#!/bin/bash
# Baut Mawari signiert und notarisiert als DMG (zum Verschicken und für Updates).
#
# Voraussetzungen (einmalig):
#   - Developer-ID-Application-Zertifikat im Login-Schlüsselbund (Team XY4C2RG3L5)
#   - notarytool-Profil. Gleiches Team wie Patchcord, daher dessen Profil als Standard:
#       NOTARY_PROFILE=patchcord-notary
#
# Aufruf: bash Tools/build-dmg.sh
set -euo pipefail
cd "$(dirname "$0")/.."

TEAM_ID="XY4C2RG3L5"
NOTARY_PROFILE="${NOTARY_PROFILE:-patchcord-notary}"
VERSION=$(grep -m1 'MARKETING_VERSION:' project.yml | sed -E 's/.*MARKETING_VERSION: *"?([^"]+)"?/\1/')
APP_NAME="Mawari"
BUILD_DIR="build"
ARCHIVE_PATH="$BUILD_DIR/Mawari.xcarchive"
DMG_STAGING="$BUILD_DIR/dmg-staging"
DMG_PATH="$BUILD_DIR/${APP_NAME}-${VERSION}.dmg"
SIGN_ID="Developer ID Application: Samuel Zielke ($TEAM_ID)"

echo "==> Version $VERSION, Team $TEAM_ID, Notarisierung über Profil $NOTARY_PROFILE"
xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \
  || { echo "Fehler: notarytool-Profil $NOTARY_PROFILE fehlt (xcrun notarytool store-credentials …)." >&2; exit 1; }

rm -rf "$ARCHIVE_PATH" "$DMG_STAGING" "$DMG_PATH"
mkdir -p "$DMG_STAGING"

command -v xcodegen >/dev/null && xcodegen >/dev/null

echo "==> Archiviere (Release, Universal)"
xcodebuild -project Mawari.xcodeproj -scheme Mawari -configuration Release \
  -archivePath "$ARCHIVE_PATH" -derivedDataPath "$BUILD_DIR/dd-release" \
  CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="Developer ID Application" DEVELOPMENT_TEAM="$TEAM_ID" \
  archive -quiet

APP_PATH="$ARCHIVE_PATH/Products/Applications/${APP_NAME}.app"
[ -d "$APP_PATH" ] || { echo "Fehler: $APP_PATH nicht gefunden." >&2; exit 1; }

# Sparkles Hilfsprogramme signiert Xcode nur ad-hoc – die Notarisierung lehnt das ab.
# Von innen nach außen nachsignieren (siehe drop.look/Tools/build-beta-dmg.sh).
echo "==> Sparkle nachsignieren"
resign() { [ -e "$1" ] || return 0; codesign --force --timestamp --options runtime --sign "$SIGN_ID" "$1"; }
SPARKLE="$APP_PATH/Contents/Frameworks/Sparkle.framework"
if [ -d "$SPARKLE" ]; then
  V="$SPARKLE/Versions/Current"
  resign "$V/XPCServices/Downloader.xpc"
  resign "$V/XPCServices/Installer.xpc"
  resign "$V/Autoupdate"
  resign "$V/Updater.app"
  resign "$SPARKLE"
fi
echo "==> App signieren"
codesign --force --timestamp --options runtime --entitlements App/Mawari.entitlements --sign "$SIGN_ID" "$APP_PATH"
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
lipo -archs "$APP_PATH/Contents/MacOS/$APP_NAME"

echo "==> App notarisieren (dauert ein paar Minuten)"
ZIP_PATH="$BUILD_DIR/${APP_NAME}-notarize.zip"
rm -f "$ZIP_PATH"
ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
xcrun stapler staple "$APP_PATH"
spctl --assess --type execute --verbose "$APP_PATH"

echo "==> DMG bauen"
cp -R "$APP_PATH" "$DMG_STAGING/"
ln -s /Applications "$DMG_STAGING/Programme"
hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH" -quiet
codesign --force --timestamp --sign "$SIGN_ID" "$DMG_PATH"

echo "==> DMG notarisieren (damit sie auch per Mail verschickt ohne Warnung aufgeht)"
xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
xcrun stapler staple "$DMG_PATH"
spctl --assess --type open --context context:primary-signature --verbose "$DMG_PATH"

echo "==> Fertig: $DMG_PATH"
echo "Für ein Online-Update danach: bash Tools/make-appcast.sh && bash Tools/publish.sh"