How to code sign my Thunderbird build on OS X?

[Nomis101]

Now that we have support for mac dmg signing for Thunderbird, I want
to sign my own (unofficial) Thunderbird builds with my Apple Developer
ID certificate. What is the best way to do this? My current plan is,
to build it, to sign it and than to pack it into the installer. Like:
$ make -f client.mk build
$ codesign -s "Developer ID Application: xxx" -fv /Volumes/Developer/
comm-beta/obj-x86_64-apple-darwin11.4.0/mozilla/dist/Thunderbird.app
$ make -C obj-x86_64-apple-darwin11.4.0/mail/installer

Or is there any better way to do this?

[Nomis101]

Oooh, this doesn't work! :-( If I do so, than the Thunderbird inside
the dmg has an invalid signature. I than get:
$ codesign -vvv /Applications/Thunderbird.app
/Applications/Thunderbird.app: invalid signature (code or signature
have been modified)
In architecture: x86_64

If I codesign the installed app in the application folder, than I get
a valid signature. But signing and than package it, doesn't work. So,
how do I get the signed Thunderbird with a valid signature into the
dmg?? Or do I need to make a signed pkg of Thunderbird with
productbuild?

[edransch...@gmail.com]

You may need to use a CodeResources file to specify which files not to sign.
Doing "make -C obj-x86_64-apple-darwin11.4.0/mail/installer " may modify some files that are signed by default if no such file is specified.

You could try using the same file that we use for our release automation (available here: http://mxr.mozilla.org/mozilla-central/source/browser/app/macbuild/Contents/_CodeSignature/CodeResources ).

The appropriate option for codesign is "--resource-rules"
(for example: "--resource-rules ./Application.app/Contents/_CodeSignature/CodeResources" )

Good Luck!