|
|
#!/bin/bash
|
|
|
# Baut Mawari signiert und notarisiert als DMG (zum Verschicken und für Updates).
|
|
|
#
|
|
|
# Voraussetzungen (einmalig):
|
|
|
# - Developer-ID-Application-Zertifikat im Login-Schlüsselbund (Team XY4C2RG3L5)
|
|
|
# - notarytool-Profil. Gleiches Team wie Patchcord, daher dessen Profil als Standard:
|
|
|
# NOTARY_PROFILE=patchcord-notary
|
|
|
#
|
|
|
# Aufruf: bash Tools/build-dmg.sh
|
|
|
set -euo pipefail
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
|
|
TEAM_ID="XY4C2RG3L5"
|
|
|
NOTARY_PROFILE="${NOTARY_PROFILE:-patchcord-notary}"
|
|
|
VERSION=$(grep -m1 'MARKETING_VERSION:' project.yml | sed -E 's/.*MARKETING_VERSION: *"?([^"]+)"?/\1/')
|
|
|
APP_NAME="Mawari"
|
|
|
BUILD_DIR="build"
|
|
|
ARCHIVE_PATH="$BUILD_DIR/Mawari.xcarchive"
|
|
|
DMG_STAGING="$BUILD_DIR/dmg-staging"
|
|
|
DMG_PATH="$BUILD_DIR/${APP_NAME}-${VERSION}.dmg"
|
|
|
SIGN_ID="Developer ID Application: Samuel Zielke ($TEAM_ID)"
|
|
|
|
|
|
echo "==> Version $VERSION, Team $TEAM_ID, Notarisierung über Profil $NOTARY_PROFILE"
|
|
|
xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null 2>&1 \
|
|
|
|| { echo "Fehler: notarytool-Profil $NOTARY_PROFILE fehlt (xcrun notarytool store-credentials …)." >&2; exit 1; }
|
|
|
|
|
|
rm -rf "$ARCHIVE_PATH" "$DMG_STAGING" "$DMG_PATH"
|
|
|
mkdir -p "$DMG_STAGING"
|
|
|
|
|
|
command -v xcodegen >/dev/null && xcodegen >/dev/null
|
|
|
|
|
|
echo "==> Archiviere (Release, Universal)"
|
|
|
xcodebuild -project Mawari.xcodeproj -scheme Mawari -configuration Release \
|
|
|
-archivePath "$ARCHIVE_PATH" -derivedDataPath "$BUILD_DIR/dd-release" \
|
|
|
CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="Developer ID Application" DEVELOPMENT_TEAM="$TEAM_ID" \
|
|
|
archive -quiet
|
|
|
|
|
|
APP_PATH="$ARCHIVE_PATH/Products/Applications/${APP_NAME}.app"
|
|
|
[ -d "$APP_PATH" ] || { echo "Fehler: $APP_PATH nicht gefunden." >&2; exit 1; }
|
|
|
|
|
|
# Sparkles Hilfsprogramme signiert Xcode nur ad-hoc – die Notarisierung lehnt das ab.
|
|
|
# Von innen nach außen nachsignieren (siehe drop.look/Tools/build-beta-dmg.sh).
|
|
|
echo "==> Sparkle nachsignieren"
|
|
|
resign() { [ -e "$1" ] || return 0; codesign --force --timestamp --options runtime --sign "$SIGN_ID" "$1"; }
|
|
|
SPARKLE="$APP_PATH/Contents/Frameworks/Sparkle.framework"
|
|
|
if [ -d "$SPARKLE" ]; then
|
|
|
V="$SPARKLE/Versions/Current"
|
|
|
resign "$V/XPCServices/Downloader.xpc"
|
|
|
resign "$V/XPCServices/Installer.xpc"
|
|
|
resign "$V/Autoupdate"
|
|
|
resign "$V/Updater.app"
|
|
|
resign "$SPARKLE"
|
|
|
fi
|
|
|
echo "==> App signieren"
|
|
|
codesign --force --timestamp --options runtime --entitlements App/Mawari.entitlements --sign "$SIGN_ID" "$APP_PATH"
|
|
|
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
|
|
|
lipo -archs "$APP_PATH/Contents/MacOS/$APP_NAME"
|
|
|
|
|
|
echo "==> App notarisieren (dauert ein paar Minuten)"
|
|
|
ZIP_PATH="$BUILD_DIR/${APP_NAME}-notarize.zip"
|
|
|
rm -f "$ZIP_PATH"
|
|
|
ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
|
|
|
xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
|
|
|
xcrun stapler staple "$APP_PATH"
|
|
|
spctl --assess --type execute --verbose "$APP_PATH"
|
|
|
|
|
|
echo "==> DMG bauen"
|
|
|
cp -R "$APP_PATH" "$DMG_STAGING/"
|
|
|
ln -s /Applications "$DMG_STAGING/Programme"
|
|
|
hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH" -quiet
|
|
|
codesign --force --timestamp --sign "$SIGN_ID" "$DMG_PATH"
|
|
|
|
|
|
echo "==> DMG notarisieren (damit sie auch per Mail verschickt ohne Warnung aufgeht)"
|
|
|
xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
|
|
|
xcrun stapler staple "$DMG_PATH"
|
|
|
spctl --assess --type open --context context:primary-signature --verbose "$DMG_PATH"
|
|
|
|
|
|
echo "==> Fertig: $DMG_PATH"
|
|
|
echo "Für ein Online-Update danach: bash Tools/make-appcast.sh && bash Tools/publish.sh"
|
