77 lines
3.0 KiB
Bash
Executable File
77 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# notarize.sh — Submit the signed DMG to Apple Notary Service and staple the
|
|
# returned ticket so users get a green Gatekeeper check offline.
|
|
#
|
|
# Design rationale:
|
|
# - We use `xcrun notarytool` (Xcode 13+). The legacy `altool` is deprecated.
|
|
# - Two credential modes are supported, in order of preference:
|
|
# 1. KEYCHAIN_PROFILE — recommended, created once via:
|
|
# xcrun notarytool store-credentials "snapgo-notary" \
|
|
# --apple-id "<APPLE_ID>" \
|
|
# --team-id "<TEAMID>" \
|
|
# --password "<APP_SPECIFIC_PASSWORD>"
|
|
# 2. APPLE_ID + APPLE_TEAM_ID + APPLE_APP_SPECIFIC_PASSWORD env vars.
|
|
# - After successful notarization we run `xcrun stapler staple` so the app/dmg
|
|
# is verifiable without an internet connection on the user's Mac.
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
|
|
DMG_PATH="${DMG_PATH:-}"
|
|
if [[ -z "${DMG_PATH}" ]]; then
|
|
# Auto-detect the most recent DMG produced by make-dmg.sh
|
|
DMG_PATH="$(ls -1t "${ROOT_DIR}/build/bin/"SnapGo-*.dmg 2>/dev/null | head -1 || true)"
|
|
fi
|
|
if [[ -z "${DMG_PATH}" || ! -f "${DMG_PATH}" ]]; then
|
|
echo "[notarize.sh] ERROR: DMG not found. Set DMG_PATH or run make-dmg.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# -------- Build the credential argv array --------
|
|
# Using array form keeps spaces in passwords / paths safe.
|
|
NOTARY_ARGS=()
|
|
if [[ -n "${KEYCHAIN_PROFILE:-}" ]]; then
|
|
NOTARY_ARGS+=(--keychain-profile "${KEYCHAIN_PROFILE}")
|
|
elif [[ -n "${APPLE_ID:-}" && -n "${APPLE_TEAM_ID:-}" && -n "${APPLE_APP_SPECIFIC_PASSWORD:-}" ]]; then
|
|
NOTARY_ARGS+=(--apple-id "${APPLE_ID}"
|
|
--team-id "${APPLE_TEAM_ID}"
|
|
--password "${APPLE_APP_SPECIFIC_PASSWORD}")
|
|
else
|
|
cat >&2 <<EOF
|
|
[notarize.sh] ERROR: notary credentials not configured.
|
|
|
|
Option A (recommended) — store once in keychain, then export KEYCHAIN_PROFILE:
|
|
xcrun notarytool store-credentials "snapgo-notary" \\
|
|
--apple-id "you@example.com" \\
|
|
--team-id "ABCDE12345" \\
|
|
--password "<app-specific-password>"
|
|
export KEYCHAIN_PROFILE=snapgo-notary
|
|
|
|
Option B — export env vars directly:
|
|
export APPLE_ID="you@example.com"
|
|
export APPLE_TEAM_ID="ABCDE12345"
|
|
export APPLE_APP_SPECIFIC_PASSWORD="abcd-efgh-ijkl-mnop"
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
echo "[notarize.sh] submitting: ${DMG_PATH}"
|
|
xcrun notarytool submit "${DMG_PATH}" "${NOTARY_ARGS[@]}" --wait
|
|
|
|
echo "[notarize.sh] stapling ticket..."
|
|
xcrun stapler staple "${DMG_PATH}"
|
|
xcrun stapler validate "${DMG_PATH}"
|
|
|
|
# Also staple the .app inside, if we still have it on disk — this ensures the
|
|
# offline Gatekeeper check works even if the user copies the app out of the DMG.
|
|
APP_PATH="${ROOT_DIR}/build/bin/SnapGo.app"
|
|
if [[ -d "${APP_PATH}" ]]; then
|
|
echo "[notarize.sh] stapling app bundle..."
|
|
xcrun stapler staple "${APP_PATH}" || true
|
|
fi
|
|
|
|
echo "[notarize.sh] OK -> ${DMG_PATH}"
|