#!/bin/bash
# Auteur : Simon-Pierre Boucher — contact@spboucher.ai
# Signature Developer ID, DMG et notarisation de KA pour macOS.
# Identité et flux repris du pipeline forge-studio / zyquo-term
# (Team 3YM54G49SN, profil notarytool keychain « MacLustr-Notarize »).
set -euo pipefail
cd "$(dirname "$0")/.."

IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"
KEYCHAIN_PROFILE="MacLustr-Notarize"
APP_DIR="dist/KA.app"
DMG_NAME="dist/KA-macos-2.1.0.dmg"   # publié en téléchargement sur groupe-ka.com

./scripts/package-app.sh release

echo "=== Signature (Developer ID, hardened runtime) ==="
codesign --force --options runtime --timestamp \
    --sign "$IDENTITY" "$APP_DIR/Contents/MacOS/KA"
codesign --force --options runtime --timestamp \
    --sign "$IDENTITY" "$APP_DIR"
codesign --verify --deep --strict --verbose=2 "$APP_DIR"

echo "=== DMG ==="
rm -f "$DMG_NAME"
hdiutil create -volname "KA" -srcfolder "$APP_DIR" -ov -format UDZO "$DMG_NAME"
codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"

echo "=== Notarisation (profil : $KEYCHAIN_PROFILE) ==="
xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait

echo "=== Stapling ==="
xcrun stapler staple "$APP_DIR"
xcrun stapler staple "$DMG_NAME"
xcrun stapler validate "$DMG_NAME"
spctl -a -vv "$APP_DIR"
echo "OK : $DMG_NAME"