Talon
d0a72176ba
.NET port / test (macos-latest) (push) Canceled after 0s
.NET port / test (ubuntu-24.04) (push) Canceled after 0s
.NET port / test (windows-latest) (push) Canceled after 0s
.NET port / apple-client (push) Canceled after 0s
.NET port / cpp-conformance (push) Canceled after 0s
75 lines
2.5 KiB
Bash
75 lines
2.5 KiB
Bash
#!/bin/zsh
|
|
set -euo pipefail
|
|
|
|
script_dir=${0:A:h}
|
|
project="$script_dir/VoiceCat.Mac/VoiceCat.Mac.csproj"
|
|
configuration=Release
|
|
dry_run=0
|
|
dotnet_host=${VOICECAT_DOTNET:-}
|
|
|
|
if [[ -z "$dotnet_host" ]]; then
|
|
if [[ -x /usr/local/share/dotnet/dotnet ]]; then
|
|
dotnet_host=/usr/local/share/dotnet/dotnet
|
|
else
|
|
dotnet_host=$(command -v dotnet)
|
|
fi
|
|
fi
|
|
|
|
if [[ ${1:-} == "--dry-run" ]]; then
|
|
dry_run=1
|
|
fi
|
|
|
|
"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false
|
|
built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
|
|
if [[ ! -d "$built_app" ]]; then
|
|
print -u2 "VoiceCat.app was not produced at $built_app"
|
|
exit 1
|
|
fi
|
|
|
|
# Signing mutates every nested runtime binary. Work on a disposable distribution copy so a
|
|
# validation run can never poison MSBuild's incremental output or its signing caches.
|
|
distribution="$script_dir/VoiceCat.Mac/bin/Release/distribution"
|
|
app="$distribution/VoiceCat.app"
|
|
if [[ -e "$app" ]]; then
|
|
rm -rf "$app"
|
|
fi
|
|
mkdir -p "$distribution"
|
|
ditto "$built_app" "$app"
|
|
|
|
if (( dry_run )); then
|
|
# The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the
|
|
# complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
|
|
codesign --force --deep --sign - "$app"
|
|
codesign --verify --deep --strict "$app"
|
|
spctl --assess --type execute "$app" 2>/dev/null || true
|
|
print "Validated ad-hoc build: $app"
|
|
exit 0
|
|
fi
|
|
|
|
identity=${VOICECAT_CODESIGN_IDENTITY:-}
|
|
if [[ -z "$identity" ]]; then
|
|
print -u2 "Set VOICECAT_CODESIGN_IDENTITY to a Developer ID Application identity."
|
|
exit 2
|
|
fi
|
|
|
|
codesign --force --deep --timestamp --options runtime \
|
|
--entitlements "$script_dir/VoiceCat.Mac/VoiceCat.Mac.entitlements" \
|
|
--sign "$identity" "$app"
|
|
codesign --verify --deep --strict --verbose=2 "$app"
|
|
|
|
archive="$distribution/VoiceCat-macOS-arm64.zip"
|
|
ditto -c -k --keepParent "$app" "$archive"
|
|
|
|
if [[ -n ${APPLE_ID:-} && -n ${APPLE_TEAM_ID:-} && -n ${APPLE_APP_PASSWORD:-} ]]; then
|
|
xcrun notarytool submit "$archive" --wait \
|
|
--apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_PASSWORD"
|
|
xcrun stapler staple "$app"
|
|
xcrun stapler validate "$app"
|
|
spctl --assess --type execute --verbose=2 "$app"
|
|
ditto -c -k --keepParent "$app" "$archive"
|
|
print "Signed, notarized, and stapled: $archive"
|
|
else
|
|
print "Signed archive produced without notarization: $archive"
|
|
print "Set APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD to submit it."
|
|
fi
|