TZGyn
88780f7701
A missing key or a skipped notarization used to exit 0 with a sha256,
which made an unnotarized build look publishable. Releases now fail
loudly unless spctl confirms a notarized build, and the skip flag warns
that its output must not be published.
💘 Generated with Crush
Assisted-by: Crush:kimi-k3
83 lines
2.8 KiB
Bash
Executable File
83 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
if [ "$#" -ne 1 ]; then
|
|
echo "usage: $0 <version> e.g. ./release.sh 0.1.0" >&2
|
|
exit 1
|
|
fi
|
|
VERSION="$1"
|
|
|
|
# Notarization credentials. Configure once, e.g. in ~/.zshrc:
|
|
# export PROMPT_NOTARY_API_KEY_PATH="$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8"
|
|
# export PROMPT_NOTARY_API_KEY_ID="K5KXMMSB28"
|
|
# export PROMPT_NOTARY_API_ISSUER="3e25e5dc-8b75-453f-a71c-c7f3feaac628"
|
|
# If these are unset (or PROMPT_SKIP_NOTARY=1), release.sh builds, zips,
|
|
# and stops there — the zip is signed but NOT notarized.
|
|
|
|
./build-app.sh "$VERSION"
|
|
|
|
mkdir -p dist
|
|
rm -f dist/Prompt.zip
|
|
ditto -c -k --keepParent Prompt.app dist/Prompt.zip
|
|
|
|
if [ -n "${PROMPT_SKIP_NOTARY:-}" ]; then
|
|
echo
|
|
echo "!! NOTARIZATION SKIPPED — this zip is NOT FOR PUBLICATION."
|
|
echo "!! It is signed but Gatekeeper will reject it on other Macs."
|
|
shasum -a 256 dist/Prompt.zip
|
|
exit 0
|
|
fi
|
|
|
|
# Default to the shared TZGyn App Store Connect key (same one Kapture uses).
|
|
PROMPT_NOTARY_API_KEY_PATH="${PROMPT_NOTARY_API_KEY_PATH:-$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8}"
|
|
PROMPT_NOTARY_API_KEY_ID="${PROMPT_NOTARY_API_KEY_ID:-K5KXMMSB28}"
|
|
PROMPT_NOTARY_API_ISSUER="${PROMPT_NOTARY_API_ISSUER:-3e25e5dc-8b75-453f-a71c-c7f3feaac628}"
|
|
|
|
if [ ! -f "$PROMPT_NOTARY_API_KEY_PATH" ]; then
|
|
echo "ERROR: notarization key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
|
|
echo "Notarization is required for a release; set PROMPT_SKIP_NOTARY=1 only" >&2
|
|
echo "for a local dev build that must not be published." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v xcrun >/dev/null 2>&1 || ! xcrun --find notarytool >/dev/null 2>&1; then
|
|
echo "ERROR: xcrun notarytool not found (requires Xcode 13+)." >&2
|
|
echo "Notarization is required for a release." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Submitting to Apple for notarization (first run can take minutes)..."
|
|
xcrun notarytool submit dist/Prompt.zip \
|
|
--key "$PROMPT_NOTARY_API_KEY_PATH" \
|
|
--key-id "$PROMPT_NOTARY_API_KEY_ID" \
|
|
--issuer "$PROMPT_NOTARY_API_ISSUER" \
|
|
--wait \
|
|
--output-format json > notary-result.json
|
|
|
|
STATUS=$(jq -r '.status' notary-result.json 2>/dev/null || echo "unknown")
|
|
if [ "$STATUS" != "Accepted" ]; then
|
|
echo "Notarization failed with status: $STATUS" >&2
|
|
cat notary-result.json >&2 || true
|
|
rm -f notary-result.json
|
|
exit 1
|
|
fi
|
|
rm -f notary-result.json
|
|
|
|
echo "Notarization accepted — stapling ticket onto the app..."
|
|
xcrun stapler staple Prompt.app
|
|
xcrun stapler validate Prompt.app
|
|
|
|
rm -f dist/Prompt.zip
|
|
ditto -c -k --keepParent Prompt.app dist/Prompt.zip
|
|
|
|
if ! spctl -a -vv Prompt.app 2>&1 | grep -q "source=Notarized Developer ID"; then
|
|
echo "ERROR: spctl does not report a notarized build — do not publish this." >&2
|
|
spctl -a -vv Prompt.app >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo "Done — notarized and stapled."
|
|
shasum -a 256 dist/Prompt.zip
|