52 lines
2.4 KiB
Bash
Executable File
52 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
PBX="$ROOT/Rsync Studio.xcodeproj/project.pbxproj"
|
|
EXPECTED_BUNDLE_ID="net.absdev.RsyncStudio"
|
|
EXPECTED_VERSION="1.0.0"
|
|
EXPECTED_BUILD="1"
|
|
EXPECTED_MIN_MACOS="14.0"
|
|
|
|
fail() { echo "ERROR: $*" >&2; exit 1; }
|
|
pass() { echo "OK: $*"; }
|
|
|
|
[[ -f "$PBX" ]] || fail "Missing Xcode project file"
|
|
|
|
[[ $(grep -c "PRODUCT_BUNDLE_IDENTIFIER = $EXPECTED_BUNDLE_ID;" "$PBX") -ge 2 ]] || fail "Bundle identifier must remain $EXPECTED_BUNDLE_ID in all app configurations"
|
|
pass "Bundle identifier is $EXPECTED_BUNDLE_ID"
|
|
|
|
[[ $(grep -c "MARKETING_VERSION = $EXPECTED_VERSION;" "$PBX") -ge 2 ]] || fail "Marketing version must be $EXPECTED_VERSION"
|
|
pass "Marketing version is $EXPECTED_VERSION"
|
|
|
|
[[ $(grep -c "CURRENT_PROJECT_VERSION = $EXPECTED_BUILD;" "$PBX") -ge 2 ]] || fail "Build number must be $EXPECTED_BUILD"
|
|
pass "Build number is $EXPECTED_BUILD"
|
|
|
|
[[ $(grep -c 'ENABLE_HARDENED_RUNTIME = YES;' "$PBX") -ge 2 ]] || fail "Hardened Runtime must be enabled"
|
|
pass "Hardened Runtime is enabled"
|
|
|
|
[[ $(grep -c 'ENABLE_APP_SANDBOX = NO;' "$PBX") -ge 2 ]] || fail "App Sandbox baseline changed unexpectedly"
|
|
pass "App Sandbox remains intentionally disabled for direct distribution"
|
|
|
|
[[ $(grep -c "MACOSX_DEPLOYMENT_TARGET = $EXPECTED_MIN_MACOS;" "$PBX") -ge 2 ]] || fail "macOS deployment target must remain $EXPECTED_MIN_MACOS"
|
|
pass "Minimum macOS is $EXPECTED_MIN_MACOS"
|
|
|
|
[[ $(grep -c 'INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";' "$PBX") -ge 2 ]] || fail "Application category is missing"
|
|
pass "Application category is Utilities"
|
|
|
|
if grep -q 'CODE_SIGN_IDENTITY = "Apple Development"' "$PBX"; then
|
|
fail "A project-level Apple Development identity is pinned; Release distribution must use Developer ID Application"
|
|
fi
|
|
pass "No development certificate is pinned into the project"
|
|
|
|
if grep -q 'com.apple.security.get-task-allow' "$ROOT/Rsync Studio"/*.entitlements 2>/dev/null; then
|
|
fail "get-task-allow must never ship in a commercial Release build"
|
|
fi
|
|
pass "No get-task-allow entitlement is present in source entitlements"
|
|
|
|
cat <<'MSG'
|
|
|
|
Release identity baseline passed.
|
|
Before the first commercial archive, select your Apple Developer Team in Xcode and ensure the archived app is signed with a "Developer ID Application" certificate. The exact certificate identity is intentionally not committed to source control.
|
|
MSG
|