32 lines
1.1 KiB
Bash
Executable file
32 lines
1.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
source "$(dirname "$0")/common.sh"
|
|
macos_only
|
|
|
|
if [[ ! -d "$APP_PATH" ]]; then
|
|
echo "Bundle missing: $APP_PATH" >&2
|
|
exit 1
|
|
fi
|
|
identity="${MACOC_CODESIGN_IDENTITY:-}"
|
|
if [[ -z "$identity" ]]; then
|
|
if security find-identity -v -p codesigning 2>/dev/null |
|
|
grep -F '"macoc Local Signing"' >/dev/null; then
|
|
identity="macoc Local Signing"
|
|
else
|
|
identity="-"
|
|
echo "WARNING: ad-hoc signing may require Accessibility reapproval after rebuilding." >&2
|
|
echo "Run bash scripts/setup-signing.sh for a persistent local identity." >&2
|
|
fi
|
|
fi
|
|
|
|
echo "Signing identity: $identity"
|
|
if [[ "$identity" == Developer\ ID\ Application:* ]]; then
|
|
# Developer ID builds require Hardened Runtime and a secure timestamp.
|
|
# Notarization still requires a separate submission with Apple credentials.
|
|
codesign --force --sign "$identity" --identifier "$BUNDLE_ID" \
|
|
--options runtime --timestamp "$APP_PATH"
|
|
else
|
|
codesign --force --sign "$identity" --identifier "$BUNDLE_ID" \
|
|
--timestamp=none "$APP_PATH"
|
|
fi
|
|
codesign --verify --deep --strict "$APP_PATH"
|
|
codesign --display --requirements - "$APP_PATH" 2>&1 | head -15
|