Retire legacy implementations and flatten managed layout

2026-09-21 00:11:32 +02:00
parent dd811a0bb8
commit 08e6c5930a
422 changed files with 252 additions and 38242 deletions
@@ -0,0 +1,74 @@
+#!/bin/zsh
+set -euo pipefail
+
+script_dir=${0:A:h}
+project="$script_dir/VoiceCat.Mac/VoiceCat.Mac.csproj"
+configuration=Release
+dry_run=0
+dotnet_host=${VOICECAT_DOTNET:-}
+
+if [[ -z "$dotnet_host" ]]; then
+  if [[ -x /usr/local/share/dotnet/dotnet ]]; then
+    dotnet_host=/usr/local/share/dotnet/dotnet
+  else
+    dotnet_host=$(command -v dotnet)
+  fi
+fi
+
+if [[ ${1:-} == "--dry-run" ]]; then
+  dry_run=1
+fi
+
+"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false
+built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
+if [[ ! -d "$built_app" ]]; then
+  print -u2 "VoiceCat.app was not produced at $built_app"
+  exit 1
+fi
+
+# Signing mutates every nested runtime binary. Work on a disposable distribution copy so a
+# validation run can never poison MSBuild's incremental output or its signing caches.
+distribution="$script_dir/VoiceCat.Mac/bin/Release/distribution"
+app="$distribution/VoiceCat.app"
+if [[ -e "$app" ]]; then
+  rm -rf "$app"
+fi
+mkdir -p "$distribution"
+ditto "$built_app" "$app"
+
+if (( dry_run )); then
+  # The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the
+  # complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
+  codesign --force --deep --sign - "$app"
+  codesign --verify --deep --strict "$app"
+  spctl --assess --type execute "$app" 2>/dev/null || true
+  print "Validated ad-hoc build: $app"
+  exit 0
+fi
+
+identity=${VOICECAT_CODESIGN_IDENTITY:-}
+if [[ -z "$identity" ]]; then
+  print -u2 "Set VOICECAT_CODESIGN_IDENTITY to a Developer ID Application identity."
+  exit 2
+fi
+
+codesign --force --deep --timestamp --options runtime \
+  --entitlements "$script_dir/VoiceCat.Mac/VoiceCat.Mac.entitlements" \
+  --sign "$identity" "$app"
+codesign --verify --deep --strict --verbose=2 "$app"
+
+archive="$distribution/VoiceCat-macOS-arm64.zip"
+ditto -c -k --keepParent "$app" "$archive"
+
+if [[ -n ${APPLE_ID:-} && -n ${APPLE_TEAM_ID:-} && -n ${APPLE_APP_PASSWORD:-} ]]; then
+  xcrun notarytool submit "$archive" --wait \
+    --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_PASSWORD"
+  xcrun stapler staple "$app"
+  xcrun stapler validate "$app"
+  spctl --assess --type execute --verbose=2 "$app"
+  ditto -c -k --keepParent "$app" "$archive"
+  print "Signed, notarized, and stapled: $archive"
+else
+  print "Signed archive produced without notarization: $archive"
+  print "Set APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD to submit it."
+fi