From 0025495aee0530f7dac86d9a8e3301adbc7c1fbe Mon Sep 17 00:00:00 2001
From: Allen Byrne <byrn@hdfgroup.org>
Date: Mon, 23 Sep 2024 15:42:26 -0500
Subject: [PATCH] Merge sign and relative file changes from master

---
 .github/workflows/ant-app.yml                 | 134 ++++---
 .github/workflows/ant.yml                     | 138 +++++---
 .github/workflows/daily-build.yml             |  37 +-
 .github/workflows/publish-release.yml         |  18 +-
 .github/workflows/release-files.yml           |  30 +-
 .github/workflows/release.yml                 |  30 +-
 README.md                                     |   5 +-
 build.xml                                     | 331 ++++++++++++++----
 .../hdf/view/HDFView.java                     |   2 +-
 9 files changed, 502 insertions(+), 223 deletions(-)

diff --git a/.github/workflows/ant-app.yml b/.github/workflows/ant-app.yml
index 8c248878..4f237c49 100644
--- a/.github/workflows/ant-app.yml
+++ b/.github/workflows/ant-app.yml
@@ -37,16 +37,51 @@ on:
             required: true
         KEYCHAIN_PASSWD:
             required: true
+        AZURE_TENANT_ID:
+            required: true
+        AZURE_CLIENT_ID:
+            required: true
+        AZURE_CLIENT_SECRET:
+            required: true
+        AZURE_ENDPOINT:
+            required: true
+        AZURE_CODE_SIGNING_NAME:
+            required: true
+        AZURE_CERT_PROFILE_NAME:
+            required: true
 
 permissions:
   contents: read
 
 jobs:
+  check-secret:
+    name: Check Secrets exists
+    runs-on: ubuntu-latest
+    outputs:
+      sign-state: ${{ steps.set-signing-state.outputs.BINSIGN }}
+    steps:
+      - name: Identify Signing Status
+        id: set-signing-state
+        env: 
+            signing_secret: ${{ secrets.AZURE_ENDPOINT }}
+        run: |
+          if [[ '${{ env.signing_secret }}' == '' ]]
+          then
+            SIGN_VAL=$(echo 'notexists')
+          else
+            SIGN_VAL=$(echo 'exists')
+          fi
+          echo "BINSIGN=$SIGN_VAL" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - run: echo "signing is ${{ steps.set-signing-state.outputs.BINSIGN }}."
+
   build_and_test_win:
   # Windows w/ MSVC + CMake
   #
     name: "Windows MSVC CTest"
     runs-on: windows-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -174,8 +209,8 @@ jobs:
     - name: Get zip-tarball (Windows)
       uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
       with:
-              name: zip-tarball
-              path: ${{ github.workspace }}
+          name: zip-tarball
+          path: ${{ github.workspace }}
 
     - name: using powershell
       shell: pwsh
@@ -183,8 +218,8 @@ jobs:
 
     - name: List files for the space (Windows)
       run: |
-              Get-ChildItem -Path ${{ github.workspace }}
-              Get-ChildItem -Path ${{ runner.workspace }}
+          Get-ChildItem -Path ${{ github.workspace }}
+          Get-ChildItem -Path ${{ runner.workspace }}
       shell: pwsh
 
     - name: Uncompress source (Windows)
@@ -192,10 +227,35 @@ jobs:
       run: 7z x ${{ steps.set-file-base.outputs.FILE_BASE }}.zip
       shell: bash
 
+    - name: Install TrustedSigning (Windows)
+      run: |
+          Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile .\nuget.exe
+          .\nuget.exe install Microsoft.Windows.SDK.BuildTools -Version 10.0.22621.3233 -x
+          .\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -x
+#          Install-Module -Name TrustedSigning -RequiredVersion 0.4.1
+      shell: pwsh
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
+    - name: create-json
+      id: create-json
+      uses: jsdaniell/create-json@v1.2.3
+      with:
+          name: "credentials.json"
+          json: '{"Endpoint": "${{ secrets.AZURE_ENDPOINT }}","CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}","CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}"}'
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
     - name: Build with Ant
       env:
         HDFLIBS: ${{ steps.set-hdflib-name.outputs.HDFLIB_ENV }}
         HDF5LIBS: ${{ steps.set-hdf5lib-name.outputs.HDF5LIB_ENV }}
+        BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
+        SIGNTOOLDIR: ${{ github.workspace }}/Microsoft.Windows.SDK.BuildTools/bin/10.0.22621.0/x64
       run: |
         ant -noinput -buildfile build.xml binaryAppPackage
       shell: bash
@@ -251,6 +311,7 @@ jobs:
   #
     name: "Ubuntu gcc CMake"
     runs-on: ubuntu-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -304,7 +365,7 @@ jobs:
         version: 'tags/${{ inputs.use_hdf5 }}'
         file: '${{ inputs.name_hdf5 }}-ubuntu-2204_gcc.tar.gz'
 
-    - name: Get hdf5 release
+    - name: Get hdf5 snapshot
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
@@ -419,7 +480,8 @@ jobs:
   # mac (osx) w/ clang + ant
   #
     name: "mac clang CMake"
-    runs-on: macos-13
+    runs-on: macos-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -443,6 +505,7 @@ jobs:
           # import certificate to keychain
           security -v import $CERTIFICATE_PATH -P $P12_PASSWORD -A -t cert -f pkcs12 -k $KEYCHAIN_FILE
           security -v set-key-partition-list -S apple-tool:,codesign:,apple: -k $KEYCHAIN_PASSWD $KEYCHAIN_FILE
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
 
     - name: Set up JDK 21
       uses: actions/setup-java@v4
@@ -451,40 +514,20 @@ jobs:
         distribution: 'temurin'
 
     - name: Get hdf4 release
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'release') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf4'
-        version: 'tags/${{ inputs.use_hdf }}'
-        file: '${{ inputs.use_hdf }}-osx.tar.gz'
-
-    - name: Get hdf4 release osx12
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf4'
         version: 'tags/${{ inputs.use_hdf }}'
-        file: '${{ inputs.use_hdf }}-osx12.tar.gz'
-
-    - name: Get hdf4 release
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'snapshots') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf4'
-        version: 'tags/snapshot'
-        file: '${{ inputs.use_hdf }}-osx.tar.gz'
+        file: '${{ inputs.use_hdf }}-macos14_clang.tar.gz'
 
-    - name: Get hdf4 snapshot osx12
-      continue-on-error: true
+    - name: Get hdf4 snapshot
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf4'
         version: 'tags/snapshot'
-        file: '${{ inputs.use_hdf }}-osx12.tar.gz'
+        file: '${{ inputs.use_hdf }}-macos14_clang.tar.gz'
 
     - name: List files for the space (mac)
       run: |
@@ -492,7 +535,7 @@ jobs:
             ls ${{ runner.workspace }}
 
     - name: Uncompress gh binary (mac)
-      run: tar -zxvf ${{ github.workspace }}/${{ inputs.use_hdf }}-osx*.tar.gz
+      run: tar -zxvf ${{ github.workspace }}/${{ inputs.use_hdf }}-macos14_clang*.tar.gz
 
     - name: Uncompress hdf4 binary (mac)
       run: |
@@ -507,40 +550,20 @@ jobs:
         echo "HDFLIB_ENV=$HDFDIR$FILE_NAME_HDF" >> $GITHUB_OUTPUT
 
     - name: Get hdf5 release
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf5'
         version: 'tags/${{ inputs.use_hdf5 }}'
-        file: '${{ inputs.name_hdf5 }}-osx.tar.gz'
-
-    - name: Get hdf5 release osx12
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'release') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf5'
-        version: 'tags/${{ inputs.use_hdf5 }}'
-        file: '${{ inputs.name_hdf5 }}-osx12.tar.gz'
+        file: '${{ inputs.name_hdf5 }}-macos14_clang.tar.gz'
 
     - name: Get hdf5 snapshot
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'snapshots') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf5'
-        version: 'tags/snapshot-1.14'
-        file: '${{ inputs.name_hdf5 }}-osx.tar.gz'
-
-    - name: Get hdf5 snapshot osx12
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf5'
         version: 'tags/snapshot-1.14'
-        file: '${{ inputs.name_hdf5 }}-osx12.tar.gz'
+        file: '${{ inputs.name_hdf5 }}-macos14_clang.tar.gz'
 
     - name: List files for the space (mac)
       run: |
@@ -548,7 +571,7 @@ jobs:
             ls ${{ runner.workspace }}
 
     - name: Uncompress gh binary (mac)
-      run: tar -zxvf ${{ github.workspace }}/${{ inputs.name_hdf5 }}-osx*.tar.gz
+      run: tar -zxvf ${{ github.workspace }}/${{ inputs.name_hdf5 }}-macos14_clang*.tar.gz
 
     - name: Uncompress hdf5 binary (mac)
       run:  |
@@ -599,6 +622,7 @@ jobs:
       env:
         HDFLIBS: ${{ steps.set-hdflib-name.outputs.HDFLIB_ENV }}
         HDF5LIBS: ${{ steps.set-hdf5lib-name.outputs.HDF5LIB_ENV }}
+        BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
         KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
         KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
         SIGNER: ${{ vars.SIGNER }}
@@ -631,7 +655,7 @@ jobs:
     - name: Save published snapshot-app binary (mac)
       uses: actions/upload-artifact@v4
       with:
-            name: tgz-osx-app-binary
+            name: tgz-macos14_clang-app-binary
             path: ${{ github.workspace }}/build/dist/${{ steps.set-file-base.outputs.FILE_BASE }}App-Darwin.tar.gz
             if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
       if: ${{ (inputs.use_environ == 'snapshots') }}
@@ -640,7 +664,7 @@ jobs:
     - name: Save published release-app binary (mac)
       uses: actions/upload-artifact@v4
       with:
-            name: tgz-osx-app-binary
+            name: tgz-macos14_clang-app-binary
             path: ${{ github.workspace }}/build/dist/${{ inputs.snap_name }}App-Darwin.tar.gz
             if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
       if: ${{ (inputs.use_environ == 'release') }}
diff --git a/.github/workflows/ant.yml b/.github/workflows/ant.yml
index fdd2e7ad..9b5dbec0 100644
--- a/.github/workflows/ant.yml
+++ b/.github/workflows/ant.yml
@@ -37,16 +37,51 @@ on:
             required: true
         KEYCHAIN_PASSWD:
             required: true
+        AZURE_TENANT_ID:
+            required: true
+        AZURE_CLIENT_ID:
+            required: true
+        AZURE_CLIENT_SECRET:
+            required: true
+        AZURE_ENDPOINT:
+            required: true
+        AZURE_CODE_SIGNING_NAME:
+            required: true
+        AZURE_CERT_PROFILE_NAME:
+            required: true
 
 permissions:
   contents: read
 
 jobs:
+  check-secret:
+    name: Check Secrets exists
+    runs-on: ubuntu-latest
+    outputs:
+      sign-state: ${{ steps.set-signing-state.outputs.BINSIGN }}
+    steps:
+      - name: Identify Signing Status
+        id: set-signing-state
+        env: 
+            signing_secret: ${{ secrets.AZURE_ENDPOINT }}
+        run: |
+          if [[ '${{ env.signing_secret }}' == '' ]]
+          then
+            SIGN_VAL=$(echo 'notexists')
+          else
+            SIGN_VAL=$(echo 'exists')
+          fi
+          echo "BINSIGN=$SIGN_VAL" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - run: echo "signing is ${{ steps.set-signing-state.outputs.BINSIGN }}."
+
   build_and_test_win:
   # Windows w/ MSVC + CMake
   #
     name: "Windows MSVC CTest"
     runs-on: windows-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -59,7 +94,7 @@ jobs:
     - name: Enable Developer Command Prompt
       uses: ilammy/msvc-dev-cmd@v1.13.0
 
-    - name: Get hdf4 snapshot
+    - name: Get hdf4 release
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
@@ -105,7 +140,7 @@ jobs:
         echo "HDFLIB_ENV=$HDFDIR" >> $GITHUB_OUTPUT
       shell: bash
 
-    - name: Get hdf5 snapshot
+    - name: Get hdf5 release
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
@@ -174,8 +209,8 @@ jobs:
     - name: Get zip-tarball (Windows)
       uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
       with:
-              name: zip-tarball
-              path: ${{ github.workspace }}
+          name: zip-tarball
+          path: ${{ github.workspace }}
 
     - name: using powershell
       shell: pwsh
@@ -183,8 +218,8 @@ jobs:
 
     - name: List files for the space (Windows)
       run: |
-              Get-ChildItem -Path ${{ github.workspace }}
-              Get-ChildItem -Path ${{ runner.workspace }}
+          Get-ChildItem -Path ${{ github.workspace }}
+          Get-ChildItem -Path ${{ runner.workspace }}
       shell: pwsh
 
     - name: Uncompress source (Windows)
@@ -192,10 +227,35 @@ jobs:
       run: 7z x ${{ steps.set-file-base.outputs.FILE_BASE }}.zip
       shell: bash
 
+    - name: Install TrustedSigning (Windows)
+      run: |
+          Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile .\nuget.exe
+          .\nuget.exe install Microsoft.Windows.SDK.BuildTools -Version 10.0.22621.3233 -x
+          .\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -x
+#          Install-Module -Name TrustedSigning -RequiredVersion 0.4.1
+      shell: pwsh
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
+    - name: create-json
+      id: create-json
+      uses: jsdaniell/create-json@v1.2.3
+      with:
+          name: "credentials.json"
+          json: '{"Endpoint": "${{ secrets.AZURE_ENDPOINT }}","CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}","CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}"}'
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
+
     - name: Build with Ant
       env:
         HDFLIBS: ${{ steps.set-hdflib-name.outputs.HDFLIB_ENV }}
         HDF5LIBS: ${{ steps.set-hdf5lib-name.outputs.HDF5LIB_ENV }}
+        BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
+        SIGNTOOLDIR: ${{ github.workspace }}/Microsoft.Windows.SDK.BuildTools/bin/10.0.22621.0/x64
       run: |
         ant -noinput -buildfile build.xml binaryPackage
       shell: bash
@@ -243,6 +303,7 @@ jobs:
   #
     name: "Ubuntu gcc CMake"
     runs-on: ubuntu-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -252,7 +313,7 @@ jobs:
         java-version: '21'
         distribution: 'temurin'
 
-    - name: Get hdf4 snapshot
+    - name: Get hdf4 release
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
@@ -296,7 +357,7 @@ jobs:
         version: 'tags/${{ inputs.use_hdf5 }}'
         file: '${{ inputs.name_hdf5 }}-ubuntu-2204_gcc.tar.gz'
 
-    - name: Get hdf5 release
+    - name: Get hdf5 snapshot
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
@@ -403,7 +464,8 @@ jobs:
   # mac (osx) w/ clang + ant
   #
     name: "mac clang CMake"
-    runs-on: macos-13
+    runs-on: macos-latest
+    needs: [check-secret]
     steps:
     - uses: actions/checkout@v4
 
@@ -427,6 +489,7 @@ jobs:
           # import certificate to keychain
           security -v import $CERTIFICATE_PATH -P $P12_PASSWORD -A -t cert -f pkcs12 -k $KEYCHAIN_FILE
           security -v set-key-partition-list -S apple-tool:,codesign:,apple: -k $KEYCHAIN_PASSWD $KEYCHAIN_FILE
+      if: ${{ needs.check-secret.outputs.sign-state == 'exists' }}
 
     - name: Set up JDK 21
       uses: actions/setup-java@v4
@@ -435,40 +498,20 @@ jobs:
         distribution: 'temurin'
 
     - name: Get hdf4 release
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'release') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf4'
-        version: 'tags/${{ inputs.use_hdf }}'
-        file: '${{ inputs.use_hdf }}-osx.tar.gz'
-
-    - name: Get hdf4 release osx12
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf4'
         version: 'tags/${{ inputs.use_hdf }}'
-        file: '${{ inputs.use_hdf }}-osx12.tar.gz'
+        file: '${{ inputs.use_hdf }}-macos14_clang.tar.gz'
 
     - name: Get hdf4 snapshot
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'snapshots') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf4'
-        version: 'tags/snapshot'
-        file: '${{ inputs.use_hdf }}-osx.tar.gz'
-
-    - name: Get hdf4 snapshot osx12
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf4'
         version: 'tags/snapshot'
-        file: '${{ inputs.use_hdf }}-osx12.tar.gz'
+        file: '${{ inputs.use_hdf }}-macos14_clang.tar.gz'
 
     - name: List files for the space (mac)
       run: |
@@ -476,7 +519,7 @@ jobs:
             ls ${{ runner.workspace }}
 
     - name: Uncompress gh binary (mac)
-      run: tar -zxvf ${{ github.workspace }}/${{ inputs.use_hdf }}-osx*.tar.gz
+      run: tar -zxvf ${{ github.workspace }}/${{ inputs.use_hdf }}-macos14_clang*.tar.gz
 
     - name: Uncompress hdf4 binary (mac)
       run: |
@@ -491,40 +534,20 @@ jobs:
         echo "HDFLIB_ENV=$HDFDIR$FILE_NAME_HDF" >> $GITHUB_OUTPUT
 
     - name: Get hdf5 release
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'release') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf5'
         version: 'tags/${{ inputs.use_hdf5 }}'
-        file: '${{ inputs.name_hdf5 }}-osx.tar.gz'
-
-    - name: Get hdf5 release osx12
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'release') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf5'
-        version: 'tags/${{ inputs.use_hdf5 }}'
-        file: '${{ inputs.name_hdf5 }}-osx12.tar.gz'
+        file: '${{ inputs.name_hdf5 }}-macos14_clang.tar.gz'
 
     - name: Get hdf5 snapshot
-      continue-on-error: true
-      if: ${{ (inputs.use_environ == 'snapshots') }}
-      uses: dsaltares/fetch-gh-release-asset@master
-      with:
-        repo: 'HDFGroup/hdf5'
-        version: 'tags/snapshot-1.14'
-        file: '${{ inputs.name_hdf5 }}-osx.tar.gz'
-
-    - name: Get hdf5 snapshot osx12
-      continue-on-error: true
       if: ${{ (inputs.use_environ == 'snapshots') }}
       uses: dsaltares/fetch-gh-release-asset@master
       with:
         repo: 'HDFGroup/hdf5'
         version: 'tags/snapshot-1.14'
-        file: '${{ inputs.name_hdf5 }}-osx12.tar.gz'
+        file: '${{ inputs.name_hdf5 }}-macos14_clang.tar.gz'
 
     - name: List files for the space (mac)
       run: |
@@ -532,7 +555,7 @@ jobs:
             ls ${{ runner.workspace }}
 
     - name: Uncompress gh binary (mac)
-      run: tar -zxvf ${{ github.workspace }}/${{ inputs.name_hdf5 }}-osx*.tar.gz
+      run: tar -zxvf ${{ github.workspace }}/${{ inputs.name_hdf5 }}-macos14_clang*.tar.gz
 
     - name: Uncompress hdf5 binary (mac)
       run:  |
@@ -583,6 +606,7 @@ jobs:
       env:
         HDFLIBS: ${{ steps.set-hdflib-name.outputs.HDFLIB_ENV }}
         HDF5LIBS: ${{ steps.set-hdf5lib-name.outputs.HDF5LIB_ENV }}
+        BINSIGN: ${{ needs.check-secret.outputs.sign-state }}
         KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
         KEYCHAIN_NAME: ${{ vars.KEYCHAIN_NAME }}
         SIGNER: ${{ vars.SIGNER }}
@@ -607,7 +631,7 @@ jobs:
     - name: Save published snapshot binary (mac)
       uses: actions/upload-artifact@v4
       with:
-            name: tgz-osx-binary
+            name: tgz-macos14_clang-binary
             path: ${{ github.workspace }}/build/dist/${{ steps.set-file-base.outputs.FILE_BASE }}-Darwin.tar.gz
             if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
       if: ${{ (inputs.use_environ == 'snapshots') }}
@@ -616,7 +640,7 @@ jobs:
     - name: Save published release binary (mac)
       uses: actions/upload-artifact@v4
       with:
-            name: tgz-osx-binary
+            name: tgz-macos14_clang-binary
             path: ${{ github.workspace }}/build/dist/${{ inputs.snap_name }}-Darwin.tar.gz
             if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
       if: ${{ (inputs.use_environ == 'release') }}
diff --git a/.github/workflows/daily-build.yml b/.github/workflows/daily-build.yml
index 0e2cb54c..e6bec357 100644
--- a/.github/workflows/daily-build.yml
+++ b/.github/workflows/daily-build.yml
@@ -25,7 +25,7 @@ jobs:
       run-ignore: ${{ steps.getinputs.outputs.INPUTS_IGNORE }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.1.7
 
     - name: Get hdfview release base name
       uses: dsaltares/fetch-gh-release-asset@master
@@ -69,13 +69,10 @@ jobs:
     - name: Read inputs
       id: getinputs
       run: |
-        echo "INPUTS_IGNORE=${{ ((github.event.inputs.use_ignore == '' && github.event.inputs.use_ignore)  || 'ignore') }}" >> $GITHUB_OUTPUT
-        echo "INPUTS_ENVIRON=${{ ((github.event.inputs.use_environ == '' && github.event.inputs.use_environ)  || 'snapshots') }}" >> $GITHUB_OUTPUT
+        echo "INPUTS_IGNORE=${{ github.event.inputs.use_ignore }}" >> $GITHUB_OUTPUT
 
     - run: echo "use_ignore is ${{ steps.getinputs.outputs.INPUTS_IGNORE }}."
 
-    - run: echo "use_environ is ${{ steps.getinputs.outputs.INPUTS_ENVIRON }}."
-
   call-workflow-tarball:
     needs: get-base-names
     uses: ./.github/workflows/tarball.yml
@@ -93,10 +90,16 @@ jobs:
       use_hdf5: ${{ needs.get-base-names.outputs.hdf5-name }}
       name_hdf5: ${{ needs.get-base-names.outputs.hdf5-name }}
       use_environ: snapshots
-    secrets:      
-      APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
-      APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
-      KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
 
   call-workflow-ant-app:
     needs: [get-base-names, call-workflow-tarball]
@@ -107,10 +110,16 @@ jobs:
       use_hdf5: ${{ needs.get-base-names.outputs.hdf5-name }}
       name_hdf5: ${{ needs.get-base-names.outputs.hdf5-name }}
       use_environ: snapshots
-    secrets:      
-      APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
-      APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
-      KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
 
   call-workflow-release:
     needs: [get-base-names, call-workflow-tarball, call-workflow-ant, call-workflow-ant-app]
@@ -133,5 +142,5 @@ jobs:
       file_base: ${{ needs.get-base-names.outputs.hdfview-name }}
       use_tag: HDFView-3.3.99
       use_environ: snapshots
-    if: ${{ ((needs.call-workflow-tarball.outputs.has_changes == 'true') || (needs.get-base-names.outputs.run-ignore == 'ignore')) }}
+    if: ${{ ((needs.call-workflow-tarball.outputs.has_changes == 'true') || (needs.get-base-names.outputs.run-ignore == 'ignore')) && (needs.get-base-names.outputs.hdfview-name != needs.call-workflow-tarball.outputs.file_base) }}
 
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index f7ba4cf1..ebc1142d 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -12,8 +12,9 @@ on:
         description: 'HDFView target bucket directory'
         type: string
         required: true
-    permissions:
-      contents: read
+
+permissions:
+  contents: read
 
 jobs:
   publish-tag:
@@ -21,7 +22,7 @@ jobs:
     steps:
         # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
         - name: Get Sources
-          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+          uses: actions/checkout@9a9194f87191a7e9055e3e9b95b8cfb13023bb08 # v4.1.7
           with:
             fetch-depth: 0
             ref: '${{ github.head_ref || github.ref_name }}'
@@ -44,8 +45,13 @@ jobs:
             target: 'HDFVIEW/'
             file: 'UsersGuide.*'
 
+        - name: List files for the space
+          run: |
+              ls -l ${{ github.workspace }}
+              ls ${{ github.workspace }}/HDFVIEW
+
         - name: Setup AWS CLI
-          uses: aws-actions/configure-aws-credentials@v1
+          uses: aws-actions/configure-aws-credentials@v4
           with:
                  aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
                  aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -56,9 +62,9 @@ jobs:
                 aws s3 sync ./HDFVIEW s3://${{ secrets.AWS_S3_BUCKET }}/${{ vars.TARGET_PATH }}/${{ inputs.target_dir }}/downloads --delete
 
         - name: Uncompress source (Linux)
-          run: tar -zxvf ${{ github.workspace }}/UsersGuide.tar.gz
+          run: tar -zxvf ${{ github.workspace }}/HDFVIEW/UsersGuide.tar.gz
 
         - name: Sync userguide to S3 bucket
           run: |
-                aws s3 sync ./UsersGuide s3://${{ secrets.AWS_S3_BUCKET }}/${{ vars.TARGET_PATH }}/${{ inputs.target_dir }}/documentation --delete
+                aws s3 sync ./UsersGuide s3://${{ secrets.AWS_S3_BUCKET }}/${{ vars.TARGET_PATH }}/${{ inputs.target_dir }}/documentation/UsersGuide --delete
 
diff --git a/.github/workflows/release-files.yml b/.github/workflows/release-files.yml
index 8f7a82f3..f77ba094 100644
--- a/.github/workflows/release-files.yml
+++ b/.github/workflows/release-files.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9a9194f87191a7e9055e3e9b95b8cfb13023bb08 # v4.1.7
         with:
           fetch-depth: 0
           ref: '${{ github.head_ref || github.ref_name }}'
@@ -73,58 +73,58 @@ jobs:
 
       # Get files created by tarball script
       - name: Get tgz-tarball (Linux)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: tgz-tarball
               path: ${{ github.workspace }}
 
       - name: Get zip-tarball (Windows)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: zip-tarball
               path: ${{ github.workspace }}
 
       # Get files created by ant script
       - name: Get published binary (Windows)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: zip-win-vs2022-binary
               path: ${{ github.workspace }}
 
       - name: Get published binary (MacOS)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
-              name: tgz-osx-binary
+              name: tgz-macos14_clang-binary
               path: ${{ github.workspace }}
 
       - name: Get published binary (Linux)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: tgz-ubuntu-2204-binary
               path: ${{ github.workspace }}
 
       # Get files created by ant-app script
       - name: Get published app binary (Windows)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: zip-win-vs2022-app-binary
               path: ${{ github.workspace }}
       
       - name: Get published app binary (MacOS)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
-              name: tgz-osx-app-binary
+              name: tgz-macos14_clang-app-binary
               path: ${{ github.workspace }}
       
       - name: Get published app binary (Linux)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: tgz-ubuntu-2204-app-binary
               path: ${{ github.workspace }}
 
       # Get files created by tarball script
       - name: Get UsersGuide (Linux)
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: docs-usersguide
               path: ${{ github.workspace }}/UsersGuide
@@ -160,7 +160,7 @@ jobs:
           echo "${{ steps.get-file-base.outputs.FILE_BASE }}" > ./last-file.txt
 
       - name: Get NEWSLETTER
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
               name: NEWSLETTER
               path: ${{ github.workspace }}
@@ -172,7 +172,7 @@ jobs:
       - name: PreRelease tag
         id: create_prerelease
         if: ${{ (inputs.use_environ == 'snapshots') }}
-        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
         with:
           tag_name: "${{ inputs.use_tag }}"
           prerelease: true
@@ -195,7 +195,7 @@ jobs:
       - name: Release tag
         id: create_release
         if: ${{ (inputs.use_environ == 'release') }}
-        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
         with:
           tag_name: "${{ inputs.use_tag }}"
           prerelease: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4d38035e..a60866ff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,8 +28,6 @@ on:
 permissions:
   contents: read
 
-# A workflow run is made up of one or more jobs that can run sequentially or
-# in parallel.
 jobs:
   log-the-inputs:
     runs-on: ubuntu-latest
@@ -66,10 +64,16 @@ jobs:
       name_hdf5: ${{ inputs.name_tag5 }}
       snap_name: HDFView-${{ needs.call-workflow-tarball.outputs.source_base }}
       use_environ: release
-    secrets:      
-      APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
-      APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
-      KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
 
   call-workflow-ant-app:
     needs: [log-the-inputs, call-workflow-tarball]
@@ -81,10 +85,16 @@ jobs:
       name_hdf5: ${{ inputs.name_tag5 }}
       snap_name: HDFView-${{ needs.call-workflow-tarball.outputs.source_base }}
       use_environ: release
-    secrets:      
-      APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
-      APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
-      KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+    secrets:
+        APPLE_CERTS_BASE64: ${{ secrets.APPLE_CERTS_BASE64 }}
+        APPLE_CERTS_BASE64_PASSWD: ${{ secrets.APPLE_CERTS_BASE64_PASSWD }}
+        KEYCHAIN_PASSWD: ${{ secrets.KEYCHAIN_PASSWD }}
+        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
+        AZURE_CODE_SIGNING_NAME: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        AZURE_CERT_PROFILE_NAME: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
 
   call-workflow-release:
     needs: [log-the-inputs, call-workflow-tarball, call-workflow-ant, call-workflow-ant-app]
diff --git a/README.md b/README.md
index 6a257c98..ae10d437 100644
--- a/README.md
+++ b/README.md
@@ -46,9 +46,10 @@ of HDF5 and HDF4. Previous releases of HDFView that were based on HDF5 1.8,
 
 | Release | HDF5 | HDF4 | New Features |
 | ------- | ---- | ---- | ------------ |
-| 3.3.0 | 1.14.0 | 4.2.16 | Supports HDF5 1.12 references, Single-Writer/Multiple-Readers (SWMR) reads, bug fixes |
+| 3.3.0 | 1.14.0 | 4.2.16 | HDF5 1.12 (new-style) references, Single-Writer/Multiple-Readers (SWMR) reads, bug fixes |
 | 3.3.1 | 1.14.2 | 4.2.16-2 | Fixes a critical HDF4 + HDFView bug |
-| 3.3.2 | 1.14.4 | 4.3.0 | Maintenance release |
+| 3.3.2 | 1.14.4 | 4.3.0 | Float16 support |
+| 3.3.3 | 1.16.0 | 4.4.0 | Complex number support |
 
 
 PREVIOUS RELEASES AND SOURCE CODE
diff --git a/build.xml b/build.xml
index 799ae62d..3eba4125 100644
--- a/build.xml
+++ b/build.xml
@@ -15,9 +15,9 @@
 
     <record name="antoutput.log" action="start" append="${build.antoutput.append}" loglevel="verbose" />
 
-    <property name="sign_state" value="sign" />
+    <property name="sign_state" value="${env.BINSIGN}" />
     <condition property="sign.enable">
-        <equals arg1="${sign_state}" arg2="sign" />
+        <equals arg1="${sign_state}" arg2="exists" />
     </condition>
     <!-- MAC signing: -->
     <property name="sign.account" value="${env.SIGNER}" />
@@ -1370,6 +1370,15 @@
         </condition>
         <echo if:set="isXMac">isXMac=${isXMac}</echo>
 
+        <condition property="isSignXMac" else="false">
+            <and>
+                <equals arg1="${isMac}" arg2="true" />
+                <equals arg1="${sign.enable}" arg2="true" />
+                <equals arg1="${XPackage}" arg2="true" />
+            </and>
+        </condition>
+        <echo if:set="isSignXMac">isSignXMac=${isSignXMac}</echo>
+
         <condition property="isXUnix" else="false">
             <and>
                 <equals arg1="${isUnix}" arg2="true" />
@@ -1406,9 +1415,21 @@
         </condition>
         <echo if:set="isXWindows">isXWindows=${isXWindows}</echo>
 
+        <condition property="isSignXWindows" else="false">
+            <and>
+                <equals arg1="${isWindows}" arg2="true" />
+                <equals arg1="${sign.enable}" arg2="true" />
+                <equals arg1="${XPackage}" arg2="true" />
+            </and>
+        </condition>
+        <echo if:set="isSignXWindows">isSignXWindows=${isSignXWindows}</echo>
+
         <condition property="isAppMac" else="false">
             <and>
                 <equals arg1="${isMac}" arg2="true" />
+                <not>
+                    <equals arg1="${sign.enable}" arg2="true" />
+                </not>
                 <not>
                     <equals arg1="${XPackage}" arg2="true" />
                 </not>
@@ -1416,6 +1437,17 @@
         </condition>
         <echo if:set="isAppMac">isAppMac=${isAppMac}</echo>
 
+        <condition property="isSignAppMac" else="false">
+            <and>
+                <equals arg1="${isMac}" arg2="true" />
+                <equals arg1="${sign.enable}" arg2="true" />
+                <not>
+                    <equals arg1="${XPackage}" arg2="true" />
+                </not>
+            </and>
+        </condition>
+        <echo if:set="isSignAppMac">isSignAppMac=${isSignAppMac}</echo>
+
         <condition property="isAppUnix" else="false">
             <and>
                 <equals arg1="${isUnix}" arg2="true" />
@@ -1453,32 +1485,35 @@
         <property name="XPackage" value="true" />
     </target>
 
-    <target name="binaryPackX" depends="setXPackage, binaryPackXWindows, binaryPackXUnix, binaryPackXMac"
+    <target name="binaryPackX" depends="setXPackage, binaryPackXWindows, binaryPackXUnix, binaryPackXMac, binaryPackSignXMac"
         description="Packages up the installer, the license file and the README file into a distributable form"  />
 
-    <target name="binaryPackXWindows" depends="createJXPackage, createWindowsREADME" if="${isXWindows}">
-        <mkdir dir="${dist.dir}" />
-
-        <attrib file="${basedir}\${dist.dir}\${ant.project.name}-${app.version}.exe" readonly="false" />
+    <target name="binaryPackSignXWindows" depends="createJXPackage, createWindowsREADME" if="${isSignXWindows}">
+        <attrib file="${basedir}\${dist.dir}\${ant.project.name}-${app.version}.msi" readonly="false" />
         <echo message="xxxx Sign the windows binary xxxx"/>
         <!-- Sign the generated exe -->
-        <exec executable="${env.SIGNTOOLDIR}\signtool.exe" failifexecutionfails="false">
+        <exec executable="${env.SIGNTOOLDIR}/signtool.exe" failifexecutionfails="false">
             <arg value="sign" />
             <arg value="/v" />
             <arg value="/debug" />
             <arg value="/fd" />
             <arg value="SHA256" />
+            <arg value="/tr" />
+            <arg value="http://timestamp.acs.microsoft.com" />
+            <arg value="/td" />
+            <arg value="SHA256" />
             <arg value="/d" />
             <arg value="${ant.project.name} ${app.version} Utility" />
-            <arg value="/f" />
-            <arg value="${env.CERTIFICATE}" />
-            <arg value="/p" />
-            <arg value="${env.SIGNPASSWORD}" />
-            <arg value="/t" />
-            <arg value="http://timestamp.digicert.com" />
-            <arg value="${basedir}\${dist.dir}\${ant.project.name}-${app.version}.exe" />
+            <arg value="/dlib" />
+            <arg value="Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll" />
+            <arg value="/dmdf" />
+            <arg value="${basedir}\credentials.json" />
+            <arg value="${basedir}\${dist.dir}\${ant.project.name}-${app.version}.msi" />
         </exec>
+    </target>
 
+    <target name="binaryPackXWindows" depends="binaryPackSignXWindows, createJXPackage, createWindowsREADME" if="${isXWindows}">
+        <mkdir dir="${dist.dir}" />
         <echo message="xxxx Package the windows binary xxxx"/>
         <!-- Copy over license file -->
         <copy todir="${dist.dir}">
@@ -1517,7 +1552,43 @@
         <chmod perm="u+w" file="${dist.dir}/${ant.project.name}-${app.version}-${uname.os}-${machine.arch}.tar.gz" />
     </target>
 
-    <target name="binaryPackXMac" depends="createJXPackageMac, createMacREADME" if="${isXMac}">
+    <target name="binaryPackXMac" depends="binaryPackSignXMac, createJXPackageMac, createMacREADME" if="${isXMac}">
+        <echo message="xxxx Package the mac dmg binary xxxx"/>
+        <!-- Copy over license file -->
+        <copy tofile="${dist.dir}/COPYING.txt">
+            <fileset dir="${basedir}" includes="COPYING" />
+        </copy>
+
+        <exec executable="uname" outputproperty="uname.os">
+            <arg value="-s" />
+        </exec>
+
+        <exec executable="uname" outputproperty="uname.version">
+            <arg value="-r" />
+        </exec>
+
+        <exec dir="${dist.dir}" executable="hdiutil">
+            <arg value="verify" />
+            <arg value="${ant.project.name}-${app.version}.dmg" />
+        </exec>
+
+        <echo message="xxxx Compress the mac dmg binary xxxx"/>
+        <!-- Copy over license file -->
+        <copy tofile="${dist.dir}/COPYING.txt">
+            <fileset dir="${basedir}" includes="COPYING" />
+        </copy>
+
+        <!-- Compress everything into one tar.gz file -->
+        <tar destfile="${dist.dir}/${ant.project.name}-${app.version}-${uname.os}.tar.gz" compression="gzip">
+            <tarfileset dir="${dist.dir}" filemode="755">
+                <include name="COPYING.txt" />
+                <include name="README.txt" />
+                <include name="${ant.project.name}-${app.version}.dmg" />
+            </tarfileset>
+        </tar>
+    </target>
+
+    <target name="binaryPackSignXMac" depends="createJXPackageMac, createMacREADME" if="${isSignXMac}">
         <!-- unlock keychain -->
         <exec executable="security" dir="${dist.dir}" failonerror="true">
             <arg value="unlock-keychain" />
@@ -1561,52 +1632,91 @@
 
         <echo message="xxxx Staple notary ID to dmg xxxx"/>
         <antcall target="staple-notary" />
-
-        <echo message="xxxx Package the mac dmg binary xxxx"/>
-        <!-- Copy over license file -->
-        <copy tofile="${dist.dir}/COPYING.txt">
-            <fileset dir="${basedir}" includes="COPYING" />
-        </copy>
-
-        <exec executable="uname" outputproperty="uname.os">
-            <arg value="-s" />
-        </exec>
-
-        <exec executable="uname" outputproperty="uname.version">
-            <arg value="-r" />
-        </exec>
-
-        <exec dir="${dist.dir}" executable="hdiutil">
-            <arg value="verify" />
-            <arg value="${ant.project.name}-${app.version}.dmg" />
-        </exec>
-
-        <echo message="xxxx Compress the mac dmg binary xxxx"/>
-        <!-- Copy over license file -->
-        <copy tofile="${dist.dir}/COPYING.txt">
-            <fileset dir="${basedir}" includes="COPYING" />
-        </copy>
-
-        <!-- Compress everything into one tar.gz file -->
-        <tar destfile="${dist.dir}/${ant.project.name}-${app.version}-${uname.os}.tar.gz" compression="gzip">
-            <tarfileset dir="${dist.dir}" filemode="755">
-                <include name="COPYING.txt" />
-                <include name="README.txt" />
-                <include name="${ant.project.name}-${app.version}.dmg" />
-            </tarfileset>
-        </tar>
-
     </target>
 
     <!-- =================================================================
           JXPackage - native
          ================================================================= -->
 
-    <target name="createJXPackage" depends="createJXPackageWindows, createJXPackageUnix, createJXPackageMac"
+    <target name="createJXPackage" depends="createJXPackageWindows, createJXPackageUnix, createJXPackageMac, createJXPackageSignMac"
             description="Create the final package for distribution" />
 
     <!-- package args for fixed jpackage -->
     <target name="createJXPackageMac" depends="createJPackageBase" if="${isXMac}">
+        <echo> JXPackage the mac application</echo>
+        <exec executable="${java.home}/bin/jpackage">
+            <!-- Basic usage -->
+            <arg value="--verbose" />
+            <arg value="--name" />
+            <arg value="${ant.project.name}" />
+            <arg value="--module-path" />
+            <arg value="${basedir}/${release.dir}" />
+            <arg value="--input" />
+            <arg value="${release.dir}" />
+            <arg value="--main-jar" />
+            <arg value="${ant.project.name}.jar"/>
+            <arg value="--main-class" />
+            <arg value="${main-class}"/>
+            <arg value="--dest" />
+            <arg value="${dist.dir}" />
+            <!-- Package metadata -->
+            <arg value="--app-version" />
+            <arg value="${app.version}" />
+            <arg value="--copyright" />
+            <arg value="Copyright 2006 by The HDF Group" />
+            <arg value="--description" />
+            <arg value="A visual tool for browsing and editing HDF files" />
+            <arg value="--vendor" />
+            <arg value="The HDF Group" />
+            <arg value="--license-file" />
+            <arg value="${basedir}/COPYING" />
+            <!-- File associations -->
+            <arg value="--file-associations" />
+            <arg value="${basedir}/package_files/HDFViewHDF.properties" />
+            <arg value="--file-associations" />
+            <arg value="${basedir}/package_files/HDFViewH4.properties" />
+            <arg value="--file-associations" />
+            <arg value="${basedir}/package_files/HDFViewHDF4.properties" />
+            <arg value="--file-associations" />
+            <arg value="${basedir}/package_files/HDFViewH5.properties" />
+            <arg value="--file-associations" />
+            <arg value="${basedir}/package_files/HDFViewHDF5.properties" />
+            <!-- Launchers -->
+            <!-- <arg value="- -arguments" />
+            <arg value="-Dhdfview.root='/Applications/HDF_Group/${ant.project.name}'" /> -->
+            <arg value="--arguments" />
+            <arg value="-Dhdfview.root='$APPDIR'" />
+            <arg value="--java-options" />
+            <arg value="-Xmx1024M" />
+            <arg value="--java-options" />
+            <arg value="-XstartOnFirstThread" />
+            <!-- <arg value="- -java-options" />
+            <arg value="-Djava.library.path='/Applications/HDF_Group/${ant.project.name}/lib:/Applications/HDF_Group/${ant.project.name}/lib/ext'" /> -->
+            <arg value="--java-options" />
+            <arg value="-Djava.library.path='$APPDIR'" />
+            <!-- Application images -->
+            <arg value="--resource-dir" />
+            <arg value="${basedir}/package_files/macosx" />
+
+            <!-- Runtime images -->
+            <arg value="--runtime-image" />
+            <arg value="${jar.dir}/jre" />
+            <!-- Platform-specific details -->
+            <!-- <arg value="- -install-dir" /> -->
+            <!-- <arg value="/Applications/HDF_Group/${ant.project.name}" /> -->
+            <arg value="--type" />
+            <arg value="dmg" />
+            <arg value="--icon" />
+            <arg value="${basedir}/package_files/macosx/HDFView.icns" />
+            <arg value="--mac-package-identifier" />
+            <arg value="HDFView.hdfgroup.org" />
+            <arg value="--mac-package-name" />
+            <arg value="${ant.project.name}-${app.version}" />
+        </exec>
+    </target>
+
+    <!-- package args for fixed jpackage -->
+    <target name="createJXPackageSignMac" depends="createJPackageBase" if="${isSignXMac}">
         <!-- unlock keychain -->
         <exec executable="security" dir="${dist.dir}" failonerror="true">
             <arg value="unlock-keychain" />
@@ -1824,9 +1934,8 @@
             <arg value="--win-menu" />
             <arg value="--win-menu-group" />
             <arg value="The HDF Group" />
-            <!-- create exe installer - msi needs more work -->
-            <!-- <arg value="- -type" />
-            <arg value="msi" /> -->
+            <arg value="--type" />
+            <arg value="msi" />
         </exec>
     </target>
 
@@ -1834,7 +1943,7 @@
           MAC NOTARY FOR JXPACKAGE
           ================================================================= -->
 
-    <target name="zip-submit-notary" if="sign.enable">
+    <target name="zip-submit-notary" if="${sign.enable}">
         <exec executable="/usr/bin/xcrun" failonerror="true"
               outputproperty="zipUUID.txt">
             <arg value="notarytool"/>
@@ -1864,7 +1973,7 @@
         <echo>*** notarize-zip-app:${zipUUID} ***</echo>
     </target>
 
-    <target name="zip-post-notary" if="sign.enable">
+    <target name="zip-post-notary" if="${sign.enable}">
         <exec executable="/usr/bin/xcrun" failonerror="true" outputproperty="logInfo" resultproperty="logUUID">
             <redirector output="notary.txt" alwayslog="true"/>
             <arg value="notarytool"/>
@@ -1885,7 +1994,7 @@
 
     <!-- Staple the received notarization to the app -->
     <!-- run this after notarization is completed -->
-    <target name="zip-staple-notary" if="sign.enable">
+    <target name="zip-staple-notary" if="${sign.enable}">
         <echo message="*** Stapling notarization to Mac Build ***"/>
         <exec executable="/usr/bin/xcrun" dir="${dist.dir}" failonerror="true">
             <arg value="stapler"/>
@@ -1905,7 +2014,7 @@
     <!-- =================================================================
           BINARY - PACK
           ================================================================= -->
-    <target name="binaryPack" depends="clean-package, binaryPackWindows, binaryPackUnix, binaryPackMac"
+    <target name="binaryPack" depends="clean-package, binaryPackWindows, binaryPackUnix, binaryPackMac, binaryPackSignMac"
         description="Packages up the release directory, the license file and the README file into a distributable form" />
 
     <target name="binaryPackWindows" depends="createJPackage, createWindowsAppREADME" if="${isAppWindows}">
@@ -1944,6 +2053,40 @@
     </target>
 
     <target name="binaryPackMac" depends="createJPackageMac, createMacREADME" if="${isAppMac}">
+        <exec executable="uname" outputproperty="uname.os">
+            <arg value="-s" />
+        </exec>
+
+        <exec executable="uname" outputproperty="uname.version">
+            <arg value="-r" />
+        </exec>
+
+        <!-- verify gatekeeper -->
+        <exec executable="spctl" dir="${dist.dir}" failonerror="false">
+            <arg value="-vvvv" />
+            <arg value="--assess" />
+            <arg value="--type" />
+            <arg value="install" />
+            <arg value="${ant.project.name}.app" />
+        </exec>
+
+        <echo message="---- Compress the mac app binary ----"/>
+        <!-- Copy over license file -->
+        <copy tofile="${dist.dir}/COPYING.txt">
+            <fileset dir="${basedir}" includes="COPYING" />
+        </copy>
+
+        <!-- Compress everything into one tar.gz file -->
+        <tar destfile="${dist.dir}/${ant.project.name}-${app.version}-${uname.os}.tar.gz" compression="gzip">
+            <tarfileset dir="${dist.dir}" filemode="755">
+                <include name="COPYING.txt" />
+                <include name="README.txt" />
+                <include name="${ant.project.name}.app/**" />
+            </tarfileset>
+        </tar>
+    </target>
+
+    <target name="binaryPackSignMac" depends="createJPackageMac, createMacREADME" if="${isSignAppMac}">
         <!-- unlock keychain -->
         <exec executable="security" dir="${dist.dir}" failonerror="true">
             <arg value="unlock-keychain" />
@@ -2050,10 +2193,72 @@
           JPACKAGE APP-IMAGE
           ================================================================= -->
 
-    <target name="createJPackage" depends="createJPackageWindows, createJPackageUnix, createJPackageMac"
+    <target name="createJPackage" depends="createJPackageWindows, createJPackageUnix, createJPackageMac, createJPackageSignMac"
             description="Create the final package for distribution" />
 
     <target name="createJPackageMac" depends="createJPackageBase" if="${isAppMac}">
+        <echo> Create the mac jpackage</echo>
+        <exec executable="${java.home}/bin/jpackage">
+            <!-- Basic usage -->
+            <arg value="--verbose" />
+            <arg value="--name" />
+            <arg value="${ant.project.name}" />
+            <arg value="--module-path" />
+            <arg value="${basedir}/${release.dir}" />
+            <arg value="--input" />
+            <arg value="${release.dir}" />
+            <arg value="--main-jar" />
+            <arg value="${ant.project.name}.jar"/>
+            <arg value="--main-class" />
+            <arg value="${main-class}"/>
+            <arg value="--dest" />
+            <arg value="${dist.dir}" />
+            <!-- Package metadata -->
+            <arg value="--app-version" />
+            <arg value="${app.version}" />
+            <arg value="--copyright" />
+            <arg value="Copyright 2006 by The HDF Group" />
+            <arg value="--description" />
+            <arg value="A visual tool for browsing and editing HDF files" />
+            <arg value="--vendor" />
+            <arg value="The HDF Group" />
+            <!-- <arg value="- -license-file" />
+            <arg value="${basedir}/COPYING" /> -->
+            <!-- Launchers -->
+            <!-- <arg value="- -arguments" />
+            <arg value="-Dhdfview.root='/Applications/HDF_Group/${ant.project.name}'" /> -->
+            <arg value="--arguments" />
+            <arg value="-Dhdfview.root='$APPDIR'" />
+            <arg value="--java-options" />
+            <arg value="-Xmx1024M" />
+            <arg value="--java-options" />
+            <arg value="-XstartOnFirstThread" />
+            <!-- <arg value="- -java-options" />
+            <arg value="-Djava.library.path='/Applications/HDF_Group/${ant.project.name}/lib:/Applications/HDF_Group/${ant.project.name}/lib/ext'" /> -->
+            <arg value="--java-options" />
+            <arg value="-Djava.library.path='$APPDIR'" />
+            <!-- Application images -->
+            <arg value="--resource-dir" />
+            <arg value="${basedir}/package_files/macosx" />
+
+            <!-- Runtime images -->
+            <!-- <arg value="- -install-dir" />
+            <arg value="/Applications/HDF_Group/${ant.project.name}" /> -->
+            <arg value="--runtime-image" />
+            <arg value="${jar.dir}/jre" />
+            <!-- Platform-specific details -->
+            <arg value="--type" />
+            <arg value="app-image" />
+            <arg value="--icon" />
+            <arg value="${basedir}/package_files/macosx/HDFView.icns" />
+            <arg value="--mac-package-identifier" />
+            <arg value="HDFView.hdfgroup.org" />
+            <arg value="--mac-package-name" />
+            <arg value="${ant.project.name}-${app.version}" />
+        </exec>
+    </target>
+
+    <target name="createJPackageSignMac" depends="createJPackageBase" if="${isSignAppMac}">
         <!-- unlock keychain -->
         <exec executable="security" dir="${dist.dir}" failonerror="true">
             <arg value="unlock-keychain" />
@@ -2237,7 +2442,7 @@
           MAC NOTARY FOR JPACKAGE
           ================================================================= -->
 
-    <target name="submit-notary" if="sign.enable">
+    <target name="submit-notary" if="${sign.enable}">
         <exec executable="/usr/bin/xcrun" failonerror="true"
               outputproperty="retUUID.txt">
             <arg value="notarytool"/>
@@ -2267,7 +2472,7 @@
         <echo>*** notarize-app:${retUUID} ***</echo>
     </target>
 
-    <target name="post-notary" if="sign.enable">
+    <target name="post-notary" if="${sign.enable}">
         <exec executable="/usr/bin/xcrun" failonerror="true" outputproperty="logInfo" resultproperty="logUUID">
             <redirector output="notary.txt" alwayslog="true"/>
             <arg value="notarytool"/>
@@ -2288,7 +2493,7 @@
 
     <!-- Staple the received notarization to the app -->
     <!-- run this after notarization is completed -->
-    <target name="staple-notary" if="sign.enable">
+    <target name="staple-notary" if="${sign.enable}">
         <echo message="*** Stapling notarization to Mac Build ***"/>
         <exec executable="/usr/bin/xcrun" dir="${dist.dir}" failonerror="true">
             <arg value="stapler"/>
diff --git a/src/org.hdfgroup.hdfview/hdf/view/HDFView.java b/src/org.hdfgroup.hdfview/hdf/view/HDFView.java
index 5663344b..c1c32925 100644
--- a/src/org.hdfgroup.hdfview/hdf/view/HDFView.java
+++ b/src/org.hdfgroup.hdfview/hdf/view/HDFView.java
@@ -2810,7 +2810,7 @@ else if ("-java.version".equalsIgnoreCase(args[i])) {
             for (int i = args.length - j; i < args.length; i++) {
                 tmpFile = new File(args[i]);
                 if (!tmpFile.isAbsolute())
-                    tmpFile = new File(rootDir, args[i]);
+                    tmpFile = new File(startDir, args[i]);
                 log.trace("main: filelist - file = {} ", tmpFile.getAbsolutePath());
                 log.trace("main: filelist - add file = {} exists={} isFile={} isDir={}", tmpFile,
                           tmpFile.exists(), tmpFile.isFile(), tmpFile.isDirectory());