52 lines
1.8 KiB
Bash
Executable File
52 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build, Developer ID sign, notarize, staple and zip the macOS app.
|
|
# Distribution must not skip this step; an ad-hoc build is not a release.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
VERSION="${1:-0.2.0}"
|
|
BUILD="${BUILD:-1}"
|
|
APP="Tunnel.app"
|
|
OUT=".local/release"
|
|
ZIP="$OUT/Tunnel-$VERSION.zip"
|
|
KEY="$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8"
|
|
KEY_ID="K5KXMMSB28"
|
|
ISSUER="3e25e5dc-8b75-453f-a71c-c7f3feaac628"
|
|
|
|
FYNE="$(command -v fyne || true)"
|
|
[ -n "$FYNE" ] || FYNE="$(go env GOPATH)/bin/fyne"
|
|
[ -x "$FYNE" ] || { echo "install fyne: go install fyne.io/tools/cmd/fyne@latest"; exit 1; }
|
|
[ -f "$KEY" ] || { echo "missing notary key: $KEY"; exit 1; }
|
|
|
|
IDENT="$(security find-identity -v -p codesigning | awk '/Developer ID Application:/{print $2; exit}')"
|
|
[ -n "$IDENT" ] || { echo "no Developer ID Application identity"; exit 1; }
|
|
|
|
mkdir -p "$OUT" .local/desktop
|
|
go build -o .local/desktop/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
|
|
rm -rf "$APP"
|
|
"$FYNE" package -os darwin \
|
|
-executable .local/desktop/Tunnel \
|
|
-name Tunnel -app-id dev.tzgyn.tunnel \
|
|
-app-version "$VERSION" -app-build "$BUILD" \
|
|
-icon assets/icon.png -release
|
|
|
|
codesign --force --deep --options runtime --timestamp --sign "$IDENT" "$APP"
|
|
codesign --verify --deep --strict --verbose=2 "$APP"
|
|
|
|
ditto -c -k --keepParent "$APP" "$ZIP"
|
|
xcrun notarytool submit "$ZIP" --key "$KEY" --key-id "$KEY_ID" --issuer "$ISSUER" \
|
|
--wait --output-format json
|
|
|
|
xcrun stapler staple "$APP"
|
|
xcrun stapler validate "$APP"
|
|
spctl -a -vv "$APP" 2>&1 | tee "$OUT/spctl.txt"
|
|
grep -q "source=Notarized Developer ID" "$OUT/spctl.txt" || {
|
|
echo "notarization did not produce a Notarized Developer ID app; not releasing"
|
|
exit 1
|
|
}
|
|
|
|
rm -f "$ZIP"
|
|
ditto -c -k --keepParent "$APP" "$ZIP"
|
|
shasum -a 256 "$ZIP" | tee "$OUT/Tunnel-$VERSION.zip.sha256"
|
|
echo "Release app: $ZIP"
|