#!/bin/bash
# Build, Developer ID sign, notarize, staple and zip the macOS app.
# Distribution must not skip this step; an ad-hoc build is not a release.
set -euo pipefail
cd "$(dirname "$0")/.."

VERSION="${1:-0.2.0}"
BUILD="${BUILD:-1}"
APP="Tunnel.app"
OUT=".local/release"
ZIP="$OUT/Tunnel-$VERSION.zip"
KEY="$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8"
KEY_ID="K5KXMMSB28"
ISSUER="3e25e5dc-8b75-453f-a71c-c7f3feaac628"

FYNE="$(command -v fyne || true)"
[ -n "$FYNE" ] || FYNE="$(go env GOPATH)/bin/fyne"
[ -x "$FYNE" ] || { echo "install fyne: go install fyne.io/tools/cmd/fyne@latest"; exit 1; }
[ -f "$KEY" ] || { echo "missing notary key: $KEY"; exit 1; }

IDENT="$(security find-identity -v -p codesigning | awk '/Developer ID Application:/{print $2; exit}')"
[ -n "$IDENT" ] || { echo "no Developer ID Application identity"; exit 1; }

mkdir -p "$OUT"
go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
rm -rf "$APP"
"$FYNE" package -os darwin \
  -executable .local/Tunnel \
  -name Tunnel -app-id dev.tzgyn.tunnel \
  -app-version "$VERSION" -app-build "$BUILD" \
  -icon assets/icon.png -release

codesign --force --deep --options runtime --timestamp --sign "$IDENT" "$APP"
codesign --verify --deep --strict --verbose=2 "$APP"

ditto -c -k --keepParent "$APP" "$ZIP"
xcrun notarytool submit "$ZIP" --key "$KEY" --key-id "$KEY_ID" --issuer "$ISSUER" \
  --wait --output-format json

xcrun stapler staple "$APP"
xcrun stapler validate "$APP"
spctl -a -vv "$APP" 2>&1 | tee "$OUT/spctl.txt"
grep -q "source=Notarized Developer ID" "$OUT/spctl.txt" || {
  echo "notarization did not produce a Notarized Developer ID app; not releasing"
  exit 1
}

rm -f "$ZIP"
ditto -c -k --keepParent "$APP" "$ZIP"
shasum -a 256 "$ZIP" | tee "$OUT/Tunnel-$VERSION.zip.sha256"
echo "Release app: $ZIP"