mag/KMix_Pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated release script with zsh guard and ony dmg in dist directory

Browse Source
This commit is contained in:
Mark Gregory
2026-11-03 15:30:17 +00:00
parent f23278eaa6
commit c35dd4b20e
4 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release.sh
+21 -16
View File
@@ -1,4 +1,11 @@
#!/bin/bash
# Also honor the Bash requirement if launched explicitly as `zsh scripts/release.sh`.
if [ -z "${BASH_VERSION:-}" ]; then
case "${ZSH_EVAL_CONTEXT:-}" in
*:file) printf 'Run this script with: bash ./scripts/release.sh\n' >&2;return 1 ;;
*) exec /bin/bash "$0" "$@" ;;
esac
fi
set -euo pipefail
cd "$(dirname "$0")/.."
@@ -7,9 +14,10 @@ usage() {
Usage: ./scripts/release.sh [--signed-only | --unsigned] [--] [xcodebuild arguments]
Default: Developer ID sign, notarize and staple the app and branded DMG, then
require successful Gatekeeper checks before publishing the files.
require successful Gatekeeper checks before publishing the DMG.
--signed-only: Build a Developer ID signed DMG without notarization.
--unsigned: Build an unsigned preview DMG and the legacy unsigned ZIP.
--unsigned: Build an unsigned preview DMG.
Only the current DMG is kept in dist; reports stay under build-release/release-verification.
KJMIX_SIGNING_IDENTITY: Developer ID Application certificate name or SHA-1.
Auto-selects when all matching certificates have one name.
@@ -61,6 +69,7 @@ release_built="$PWD/build-release/Build/Products/Release/KJMix Pro.app"
release_version="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$release_built/Contents/Info.plist")"
[[ "$release_version" =~ ^[A-Za-z0-9._-]+$ ]] || fail 'Invalid release version.'
release_payload="$release_work/payload"
[[ ! -L "$PWD/dist" ]] || fail 'dist must be a real directory, not a symbolic link.'
/bin/mkdir -p "$release_payload" dist
release_app="$release_payload/KJMix Pro.app"
/usr/bin/ditto --noextattr --norsrc "$release_built" "$release_app"
@@ -73,21 +82,21 @@ release_suffix=macOS
if [[ "$release_mode" == unsigned ]]; then release_suffix=unsigned-macOS;fi
if [[ "$release_mode" == signed ]]; then release_suffix=signed-unnotarized-macOS;fi
release_name="KJMixPro-$release_version-$release_suffix"
release_reports="$PWD/dist/$release_name-verification"
release_reports="$PWD/build-release/release-verification/$release_name"
/bin/mkdir -p "$release_reports"
printf 'Preparing release. NOT yet verified.\n' > "$release_reports/STATUS.txt"
notarize() {
local artifact="$1" label="$2" report="$release_reports/$2-notary.json" submission status
local artifact="$1" label="$2" report="$release_reports/$2-notary.json" submission notary_status
printf 'Submitting %s to Apple notarization…\n' "$label"
if ! xcrun notarytool submit "$artifact" --keychain-profile "$release_profile" --wait --timeout 30m --output-format json > "$report"; then
printf 'Notarization did not complete. Inspect %s; Apple may still be processing the submission.\n' "$report" >&2
return 1
fi
status="$(/usr/bin/plutil -extract status raw -o - "$report")"
notary_status="$(/usr/bin/plutil -extract status raw -o - "$report")"
submission="$(/usr/bin/plutil -extract id raw -o - "$report")"
if [[ "$status" != Accepted ]]; then
if [[ "$notary_status" != Accepted ]]; then
xcrun notarytool log "$submission" --keychain-profile "$release_profile" "$release_reports/$label-notary-log.json" || true
fail "Apple did not accept $label (status: $status). See $release_reports."
fail "Apple did not accept $label (status: $notary_status). See $release_reports."
fi
}
if [[ "$release_mode" != unsigned ]]; then
@@ -140,19 +149,15 @@ if [[ "$release_mode" == notarized ]]; then
fi
/usr/bin/hdiutil detach -quiet "$release_mount"
release_mounted=false
/usr/bin/ditto -c -k --sequesterRsrc --keepParent "$release_app" "$release_work/$release_name.zip"
/bin/mv -f "$release_dmg" "dist/$release_name.dmg"
/bin/mv -f "$release_work/$release_name.zip" "dist/$release_name.zip"
if [[ "$release_mode" == unsigned ]]; then /bin/cp "dist/$release_name.zip" dist/KJMixPro-unsigned-macOS.zip;fi
(
cd dist
/usr/bin/shasum -a 256 "$release_name.dmg" > "$release_name.dmg.sha256"
/usr/bin/shasum -a 256 "$release_name.zip" > "$release_name.zip.sha256"
)
# Preserve the previous distribution until the new image has passed every check.
# Nothing other than the current DMG belongs in this generated output directory.
/usr/bin/find "$PWD/dist" -mindepth 1 -maxdepth 1 ! -name "$release_name.dmg" -exec /bin/rm -rf -- {} +
/usr/bin/shasum -a 256 "dist/$release_name.dmg" > "$release_reports/SHA256.txt"
if [[ "$release_mode" == notarized ]]; then
printf 'Developer ID signed; Apple notarization accepted; app and DMG tickets stapled; Gatekeeper checks passed.\n' | /usr/bin/tee "$release_reports/STATUS.txt"
else
printf '%s build only. NOT notarized or Gatekeeper verified.\n' "$release_mode" | /usr/bin/tee "$release_reports/STATUS.txt"
fi
release_completed=true
printf 'Created dist/%s.dmg and dist/%s.zip\n' "$release_name" "$release_name"
printf 'Created dist/%s.dmg\nVerification reports: %s\n' "$release_name" "$release_reports"