Add connect-on-launch and notarized desktop release packaging

scripts/release-desktop-app.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# Build, Developer ID sign, notarize, staple and zip the macOS app.
+# Distribution must not skip this step; an ad-hoc build is not a release.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VERSION="${1:-0.2.0}"
+BUILD="${BUILD:-1}"
+APP="Tunnel.app"
+OUT=".local/release"
+ZIP="$OUT/Tunnel-$VERSION.zip"
+KEY="$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8"
+KEY_ID="K5KXMMSB28"
+ISSUER="3e25e5dc-8b75-453f-a71c-c7f3feaac628"
+
+FYNE="$(command -v fyne || true)"
+[ -n "$FYNE" ] || FYNE="$(go env GOPATH)/bin/fyne"
+[ -x "$FYNE" ] || { echo "install fyne: go install fyne.io/tools/cmd/fyne@latest"; exit 1; }
+[ -f "$KEY" ] || { echo "missing notary key: $KEY"; exit 1; }
+
+IDENT="$(security find-identity -v -p codesigning | awk '/Developer ID Application:/{print $2; exit}')"
+[ -n "$IDENT" ] || { echo "no Developer ID Application identity"; exit 1; }
+
+mkdir -p "$OUT"
+go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+rm -rf "$APP"
+"$FYNE" package -os darwin \
+  -executable .local/Tunnel \
+  -name Tunnel -app-id dev.tzgyn.tunnel \
+  -app-version "$VERSION" -app-build "$BUILD" \
+  -icon assets/icon.png -release
+
+codesign --force --deep --options runtime --timestamp --sign "$IDENT" "$APP"
+codesign --verify --deep --strict --verbose=2 "$APP"
+
+ditto -c -k --keepParent "$APP" "$ZIP"
+xcrun notarytool submit "$ZIP" --key "$KEY" --key-id "$KEY_ID" --issuer "$ISSUER" \
+  --wait --output-format json
+
+xcrun stapler staple "$APP"
+xcrun stapler validate "$APP"
+spctl -a -vv "$APP" 2>&1 | tee "$OUT/spctl.txt"
+grep -q "source=Notarized Developer ID" "$OUT/spctl.txt" || {
+  echo "notarization did not produce a Notarized Developer ID app; not releasing"
+  exit 1
+}
+
+rm -f "$ZIP"
+ditto -c -k --keepParent "$APP" "$ZIP"
+shasum -a 256 "$ZIP" | tee "$OUT/Tunnel-$VERSION.zip.sha256"
+echo "Release app: $ZIP"