feat(flet build): macOS code signing, notarization and AppStore support

sdk/python/packages/flet-cli/src/flet_cli/commands/build.py

@@ -7,7 +7,15 @@
 from rich.live import Live
 
 from flet_cli.commands.build_base import BaseBuildCommand, console
+from flet_cli.commands.flutter_base import verbose1_style
 from flet_cli.utils.android import flutter_target_platforms
+from flet_cli.utils.macos_sign import (
+    MacOSSigningError,
+    NotaryCredentials,
+    notarize_and_staple,
+    resolve_identity,
+    sign_app,
+)
 
 
 class Command(BaseBuildCommand):
@@ -84,6 +92,8 @@ def handle(self, options: argparse.Namespace) -> None:
             self.customize_splash_images()
             self.run_flutter()
             self.copy_build_output()
+            if self.target_platform == "macos":
+                self.sign_macos_app()
 
             self.cleanup(
                 0,
@@ -207,3 +217,145 @@ def run_flutter(self):
             f"Built [cyan]{self.platforms[self.target_platform]['status_text']}"
             f"[/cyan] {self.emojis['checkmark']}",
         )
+
+    def sign_macos_app(self):
+        """
+        Code-sign — and optionally notarize — the built macOS app bundle.
+
+        Runs after `copy_build_output()` and operates on the final `.app`
+        in the output directory, i.e. the artifact users distribute.
+
+        No-op unless a signing identity is configured; without one, the app keeps the
+        default ad-hoc signature produced by the Flutter build. Notarization is
+        additionally gated and requires a real (non-ad-hoc) identity plus notary
+        credentials.
+
+        The app-bundle signature re-applies the entitlements from the
+        template-generated `Release.entitlements` — re-signing replaces the
+        signature Xcode embedded them in, so they must be supplied again.
+
+        Exits via `cleanup(1, ...)` with an actionable message on any
+        configuration or signing failure.
+        """
+
+        assert self.options
+        assert self.get_pyproject
+        assert self.out_dir
+        assert self.flutter_dir
+
+        identity = (
+            self.options.macos_signing_identity
+            or self.get_pyproject("tool.flet.macos.signing.identity")
+            or os.getenv("FLET_MACOS_SIGNING_IDENTITY")
+        )
+        notarize = (
+            self.options.macos_notarize
+            if self.options.macos_notarize is not None
+            else bool(self.get_pyproject("tool.flet.macos.signing.notarize"))
+        )
+
+        if not identity:
+            if notarize:
+                self.cleanup(
+                    1,
+                    "Notarization requires a code-signing identity. Pass "
+                    "--macos-signing-identity or set "
+                    "`[tool.flet.macos.signing].identity` in pyproject.toml.",
+                )
+            return
+
+        apps = sorted(self.out_dir.glob("*.app"))
+        if len(apps) != 1:
+            self.cleanup(
+                1,
+                f"Expected exactly one .app bundle in {self.rel_out_dir}, "
+                f"found {len(apps)}.",
+            )
+        app_path = apps[0]
+
+        # Release.entitlements is the single merged source of entitlements.
+        entitlements = self.flutter_dir / "macos" / "Runner" / "Release.entitlements"
+
+        def log(message: str):
+            if self.verbose > 0:
+                console.log(message, style=verbose1_style)
+
+        self.update_status(f"[bold blue]Signing [cyan]{app_path.name}[/cyan]...")
+        try:
+            resolved = resolve_identity(identity)
+            if notarize and resolved.is_adhoc:
+                self.cleanup(
+                    1,
+                    "Notarization requires a Developer ID identity; "
+                    'ad-hoc ("-") signed apps cannot be notarized.',
+                )
+            signed_count = sign_app(
+                app_path,
+                resolved,
+                entitlements=entitlements if entitlements.is_file() else None,
+                log=log,
+            )
+            console.log(
+                f"Signed [cyan]{app_path.name}[/cyan] ({signed_count} binaries, "
+                f"identity: {resolved.description}) {self.emojis['checkmark']}"
+            )
+
+            if notarize:
+                credentials = self._macos_notary_credentials()
+                self.update_status(
+                    f"[bold blue]Notarizing [cyan]{app_path.name}[/cyan] "
+                    "(this can take a few minutes)...",
+                )
+                notarize_and_staple(app_path, credentials, log=log)
+                console.log(
+                    f"Notarized and stapled [cyan]{app_path.name}[/cyan] "
+                    f"{self.emojis['checkmark']}"
+                )
+        except MacOSSigningError as e:
+            self.cleanup(1, str(e))
+
+    def _macos_notary_credentials(self) -> NotaryCredentials:
+        """
+        Resolve Apple notary service credentials.
+
+        A keychain profile is looked up first — `--macos-notary-profile`,
+        then `[tool.flet.macos.signing].notary_profile`, then the
+        `FLET_MACOS_NOTARY_PROFILE` environment variable — and only then
+        the `APPLE_API_KEY`/`APPLE_API_KEY_ID`/`APPLE_API_ISSUER` App Store
+        Connect API key variables (all three required). A configured
+        profile deliberately outranks the `APPLE_API_*` variables, which
+        other tooling (Fastlane, CI images) may have exported ambiently,
+        possibly for a different Apple team.
+
+        Returns:
+            Credentials for `notarytool`; exits via `cleanup(1, ...)` with
+                setup instructions when nothing is configured.
+        """
+
+        assert self.options
+        assert self.get_pyproject
+
+        profile = (
+            self.options.macos_notary_profile
+            or self.get_pyproject("tool.flet.macos.signing.notary_profile")
+            or os.getenv("FLET_MACOS_NOTARY_PROFILE")
+        )
+        if profile:
+            return NotaryCredentials(keychain_profile=profile)
+
+        api_key = os.getenv("APPLE_API_KEY")
+        api_key_id = os.getenv("APPLE_API_KEY_ID")
+        api_issuer = os.getenv("APPLE_API_ISSUER")
+        if api_key and api_key_id and api_issuer:
+            return NotaryCredentials(
+                api_key=api_key, api_key_id=api_key_id, api_issuer=api_issuer
+            )
+
+        self.cleanup(
+            1,
+            "Notary service credentials are missing. Either store an "
+            "App Store Connect API key or Apple ID app-specific password "
+            "with `xcrun notarytool store-credentials <profile>` and pass "
+            "--macos-notary-profile <profile>, or set the APPLE_API_KEY, "
+            "APPLE_API_KEY_ID and APPLE_API_ISSUER environment variables.",
+        )

sdk/python/packages/flet-cli/src/flet_cli/commands/build_base.py

@@ -16,7 +16,7 @@
 
 import flet.version
 import flet_cli.utils.processes as processes
-from flet.utils import copy_tree, slugify
+from flet.utils import copy_tree, get_bool_env_var, slugify
 from flet.utils.deprecated import deprecated_warning
 from flet_cli.commands.flutter_base import (
     BaseFlutterCommand,
@@ -655,6 +655,31 @@ def add_arguments(self, parser: argparse.ArgumentParser) -> None:
             default=None,
             help="Android signing key alias [env: FLET_ANDROID_SIGNING_KEY_ALIAS=]",
         )
+        parser.add_argument(
+            "--macos-signing-identity",
+            dest="macos_signing_identity",
+            help='"Developer ID Application" certificate name, its SHA-1 '
+            'fingerprint, or "-" for ad-hoc, used to code-sign the app bundle '
+            "(macos only) [env: FLET_MACOS_SIGNING_IDENTITY=]",
+        )
+        parser.add_argument(
+            "--macos-notarize",
+            dest="macos_notarize",
+            action=argparse.BooleanOptionalAction,
+            default=None,
+            help="Submit the signed app to the Apple notary service and staple "
+            "the ticket; requires --macos-signing-identity and notary "
+            "credentials (macos only)",
+        )
+        parser.add_argument(
+            "--macos-notary-profile",
+            dest="macos_notary_profile",
+            help="Keychain profile name created with `xcrun notarytool "
+            "store-credentials` to authenticate with the Apple notary service; "
+            "alternatively set the APPLE_API_KEY, APPLE_API_KEY_ID and "
+            "APPLE_API_ISSUER environment variables (macos only) "
+            "[env: FLET_MACOS_NOTARY_PROFILE=]",
+        )
         parser.add_argument(
             "--build-number",
             dest="build_number",
@@ -924,6 +949,7 @@ def setup_template_data(self):
         macos_entitlements = {
             "com.apple.security.app-sandbox": False,
             "com.apple.security.cs.allow-jit": True,
+            "com.apple.security.cs.allow-unsigned-executable-memory": True,
             "com.apple.security.network.client": True,
             "com.apple.security.network.server": True,
             "com.apple.security.files.user-selected.read-write": True,
@@ -1288,6 +1314,7 @@ def _xml_attr_value(v):
             "route_url_strategy": (
                 self.options.route_url_strategy
                 or self.get_pyproject("tool.flet.web.route_url_strategy")
+                or os.getenv("FLET_WEB_ROUTE_URL_STRATEGY")
                 or "path"
             ),
             # "canvaskit" (dart2js), not "auto": with "auto" Chromium browsers
@@ -1298,6 +1325,7 @@ def _xml_attr_value(v):
             "web_renderer": (
                 self.options.web_renderer
                 or self.get_pyproject("tool.flet.web.renderer")
+                or os.getenv("FLET_WEB_RENDERER")
                 or "canvaskit"
             ),
             "pwa_background_color": (
@@ -1313,7 +1341,9 @@ def _xml_attr_value(v):
                 or self.get_pyproject("tool.flet.web.wasm") == False  # noqa: E712
             ),
             "no_cdn": (
-                self.options.no_cdn or self.get_pyproject("tool.flet.web.cdn") == False  # noqa: E712
+                self.options.no_cdn
+                or self.get_pyproject("tool.flet.web.cdn") == False  # noqa: E712
+                or bool(get_bool_env_var("FLET_WEB_NO_CDN"))
             ),
             # Surface the resolved Pyodide release to the cookiecutter
             # context so the web template's index.html can wire the
@@ -2853,11 +2883,13 @@ def find_platform_image(
         # incompatible formats so flutter_launcher_icons gets a decodable file.
         images = list(
             filter(
-                lambda p: not (
-                    (ext := Path(p).suffix.lower()) == ".icns"
-                    and self.target_platform != "macos"
-                    or ext == ".ico"
-                    and self.target_platform != "windows"
+                lambda p: (
+                    not (
+                        (ext := Path(p).suffix.lower()) == ".icns"
+                        and self.target_platform != "macos"
+                        or ext == ".ico"
+                        and self.target_platform != "windows"
+                    )
                 ),
                 glob.glob(str(src_path.joinpath(f"{image_name}.*"))),
             )

sdk/python/packages/flet-cli/src/flet_cli/commands/publish.py

@@ -7,7 +7,12 @@
 from pathlib import Path
 
 from flet.controls.types import RouteUrlStrategy, WebRenderer
-from flet.utils import copy_tree, is_within_directory, random_string
+from flet.utils import (
+    copy_tree,
+    get_bool_env_var,
+    is_within_directory,
+    random_string,
+)
 from flet_cli.commands.base import BaseCommand
 from flet_cli.utils.project_dependencies import (
     get_poetry_dependencies,
@@ -146,7 +151,8 @@ def add_arguments(self, parser: argparse.ArgumentParser) -> None:
             action="store_true",
             default=False,
             help="Disable loading of CanvasKit, Pyodide, and fonts from CDNs. "
-            "Use this for full offline deployments or air-gapped environments",
+            "Use this for full offline deployments or air-gapped environments "
+            "[env: FLET_WEB_NO_CDN=]",
         )
 
     def handle(self, options: argparse.Namespace) -> None:
@@ -343,7 +349,11 @@ def filter_tar(tarinfo: tarfile.TarInfo):
             "tool.flet.web.pwa_theme_color"
         )
 
-        no_cdn = options.no_cdn or get_pyproject("tool.flet.web.cdn") == False  # noqa: E712
+        no_cdn = (
+            options.no_cdn
+            or get_pyproject("tool.flet.web.cdn") == False  # noqa: E712
+            or bool(get_bool_env_var("FLET_WEB_NO_CDN"))
+        )
 
         print("Patching index.html")
         patch_index_html(
@@ -362,11 +372,13 @@ def filter_tar(tarinfo: tarfile.TarInfo):
             web_renderer=WebRenderer(
                 options.web_renderer
                 or get_pyproject("tool.flet.web.renderer")
+                or os.getenv("FLET_WEB_RENDERER")
                 or "canvaskit"
             ),
             route_url_strategy=RouteUrlStrategy(
                 options.route_url_strategy
                 or get_pyproject("tool.flet.web.route_url_strategy")
+                or os.getenv("FLET_WEB_ROUTE_URL_STRATEGY")
                 or "path"
             ),
             no_cdn=no_cdn,