TZGyn
234a4226c5
release.sh now submits the zip to Apple's notary via notarytool, staples
the ticket, and repackages, so users no longer hit Gatekeeper warnings.
build-app.sh signs Developer ID builds with the hardened runtime and
unlocks the login keychain to avoid transient signing errors. The private
API key (.p8) is gitignored.
💘 Generated with Crush
Assisted-by: Crush:deepseek-v4-flash-0731
91 lines
2.9 KiB
Bash
Executable File
91 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
if [ "$#" -ne 1 ]; then
|
|
echo "usage: $0 <version> e.g. ./release.sh 1.0.1" >&2
|
|
exit 1
|
|
fi
|
|
VERSION="$1"
|
|
|
|
# Notarization credentials. Configure once, e.g. in ~/.zshrc:
|
|
# export KAPTURE_NOTARY_ASC_PROVIDER="<TeamID>"
|
|
# export KAPTURE_NOTARY_API_KEY_PATH="$HOME/.config/kapture/AuthKey_XXXX.p8"
|
|
# export KAPTURE_NOTARY_API_KEY_ID="<KeyID>"
|
|
# export KAPTURE_NOTARY_API_ISSUER="<IssuerID>"
|
|
# If these are unset (or KAPTURE_SKIP_NOTARY=1), release.sh builds, zips, and stops
|
|
# there — the zip is signed with the Developer ID identity but NOT notarized.
|
|
|
|
./build-app.sh
|
|
|
|
mkdir -p dist
|
|
rm -f dist/Kapture.zip
|
|
ditto -c -k --keepParent Kapture.app dist/Kapture.zip
|
|
|
|
if [ -n "${KAPTURE_SKIP_NOTARY:-}" ]; then
|
|
echo
|
|
echo "Skipping notarization (KAPTURE_SKIP_NOTARY set)."
|
|
shasum -a 256 dist/Kapture.zip
|
|
echo
|
|
echo "Tag and release with:"
|
|
echo " git tag v$VERSION && git push origin v$VERSION"
|
|
echo "Attach dist/Kapture.zip to the GitHub release manually."
|
|
exit 0
|
|
fi
|
|
|
|
REQUIRED_VARS="KAPTURE_NOTARY_ASC_PROVIDER KAPTURE_NOTARY_API_KEY_PATH KAPTURE_NOTARY_API_KEY_ID KAPTURE_NOTARY_API_ISSUER"
|
|
MISSING=""
|
|
for v in $REQUIRED_VARS; do
|
|
if [ -z "${!v:-}" ]; then
|
|
MISSING="$MISSING $v"
|
|
fi
|
|
done
|
|
if [ -n "$MISSING" ]; then
|
|
echo "Notarization skipped — missing env var(s):$MISSING (see header comments)." >&2
|
|
shasum -a 256 dist/Kapture.zip
|
|
echo
|
|
echo "The zip above is signed but NOT notarized; Gatekeeper will warn users until it is."
|
|
echo "Set the KAPTURE_NOTARY_* variables and re-run ./release.sh $VERSION."
|
|
exit 0
|
|
fi
|
|
|
|
if ! command -v xcrun >/dev/null 2>&1 || ! xcrun --find notarytool >/dev/null 2>&1; then
|
|
echo "Notarization skipped — xcrun notarytool not found (requires Xcode 13+)." >&2
|
|
shasum -a 256 dist/Kapture.zip
|
|
exit 0
|
|
fi
|
|
|
|
echo "Submitting to Apple for notarization (first run can take minutes)..."
|
|
xcrun notarytool submit dist/Kapture.zip \
|
|
--key "$KAPTURE_NOTARY_API_KEY_PATH" \
|
|
--key-id "$KAPTURE_NOTARY_API_KEY_ID" \
|
|
--issuer "$KAPTURE_NOTARY_API_ISSUER" \
|
|
--wait \
|
|
--output-format json > notary-result.json
|
|
|
|
STATUS=$(jq -r '.status' notary-result.json 2>/dev/null || echo "unknown")
|
|
if [ "$STATUS" != "Accepted" ]; then
|
|
echo "Notarization failed with status: $STATUS" >&2
|
|
if [ -f notary-result.json ]; then
|
|
cat notary-result.json >&2
|
|
rm -f notary-result.json
|
|
fi
|
|
exit 1
|
|
fi
|
|
rm -f notary-result.json
|
|
|
|
echo "Notarization accepted — stapling ticket onto the app..."
|
|
xcrun stapler staple Kapture.app
|
|
xcrun stapler validate Kapture.app
|
|
|
|
rm -f dist/Kapture.zip
|
|
ditto -c -k --keepParent Kapture.app dist/Kapture.zip
|
|
|
|
echo
|
|
echo "Done — notarized."
|
|
shasum -a 256 dist/Kapture.zip
|
|
echo
|
|
echo "Tag and release with:"
|
|
echo " git tag v$VERSION && git push origin v$VERSION"
|
|
echo "Attach dist/Kapture.zip to the GitHub release manually; the Homebrew cask is ready."
|