spb/zyquo-atlas Public License

1#!/bin/bash2#3#  make-dmg.sh4#  Zyquo Atlas5#6#  Author: Simon-Pierre Boucher7#  Mail: contact@spboucher.ai8#9#  Builds a signed, notarized, stapled distribution DMG from an already10#  notarized+stapled Zyquo Atlas.app (run `make release` first). Creates a11#  compressed UDZO image with a drag-to-Applications symlink, signs it with the12#  Developer ID, submits to notarytool --wait, and staples. Secrets never printed.13#14#  Usage: make-dmg.sh <app-dir> <identity> <notary-profile> <dmg-path>15#16set -euo pipefail17cd "$(dirname "$0")/.."1819APP_DIR="$1"20IDENTITY="$2"21KEYCHAIN_PROFILE="$3"22DMG_PATH="$4"23APP_NAME="$(basename "${APP_DIR%.app}")"2425[ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make release' first" >&2; exit 1; }2627echo "=== Staging DMG contents ==="28STAGE="$(mktemp -d)/dmg"29mkdir -p "$STAGE"30cp -R "$APP_DIR" "$STAGE/"31ln -s /Applications "$STAGE/Applications"3233echo "=== Creating compressed image ==="34rm -f "$DMG_PATH"35hdiutil create -volname "$APP_NAME" -srcfolder "$STAGE" -ov -format UDZO "$DMG_PATH"36rm -rf "$(dirname "$STAGE")"3738echo "=== Signing DMG (Developer ID) ==="39codesign --force --timestamp --sign "$IDENTITY" "$DMG_PATH"40codesign --verify --verbose=2 "$DMG_PATH"4142echo "=== Notarizing DMG (profile: $KEYCHAIN_PROFILE) ==="43xcrun notarytool submit "$DMG_PATH" --keychain-profile "$KEYCHAIN_PROFILE" --wait4445echo "=== Stapling DMG ==="46xcrun stapler staple "$DMG_PATH"47xcrun stapler validate "$DMG_PATH"4849echo "=== Gatekeeper assessment (DMG) ==="50spctl -a -t open --context context:primary-signature -vv "$DMG_PATH"5152echo "Done: $DMG_PATH is signed, notarized, and stapled."53