spb/os-vault Public

1#!/bin/bash2#3#  release.sh4#  OS Vault5#6#  Author: Simon-Pierre Boucher7#  Mail: contact@spboucher.ai8#9# Developer ID signing, notarization and stapling for OS Vault.10# Identity and notarytool profile reused from the Zyquo Local/Term pipeline.11#12# Usage:13#   scripts/release.sh          # full: build + bundle + sign + notarize + staple + dmg14#   scripts/release.sh sign|notarize|dmg   # individual steps1516set -euo pipefail17cd "$(dirname "$0")/.."1819IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"20KEYCHAIN_PROFILE="MacLustr-Notarize"21APP_DIR="dist/OS Vault.app"22ZIP_NAME="dist/OSVault.zip"23DMG_NAME="dist/OSVault.dmg"24ENTITLEMENTS="Support/entitlements.plist"2526build() {27    echo "=== Release build + bundle ==="28    make bundle-release29}3031sign() {32    [ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make bundle-release' first" >&2; exit 1; }33    echo "=== Signing (Developer ID, hardened runtime, sandboxed) ==="34    codesign --force --options runtime --timestamp \35        --entitlements "$ENTITLEMENTS" \36        --sign "$IDENTITY" "$APP_DIR"37    codesign --verify --deep --strict --verbose=2 "$APP_DIR"38    echo "Signature valid."39}4041notarize() {42    echo "=== Notarizing app (profile: $KEYCHAIN_PROFILE) ==="43    rm -f "$ZIP_NAME"44    ditto -c -k --keepParent "$APP_DIR" "$ZIP_NAME"45    xcrun notarytool submit "$ZIP_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait46    xcrun stapler staple "$APP_DIR"47    xcrun stapler validate "$APP_DIR"48    spctl -a -vv "$APP_DIR"49    echo "App notarized and stapled."50}5152dmg() {53    echo "=== Creating signed + notarized DMG (custom volume icon) ==="54    rm -f "$DMG_NAME"55    DMG_TEMP="dist/dmg_temp"56    DMG_RW="dist/OSVault-rw.dmg"57    rm -rf "$DMG_TEMP" "$DMG_RW"58    mkdir -p "$DMG_TEMP"59    cp -R "$APP_DIR" "$DMG_TEMP/"60    ln -s /Applications "$DMG_TEMP/Applications"61    cp assets/icon/AppIcon.icns "$DMG_TEMP/.VolumeIcon.icns"6263    # Read-write image first so the volume's custom-icon flag can be set,64    # then compress to the final UDZO.65    hdiutil create -volname "OS Vault" -srcfolder "$DMG_TEMP" -ov -format UDRW "$DMG_RW"66    MOUNT_DIR=$(hdiutil attach "$DMG_RW" -nobrowse | awk -F'\t' '/\/Volumes\//{print $NF; exit}')67    SetFile -a C "$MOUNT_DIR"68    hdiutil detach "$MOUNT_DIR" -quiet69    hdiutil convert "$DMG_RW" -format UDZO -o "$DMG_NAME"70    rm -rf "$DMG_TEMP" "$DMG_RW"7172    codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"73    xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait74    xcrun stapler staple "$DMG_NAME"75    echo "DMG ready: $DMG_NAME"76}7778case "${1:-dist}" in79    sign) sign ;;80    notarize) notarize ;;81    dmg) dmg ;;82    dist) build; sign; notarize; dmg ;;83    *) echo "Usage: $0 {sign|notarize|dmg|dist}" >&2; exit 64 ;;84esac85