Build macOS installer for tsh.app

[codingllama]

Changes how make pkg-tsh works so instead of building an installer for the tsh binary, placed under /usr/local/bin, we install an app to /Applications/tsh-vXXX.app and link its tsh binary to /usr/local/bin.

The app shell is necessary to distribute a provisioning profile along with the signed/entitled/notarized binary. All of that is required for Touch ID to work. Naked tsh binaries are unable to use Touch ID, even if built with the correct build tags.

I've elected to split the logic from build-package.sh into a separate script - it already does too much as-is. build-pkg-tsh.sh is more idiomatic, clears additional shellcheck rules and is easier to dry-run.

#9160

[codingllama]

There are more changes required to make sure the packages really work, like building with the proper build tags, but this is enough for a single PR (and my brain is fried for today).

[codingllama]

Also, give me a shout if you want and I can send a fully-functional "tshdev" installer to you. :)

[ibeckermayer]

Naively going through your instructions at build.assets/macos/tshdev/README.md, I get to

$skel/sign.sh $skel/tsh.app                  # sign .app

and my terminal complains

error: The specified item could not be found in the keychain.

I'm thinking I'm missing the One-time setup, however when I try to log in to my personal developer profile by navigating to https://developer.apple.com/account/resources/profiles/list and signing in, I get

.

Presuming I do indeed need to do One-time setup before going through the instructions, a note at the top of the Instructions setting would be helpful. Also, a note or link to a Slab post about how I request to get enrolled in Teleport's developer program (or should I just enroll in my own developer program?) would be useful.

(If you find any of this to be overly pedantic to add then feel free to just ignore me, I'm coming at it from a place of total ignorance about Apple's code signing system).

[codingllama]

@ibeckermayer thanks for going through the README with such attention, I appreciate the feedback.

One-time setup is pretty much done, the idea of the README is to document how I got those files in the first place in case someone wants to recreate them. I'll mention that in the file.

You won't be able to use that signing key without access to our Apple Dev account. Personal account won't cut it for Keychain access, you need to be enrolled in the Apple Developer program. Ping me in private and I can give some instructions. A Slab page would indeed be nice, I'll add that to my backlog (I won't do it right now, but I'll get to it!).

[codingllama]

Thanks for the quick review, Isaiah.

[codingllama]

Friendly ping @timothyb89 ?

[codingllama]

Friendly ping @timothyb89 ?

[codingllama]

Thanks folks. Now let's see what I missed when it gets to Drone.