAGE_SIGNING_IDENTITY CPackIFW variable.

This variable mirrors the --sign option of the binarycreator tool.

Fixes: #22927

5 files changed, 37 insertions, 0 deletions

diff --git a/Help/cpack_gen/ifw.rst b/Help/cpack_gen/ifw.rst
index 8bfcd981a9..a293a16a80 100644
--- a/Help/cpack_gen/ifw.rst
+++ b/Help/cpack_gen/ifw.rst
@@ -292,6 +292,13 @@ Package
 
  This feature is available for QtIFW 4.0.0 and newer.
 
+.. variable:: CPACK_IFW_PACKAGE_SIGNING_IDENTITY
+
+ .. versionadded: 3.23
+
+ Allows specifying a code signing identity to be used for signing the generated
+ app bundle. Only available on macOS.
+
 .. variable:: CPACK_IFW_ARCHIVE_FORMAT
 
  .. versionadded:: 3.23
diff --git a/Help/release/dev/cpackifw-signing-identity.rst b/Help/release/dev/cpackifw-signing-identity.rst
new file mode 100644
index 0000000000..58f5030338
--- /dev/null
+++ b/Help/release/dev/cpackifw-signing-identity.rst
@@ -0,0 +1,7 @@
+cpackifw-signing-identity
+-------------------------
+
+* The :cpack_gen:`CPack IFW Generator` gained the new
+  :variable:`CPACK_IFW_PACKAGE_SIGNING_IDENTITY` variable for specifying a code
+  signing identity to be used for signing the generated app bundle.
+  This feature is available on macOS only, and for QtIFW 3.0 and newer.
diff --git a/Source/CPack/IFW/cmCPackIFWGenerator.cxx b/Source/CPack/IFW/cmCPackIFWGenerator.cxx
index f35d7e9b6f..9ca7a69e57 100644
--- a/Source/CPack/IFW/cmCPackIFWGenerator.cxx
+++ b/Source/CPack/IFW/cmCPackIFWGenerator.cxx
@@ -179,6 +179,17 @@ std::vector<std::string> cmCPackIFWGenerator::BuildBinaryCreatorCommmand()
     }
   }
 
+  if (!this->IsVersionLess("3.0")) {
+#ifdef __APPLE__
+    // macOS only
+    std::string signingIdentity = this->Installer.SigningIdentity;
+    if (!signingIdentity.empty()) {
+      ifwCmd.emplace_back("--sign");
+      ifwCmd.emplace_back(signingIdentity);
+    }
+#endif
+  }
+
   ifwCmd.emplace_back("-c");
   ifwCmd.emplace_back(this->toplevel + "/config/config.xml");
 
diff --git a/Source/CPack/IFW/cmCPackIFWInstaller.cxx b/Source/CPack/IFW/cmCPackIFWInstaller.cxx
index a94ca48b22..6fc48480ef 100644
--- a/Source/CPack/IFW/cmCPackIFWInstaller.cxx
+++ b/Source/CPack/IFW/cmCPackIFWInstaller.cxx
@@ -306,6 +306,13 @@ void cmCPackIFWInstaller::ConfigureFromOptions()
         this->GetOption("CPACK_IFW_PACKAGE_RUN_PROGRAM_DESCRIPTION")) {
     this->RunProgramDescription = *description;
   }
+
+#ifdef __APPLE__
+  // Code signing identity for signing the generated app bundle
+  if (cmValue id = this->GetOption("CPACK_IFW_PACKAGE_SIGNING_IDENTITY")) {
+    this->SigningIdentity = *id;
+  }
+#endif
 }
 
 /** \class cmCPackIFWResourcesParser
diff --git a/Source/CPack/IFW/cmCPackIFWInstaller.h b/Source/CPack/IFW/cmCPackIFWInstaller.h
index 0ace099558..205835b0f2 100644
--- a/Source/CPack/IFW/cmCPackIFWInstaller.h
+++ b/Source/CPack/IFW/cmCPackIFWInstaller.h
@@ -135,6 +135,11 @@ public:
   /// installation
   std::string RunProgramDescription;
 
+#ifdef __APPLE__
+  /// Code signing identity for signing the generated app bundle
+  std::string SigningIdentity;
+#endif
+
 public:
   // Internal implementation