build: Sign pkg installer for OS X

This makes the installer work on Mountain Lion.

Makefile

@@ -3,6 +3,7 @@
 BUILDTYPE ?= Release
 PYTHON ?= python
 DESTDIR ?=
+SIGN ?=
 
 # Default to verbose builds.
 # To do quiet/pretty builds, run `make V=` to set V to an empty string,
@@ -210,16 +211,18 @@ $(PKG):
 	rm -rf out/deps out/Release
 	./configure --prefix=$(PKGDIR)/usr/local --without-snapshot --dest-cpu=x64
 	$(MAKE) install V=$(V)
+	SIGN="$(SIGN)" PKGDIR="$(PKGDIR)" bash tools/osx-codesign.sh
 	lipo $(PKGDIR)/32/usr/local/bin/node \
 		$(PKGDIR)/usr/local/bin/node \
 		-output $(PKGDIR)/usr/local/bin/node-universal \
 		-create
 	mv $(PKGDIR)/usr/local/bin/node-universal $(PKGDIR)/usr/local/bin/node
 	rm -rf $(PKGDIR)/32
 	$(packagemaker) \
-		--id "org.nodejs.NodeJS-$(VERSION)" \
+		--id "org.nodejs.Node" \
 		--doc tools/osx-pkg.pmdoc \
 		--out $(PKG)
+	SIGN="$(SIGN)" PKG="$(PKG)" bash tools/osx-productsign.sh
 
 $(TARBALL): node doc
 	@if [ "$(shell git status --porcelain | egrep -v '^\?\? ')" = "" ]; then \

tools/osx-codesign.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -x
+set -e
+
+if ! [ -n "$SIGN" ] && [ $STEP -eq 1 ]; then
+  echo "No SIGN environment var.  Skipping codesign." >&2
+  exit 0
+fi
+
+codesign -s "$SIGN" "$PKGDIR"/usr/local/bin/node
+codesign -s "$SIGN" "$PKGDIR"/32/usr/local/bin/node

tools/osx-productsign.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -x
+set -e
+
+if ! [ -n "$SIGN" ]; then
+  echo "No SIGN environment var.  Skipping codesign." >&2
+  exit 0
+fi
+
+productsign --sign "$SIGN" "$PKG" "$PKG"-SIGNED
+mv "$PKG"-SIGNED "$PKG"