#!/bin/bash
#
#  notarize.sh
#  Zyquo Cloud
#
#  Author: Simon-Pierre Boucher
#  Mail: contact@spboucher.ai
#
#  Developer ID signing + notarization + stapling (Phase 8), reusing the
#  proven zyquo-term pipeline: identity "Developer ID Application:
#  Simon-Pierre Boucher (3YM54G49SN)" and notarytool keychain profile
#  "MacLustr-Notarize".
#
#  Usage: notarize.sh <app-dir> <identity> <keychain-profile> <entitlements>
#
set -euo pipefail

APP_DIR="$1"; IDENTITY="$2"; PROFILE="$3"; ENTITLEMENTS="$4"
DIST="$(dirname "$APP_DIR")"
APP_NAME="$(basename "$APP_DIR" .app)"
ZIP_PATH="$DIST/$APP_NAME.zip"
DMG_PATH="$DIST/ZyquoCloud.dmg"

echo "=== Signing (Developer ID, hardened runtime) ==="
codesign --force --options runtime --timestamp \
    --entitlements "$ENTITLEMENTS" \
    --sign "$IDENTITY" "$APP_DIR"
codesign --verify --deep --strict --verbose=2 "$APP_DIR"
echo "Signature valid."

echo "=== Notarizing app (profile: $PROFILE) ==="
rm -f "$ZIP_PATH"
ditto -c -k --keepParent "$APP_DIR" "$ZIP_PATH"
xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$PROFILE" --wait
xcrun stapler staple "$APP_DIR"
xcrun stapler validate "$APP_DIR"

echo "=== Gatekeeper check ==="
spctl -a -vv "$APP_DIR"

echo "=== Building distributable DMG ==="
rm -f "$DMG_PATH"
DMG_TEMP="$DIST/dmg_temp"
rm -rf "$DMG_TEMP"
mkdir -p "$DMG_TEMP"
cp -R "$APP_DIR" "$DMG_TEMP/"
ln -s /Applications "$DMG_TEMP/Applications"
hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_TEMP" -ov -format UDZO "$DMG_PATH"
rm -rf "$DMG_TEMP"
codesign --force --sign "$IDENTITY" --timestamp "$DMG_PATH"

echo "=== Notarizing DMG ==="
xcrun notarytool submit "$DMG_PATH" --keychain-profile "$PROFILE" --wait
xcrun stapler staple "$DMG_PATH"

echo "Release complete: $APP_DIR (stapled) + $DMG_PATH (notarized, stapled)"