spb/zyquo-cloud Public MIT

1#!/bin/bash2#3#  notarize.sh4#  Zyquo Cloud5#6#  Author: Simon-Pierre Boucher7#  Mail: contact@spboucher.ai8#9#  Developer ID signing + notarization + stapling (Phase 8), reusing the10#  proven zyquo-term pipeline: identity "Developer ID Application:11#  Simon-Pierre Boucher (3YM54G49SN)" and notarytool keychain profile12#  "MacLustr-Notarize".13#14#  Usage: notarize.sh <app-dir> <identity> <keychain-profile> <entitlements>15#16set -euo pipefail1718APP_DIR="$1"; IDENTITY="$2"; PROFILE="$3"; ENTITLEMENTS="$4"19DIST="$(dirname "$APP_DIR")"20APP_NAME="$(basename "$APP_DIR" .app)"21ZIP_PATH="$DIST/$APP_NAME.zip"22DMG_PATH="$DIST/ZyquoCloud.dmg"2324echo "=== Signing (Developer ID, hardened runtime) ==="25codesign --force --options runtime --timestamp \26    --entitlements "$ENTITLEMENTS" \27    --sign "$IDENTITY" "$APP_DIR"28codesign --verify --deep --strict --verbose=2 "$APP_DIR"29echo "Signature valid."3031echo "=== Notarizing app (profile: $PROFILE) ==="32rm -f "$ZIP_PATH"33ditto -c -k --keepParent "$APP_DIR" "$ZIP_PATH"34xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$PROFILE" --wait35xcrun stapler staple "$APP_DIR"36xcrun stapler validate "$APP_DIR"3738echo "=== Gatekeeper check ==="39spctl -a -vv "$APP_DIR"4041echo "=== Building distributable DMG ==="42rm -f "$DMG_PATH"43DMG_TEMP="$DIST/dmg_temp"44rm -rf "$DMG_TEMP"45mkdir -p "$DMG_TEMP"46cp -R "$APP_DIR" "$DMG_TEMP/"47ln -s /Applications "$DMG_TEMP/Applications"48hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_TEMP" -ov -format UDZO "$DMG_PATH"49rm -rf "$DMG_TEMP"50codesign --force --sign "$IDENTITY" --timestamp "$DMG_PATH"5152echo "=== Notarizing DMG ==="53xcrun notarytool submit "$DMG_PATH" --keychain-profile "$PROFILE" --wait54xcrun stapler staple "$DMG_PATH"5556echo "Release complete: $APP_DIR (stapled) + $DMG_PATH (notarized, stapled)"57