Re-sign Mac Applications before creating install package

On Apple Silicon, the changes to linking paths done to "relativise"
paths in App bundles invalidates the code signature, so we need to
recalculate the signatures *after* the path changes have been performed
but before the install package is created. This depends on a new CMake
feature introduced in 3.19.

CMakeLists.txt

@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.1.0)
+cmake_minimum_required(VERSION 3.19.0)
 
 # for link time optimization, remove if cmake version is >= 3.9
 if(POLICY CMP0069) # LTO
@@ -888,6 +888,9 @@ if (OPENMW_OSX_DEPLOYMENT AND APPLE)
         fixup_bundle(\"${INSTALLED_OPENMW_APP}\" \"${PLUGINS}\" \"\")
         fixup_bundle(\"${INSTALLED_OPENCS_APP}\" \"${OPENCS_PLUGINS}\" \"\")
         " COMPONENT Runtime)
+
+    set(CPACK_PRE_BUILD_SCRIPTS ${CMAKE_SOURCE_DIR}/cmake/SignMacApplications.cmake)
+
     include(CPack)
 elseif(NOT APPLE)
     get_generator_is_multi_config(multi_config)

cmake/SignMacApplications.cmake

@@ -0,0 +1,20 @@
+# This script re-signs OpenMW.app and OpenMW-CS.app after CPack packages them. This is necessary because CPack modifies
+# the library references used by OpenMW to App relative paths, invalidating the code signature.
+
+# Obviously, we only need to run this on Apple targets.
+if (APPLE)
+    set(OPENMW_APP "OpenMW")
+    set(OPENMW_CS_APP "OpenMW-CS")
+
+    set(APPLICATIONS "${OPENMW_APP}" "${OPENMW_CS_APP}")
+    foreach(app_name IN LISTS APPLICATIONS)
+        set(FULL_APP_PATH "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_IN_ONE/${app_name}.app")
+        message(STATUS "Re-signing ${app_name}.app")
+        # Apple's codesign utility does not like directories with periods (.) in their names, so we'll remove it and
+        # create a symlink using the original name, which codesign is fine with.
+        file(GLOB OSG_PLUGINS_DIR "${FULL_APP_PATH}/Contents/PlugIns/osgPlugins*")
+        file(RENAME "${OSG_PLUGINS_DIR}" "${FULL_APP_PATH}/Contents/PlugIns/osgPlugins")
+        execute_process(COMMAND "ln" "-s" "${FULL_APP_PATH}/Contents/PlugIns/osgPlugins" "${OSG_PLUGINS_DIR}")
+        execute_process(COMMAND "codesign" "--force" "--deep" "-s" "-" "${FULL_APP_PATH}")
+    endforeach(app_name)
+endif (APPLE)