spb/zyquo-local Public MIT

1#!/bin/bash2#3#  release.sh4#  Zyquo Local5#6#  Author: Simon-Pierre Boucher7#  Mail: contact@spboucher.ai8#9# Developer ID signing, notarization and stapling for Zyquo Local.10# Identity and notarytool profile reused from the Zyquo Term pipeline.11#12# Usage:13#   scripts/release.sh          # full: build + bundle + sign + notarize + staple + dmg14#   scripts/release.sh sign|notarize|dmg   # individual steps1516set -euo pipefail17cd "$(dirname "$0")/.."1819export SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk20export PATH="$HOME/Developer/Metal.xctoolchain/usr/bin:$PATH"2122IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"23KEYCHAIN_PROFILE="MacLustr-Notarize"24APP_DIR="dist/Zyquo Local.app"25ZIP_NAME="dist/ZyquoLocal.zip"26DMG_NAME="dist/ZyquoLocal.dmg"27ENTITLEMENTS="Support/entitlements.plist"2829build() {30    echo "=== Release build + bundle ==="31    make bundle-release32}3334sign() {35    [ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make bundle-release' first" >&2; exit 1; }36    echo "=== Signing (Developer ID, hardened runtime) ==="37    # Nested code first: resource bundles (the Cmlx bundle seals the MLX38    # metallib — the classic notarization culprit), then the app.39    find "$APP_DIR/Contents/Resources" -maxdepth 1 -name '*.bundle' -print0 |40        while IFS= read -r -d '' bundle; do41            codesign --force --options runtime --timestamp --sign "$IDENTITY" "$bundle"42        done43    codesign --force --options runtime --timestamp \44        --entitlements "$ENTITLEMENTS" \45        --sign "$IDENTITY" "$APP_DIR"46    codesign --verify --deep --strict --verbose=2 "$APP_DIR"47    echo "Signature valid."48}4950notarize() {51    echo "=== Notarizing app (profile: $KEYCHAIN_PROFILE) ==="52    rm -f "$ZIP_NAME"53    ditto -c -k --keepParent "$APP_DIR" "$ZIP_NAME"54    xcrun notarytool submit "$ZIP_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait55    xcrun stapler staple "$APP_DIR"56    xcrun stapler validate "$APP_DIR"57    spctl -a -vv "$APP_DIR"58    echo "App notarized and stapled."59}6061dmg() {62    echo "=== Creating signed + notarized DMG ==="63    rm -f "$DMG_NAME"64    DMG_TEMP="dist/dmg_temp"65    rm -rf "$DMG_TEMP"66    mkdir -p "$DMG_TEMP"67    cp -R "$APP_DIR" "$DMG_TEMP/"68    ln -s /Applications "$DMG_TEMP/Applications"69    hdiutil create -volname "Zyquo Local" -srcfolder "$DMG_TEMP" -ov -format UDZO "$DMG_NAME"70    rm -rf "$DMG_TEMP"71    codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"72    xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait73    xcrun stapler staple "$DMG_NAME"74    echo "DMG ready: $DMG_NAME"75}7677case "${1:-dist}" in78    sign) sign ;;79    notarize) notarize ;;80    dmg) dmg ;;81    dist) build; sign; notarize; dmg ;;82    *) echo "Usage: $0 {sign|notarize|dmg|dist}" >&2; exit 64 ;;83esac84