Release 3.8.0.2: app.zip updates, lock hygiene, secret-safe getState.

scripts/sign-macos.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Optional release signing / notarization for macOS Navis.app / DMG.
+# Requires Apple Developer ID + notarytool credentials in the environment.
+#
+# Usage:
+#   export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
+#   export NAVIS_NOTARY_PROFILE="navis-notary"   # xcrun notarytool store-credentials
+#   ./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg
+#   # or a staged .app:
+#   ./scripts/sign-macos.sh /path/to/Navis.app
+set -euo pipefail
+
+TARGET="${1:-}"
+if [[ -z "$TARGET" || ! -e "$TARGET" ]]; then
+  echo "usage: $0 <Navis.app|Navis.dmg>" >&2
+  exit 2
+fi
+
+IDENTITY="${NAVIS_CODESIGN_IDENTITY:-}"
+if [[ -z "$IDENTITY" ]]; then
+  echo "NAVIS_CODESIGN_IDENTITY is required (Developer ID Application: …)" >&2
+  exit 1
+fi
+
+sign_app() {
+  local app="$1"
+  echo "codesign $app as $IDENTITY"
+  codesign -s "$IDENTITY" --force --deep --options runtime --timestamp "$app"
+  codesign --verify --deep --strict "$app"
+}
+
+if [[ "$TARGET" == *.app || -d "$TARGET" ]]; then
+  sign_app "$TARGET"
+  echo "Signed app. Notarize the DMG that contains it via notarytool."
+  exit 0
+fi
+
+if [[ "$TARGET" == *.dmg ]]; then
+  # Sign nested .app if present after attach is awkward; prefer signing .app before packmac.
+  # Here we submit the DMG for notarization when credentials exist.
+  if [[ -n "${NAVIS_NOTARY_PROFILE:-}" ]]; then
+    echo "notarytool submit $TARGET (profile=$NAVIS_NOTARY_PROFILE)"
+    xcrun notarytool submit "$TARGET" --keychain-profile "$NAVIS_NOTARY_PROFILE" --wait
+    xcrun stapler staple "$TARGET"
+    echo "Notarized + stapled: $TARGET"
+  else
+    echo "DMG ready. Set NAVIS_NOTARY_PROFILE and re-run to notarize."
+    echo "Tip: packmac with NAVIS_CODESIGN_IDENTITY set signs the .app before zip/dmg."
+  fi
+  exit 0
+fi
+
+echo "unsupported target: $TARGET" >&2
+exit 2