mirror of
https://github.com/nolen777/eagle0.git
synced 2026-07-28 22:35:42 +00:00
9cc9a65e4a
* Fix codesign script to sign all Sparkle framework components Sign XPC services, nested apps (Updater.app), and standalone executables (Autoupdate) before signing the framework itself. Apple notarization requires all nested binaries to be signed with Developer ID certificate and secure timestamp. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add missing path triggers for pull_request in Mac build workflow 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Re-add rules_swift for Mac GoDice plugin build The DarwinGodiceBundle requires rules_swift to build. This was inadvertently removed in #5194. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
89 lines
3.1 KiB
Bash
Executable File
89 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Code sign a macOS .app bundle for distribution
|
|
# Usage: codesign_mac_app.sh <app_path> [entitlements_path]
|
|
#
|
|
# Environment variables:
|
|
# SIGNING_IDENTITY - The signing identity (default: "Developer ID Application")
|
|
# KEYCHAIN_PASSWORD - Password to unlock the build keychain (optional)
|
|
|
|
set -euxo pipefail
|
|
|
|
APP_PATH="$1"
|
|
ENTITLEMENTS_PATH="${2:-}"
|
|
SIGNING_IDENTITY="${SIGNING_IDENTITY:-Developer ID Application}"
|
|
|
|
if [ ! -d "$APP_PATH" ]; then
|
|
echo "ERROR: App not found at $APP_PATH"
|
|
exit 1
|
|
fi
|
|
|
|
# Unlock keychain if password provided
|
|
if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain || true
|
|
fi
|
|
|
|
echo "=== Signing nested components first ==="
|
|
|
|
# Sign all dylibs
|
|
find "$APP_PATH" -name "*.dylib" -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing dylib: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
# Sign all bundles (plugins)
|
|
find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing bundle: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
# Sign XPC services (inside Sparkle framework)
|
|
find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing XPC service: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
# Sign nested apps (like Sparkle's Updater.app)
|
|
find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing nested app: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
# Sign standalone executables inside frameworks (like Autoupdate)
|
|
find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing executable: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
# Sign all frameworks (after their contents are signed)
|
|
find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do
|
|
echo "Signing framework: $item"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$item"
|
|
done
|
|
|
|
echo "=== Signing main app bundle ==="
|
|
|
|
if [ -n "$ENTITLEMENTS_PATH" ] && [ -f "$ENTITLEMENTS_PATH" ]; then
|
|
echo "Using entitlements: $ENTITLEMENTS_PATH"
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--entitlements "$ENTITLEMENTS_PATH" \
|
|
--sign "$SIGNING_IDENTITY" "$APP_PATH"
|
|
else
|
|
codesign --force --verify --verbose --timestamp --options runtime \
|
|
--sign "$SIGNING_IDENTITY" "$APP_PATH"
|
|
fi
|
|
|
|
echo "=== Verifying signature ==="
|
|
codesign --verify --verbose=4 "$APP_PATH"
|
|
|
|
echo "=== Checking Gatekeeper assessment ==="
|
|
spctl --assess --type exec -v "$APP_PATH" || echo "Note: Gatekeeper may reject until notarized"
|
|
|
|
echo "Code signing complete: $APP_PATH"
|