#!/bin/bash
#
#  notarize.sh
#  Zyquo Router
#
#  Author: Simon-Pierre Boucher
#  Mail: contact@spboucher.ai
#
#  Developer ID signing + notarization + stapling, reusing the identity and
#  notarytool keychain profile from the zyquo-term pipeline. Called by
#  `make release` as: notarize.sh <app-dir> <identity> <profile> <entitlements>
#
#  Flow: codesign (hardened runtime, nested binary first) → ditto zip →
#  notarytool submit --wait → staple app → spctl/stapler verify → signed,
#  notarized, stapled DMG.
#
set -euo pipefail

APP_DIR="$1"; IDENTITY="$2"; PROFILE="$3"; ENTITLEMENTS="$4"

APP_NAME="$(basename "$APP_DIR" .app)"
DIST="$(dirname "$APP_DIR")"
ZIP="$DIST/$APP_NAME.zip"
DMG="$DIST/ZyquoRouter.dmg"
EXEC="$APP_DIR/Contents/MacOS/ZyquoRouter"

echo "=== Signing (Developer ID, hardened runtime) ==="
# Nested code first, then the bundle.
codesign --force --options runtime --timestamp \
    --entitlements "$ENTITLEMENTS" \
    --sign "$IDENTITY" "$EXEC"
codesign --force --options runtime --timestamp \
    --entitlements "$ENTITLEMENTS" \
    --sign "$IDENTITY" "$APP_DIR"
codesign --verify --deep --strict --verbose=2 "$APP_DIR"
echo "Signature valid."

echo "=== Notarizing the app (profile: $PROFILE) ==="
rm -f "$ZIP"
ditto -c -k --keepParent "$APP_DIR" "$ZIP"
xcrun notarytool submit "$ZIP" --keychain-profile "$PROFILE" --wait
xcrun stapler staple "$APP_DIR"
rm -f "$ZIP"

echo "=== Verifying ==="
spctl -a -vv "$APP_DIR"
xcrun stapler validate "$APP_DIR"

echo "=== Building signed + notarized DMG ==="
rm -f "$DMG"
DMG_TEMP="$DIST/dmg_temp"
rm -rf "$DMG_TEMP"
mkdir -p "$DMG_TEMP"
cp -R "$APP_DIR" "$DMG_TEMP/"
ln -s /Applications "$DMG_TEMP/Applications"
hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_TEMP" -ov -format UDZO "$DMG"
rm -rf "$DMG_TEMP"
codesign --force --sign "$IDENTITY" --timestamp "$DMG"
xcrun notarytool submit "$DMG" --keychain-profile "$PROFILE" --wait
xcrun stapler staple "$DMG"

echo "=== Done ==="
echo "App: $APP_DIR (notarized + stapled)"
echo "DMG: $DMG (signed + notarized + stapled)"