spb/zyquo-atlas Public License

1#!/bin/bash2#3#  notarize.sh4#  Zyquo Atlas5#6#  Author: Simon-Pierre Boucher7#  Mail: contact@spboucher.ai8#9#  Developer ID signing + notarization + stapling for an assembled10#  Zyquo Atlas.app (Phase 8). Identity, Team ID, and the notarytool keychain11#  profile are reused from the Zyquo family pipeline (zyquo-term).12#13#  Usage: notarize.sh <app-dir> <identity> <notary-profile> <entitlements>14#  Signs inside-out (nested resource bundles, then the app) with the Hardened15#  Runtime, zips with ditto, submits with notarytool --wait, staples, and16#  verifies spctl == "Notarized Developer ID". Secrets are never printed.17#18set -euo pipefail19cd "$(dirname "$0")/.."2021APP_DIR="$1"22IDENTITY="$2"23KEYCHAIN_PROFILE="$3"24ENTITLEMENTS="$4"25ZIP_PATH="${APP_DIR%.app}.zip"2627[ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make release' (assembles the bundle first)" >&2; exit 1; }2829echo "=== Signing (Developer ID, Hardened Runtime) ==="30# Sign nested code first (SPM resource bundles carrying the Content/*.js and31# icon), inside-out, so the outer signature stays valid.32find "$APP_DIR/Contents" -name "*.bundle" -maxdepth 3 -print0 2>/dev/null \33  | while IFS= read -r -d '' bundle; do34        echo "  nested: $(basename "$bundle")"35        codesign --force --options runtime --timestamp \36            --entitlements "$ENTITLEMENTS" --sign "$IDENTITY" "$bundle"37    done38# Sign the app bundle (also signs Contents/MacOS/ZyquoAtlas).39codesign --force --options runtime --timestamp \40    --entitlements "$ENTITLEMENTS" --sign "$IDENTITY" "$APP_DIR"41codesign --verify --deep --strict --verbose=2 "$APP_DIR"42echo "Signature valid."4344echo "=== Packaging for notarization (ditto) ==="45rm -f "$ZIP_PATH"46ditto -c -k --keepParent "$APP_DIR" "$ZIP_PATH"4748echo "=== Submitting to notarytool (profile: $KEYCHAIN_PROFILE) ==="49xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$KEYCHAIN_PROFILE" --wait5051echo "=== Stapling ==="52xcrun stapler staple "$APP_DIR"53xcrun stapler validate "$APP_DIR"5455echo "=== Gatekeeper assessment ==="56spctl -a -vvv --type execute "$APP_DIR"5758echo "Done: $APP_DIR is Developer ID–signed, notarized, and stapled."59