Dependency to Jython-standalone prevents us from signing our MacOS package

[wetneb]

The fact that we depend on the jython-standalone distribution prevents us from signing our MacOS package and notarizing it with Apple.

To Reproduce

Check the CI logs here:
https://github.com/OpenRefine/OpenRefine/runs/5335255475?check_suite_focus=true

Current Results

When notarizing our DMG build, we get the following errors:

 [INFO]      [exec]   "issues": [
[INFO]      [exec]     {
[INFO]      [exec]       "severity": "error",
[INFO]      [exec]       "code": null,
[INFO]      [exec]       "path": "openrefine-mac-3.6-SNAPSHOT.dmg/OpenRefine.app/Contents/Resources/webapp/extensions/jython/module/MOD-INF/lib/jython-standalone-2.7.2.jar/jni/Darwin/libjffi-1.2.jnilib",
[INFO]      [exec]       "message": "The binary uses an SDK older than the 10.9 SDK.",
[INFO]      [exec]       "docUrl": null,
[INFO]      [exec]       "architecture": "i386"
[INFO]      [exec]     },
[INFO]      [exec]     {
[INFO]      [exec]       "severity": "error",
[INFO]      [exec]       "code": null,
[INFO]      [exec]       "path": "openrefine-mac-3.6-SNAPSHOT.dmg/OpenRefine.app/Contents/Resources/webapp/extensions/jython/module/MOD-INF/lib/jython-standalone-2.7.2.jar/jni/Darwin/libjffi-1.2.jnilib",
[INFO]      [exec]       "message": "The binary uses an SDK older than the 10.9 SDK.",
[INFO]      [exec]       "docUrl": null,
[INFO]      [exec]       "architecture": "x86_64"
[INFO]      [exec]     }
[INFO]      [exec]   ]

Expected Behavior

Successful notarization.

Additional context

We might be able to switch to jython-slim which should also let us save some megabytes (but some additional dependencies are probably pulled in then)

Funding available

The OpenRefine project has funding available to work on this. Do you know someone who would be able to get this fixed? Send them our way!
https://openrefine.org/blog/2022/09/30/windows-macos-packaging.html

[wetneb]

Pulling jython-slim does not make much difference, the same dependencies are pulled in as separate jars. That does not solve the problem yet and does not change the weight of the distribution.

[wetneb]

I just witnessed what it looked like for @stefanw to download and install OpenRefine on MacOS, and the experience was pretty painful because of this issue. Basically he had to try open the app at least three times before MacOS gave him the opportunity to open anyway. So I suggest this is actually a blocker for quite a lot of people who might not know how too circumvent this check.

[thadguidry]

Until we have a path forward, can we update our docs for running on MacOS to help folks more for now with the steps needed to circumvent with the caveat of "only install packages from trusted sources" ?

[wetneb]

Yes please! It is likely that this needs to be broken down by OS version, because the process I witnessed today was very different from what I had to do myself in a VM.