55 lines
1.8 KiB
Bash
Executable File
55 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Optional release signing / notarization for macOS Navis.app / DMG.
|
|
# Requires Apple Developer ID + notarytool credentials in the environment.
|
|
#
|
|
# Usage:
|
|
# export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
|
|
# export NAVIS_NOTARY_PROFILE="navis-notary" # xcrun notarytool store-credentials
|
|
# ./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg
|
|
# # or a staged .app:
|
|
# ./scripts/sign-macos.sh /path/to/Navis.app
|
|
set -euo pipefail
|
|
|
|
TARGET="${1:-}"
|
|
if [[ -z "$TARGET" || ! -e "$TARGET" ]]; then
|
|
echo "usage: $0 <Navis.app|Navis.dmg>" >&2
|
|
exit 2
|
|
fi
|
|
|
|
IDENTITY="${NAVIS_CODESIGN_IDENTITY:-}"
|
|
if [[ -z "$IDENTITY" ]]; then
|
|
echo "NAVIS_CODESIGN_IDENTITY is required (Developer ID Application: …)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sign_app() {
|
|
local app="$1"
|
|
echo "codesign $app as $IDENTITY"
|
|
codesign -s "$IDENTITY" --force --deep --options runtime --timestamp "$app"
|
|
codesign --verify --deep --strict "$app"
|
|
}
|
|
|
|
if [[ "$TARGET" == *.app || -d "$TARGET" ]]; then
|
|
sign_app "$TARGET"
|
|
echo "Signed app. Notarize the DMG that contains it via notarytool."
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$TARGET" == *.dmg ]]; then
|
|
# Sign nested .app if present after attach is awkward; prefer signing .app before packmac.
|
|
# Here we submit the DMG for notarization when credentials exist.
|
|
if [[ -n "${NAVIS_NOTARY_PROFILE:-}" ]]; then
|
|
echo "notarytool submit $TARGET (profile=$NAVIS_NOTARY_PROFILE)"
|
|
xcrun notarytool submit "$TARGET" --keychain-profile "$NAVIS_NOTARY_PROFILE" --wait
|
|
xcrun stapler staple "$TARGET"
|
|
echo "Notarized + stapled: $TARGET"
|
|
else
|
|
echo "DMG ready. Set NAVIS_NOTARY_PROFILE and re-run to notarize."
|
|
echo "Tip: packmac with NAVIS_CODESIGN_IDENTITY set signs the .app before zip/dmg."
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
echo "unsupported target: $TARGET" >&2
|
|
exit 2
|