#!/bin/bash
#
#  make-dmg.sh
#  Zyquo Atlas
#
#  Author: Simon-Pierre Boucher
#  Mail: contact@spboucher.ai
#
#  Builds a signed, notarized, stapled distribution DMG from an already
#  notarized+stapled Zyquo Atlas.app (run `make release` first). Creates a
#  compressed UDZO image with a drag-to-Applications symlink, signs it with the
#  Developer ID, submits to notarytool --wait, and staples. Secrets never printed.
#
#  Usage: make-dmg.sh <app-dir> <identity> <notary-profile> <dmg-path>
#
set -euo pipefail
cd "$(dirname "$0")/.."

APP_DIR="$1"
IDENTITY="$2"
KEYCHAIN_PROFILE="$3"
DMG_PATH="$4"
APP_NAME="$(basename "${APP_DIR%.app}")"

[ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make release' first" >&2; exit 1; }

echo "=== Staging DMG contents ==="
STAGE="$(mktemp -d)/dmg"
mkdir -p "$STAGE"
cp -R "$APP_DIR" "$STAGE/"
ln -s /Applications "$STAGE/Applications"

echo "=== Creating compressed image ==="
rm -f "$DMG_PATH"
hdiutil create -volname "$APP_NAME" -srcfolder "$STAGE" -ov -format UDZO "$DMG_PATH"
rm -rf "$(dirname "$STAGE")"

echo "=== Signing DMG (Developer ID) ==="
codesign --force --timestamp --sign "$IDENTITY" "$DMG_PATH"
codesign --verify --verbose=2 "$DMG_PATH"

echo "=== Notarizing DMG (profile: $KEYCHAIN_PROFILE) ==="
xcrun notarytool submit "$DMG_PATH" --keychain-profile "$KEYCHAIN_PROFILE" --wait

echo "=== Stapling DMG ==="
xcrun stapler staple "$DMG_PATH"
xcrun stapler validate "$DMG_PATH"

echo "=== Gatekeeper assessment (DMG) ==="
spctl -a -t open --context context:primary-signature -vv "$DMG_PATH"

echo "Done: $DMG_PATH is signed, notarized, and stapled."