new release script

scripts/release-dbsyn-direct.sh

@@ -71,6 +71,38 @@ echo '==> Exporting Developer ID application...'
 xcodebuild -exportArchive -archivePath "$ARCHIVE_PATH" \
     -exportPath "$EXPORT_DIR" -exportOptionsPlist "$EXPORT_OPTIONS"
 APP_PATH="$EXPORT_DIR/$APP_NAME.app"
+
+# ------------------------------------------------------------
+# Enforce Developer ID signing with hardened runtime
+# ------------------------------------------------------------
+
+echo
+echo "==> Signing DBSyn with hardened runtime..."
+
+codesign \
+    --force \
+    --deep \
+    --options runtime \
+    --timestamp \
+    --sign "$SIGNING_IDENTITY" \
+    "$APP_PATH"
+
+echo "==> Verifying hardened runtime..."
+
+codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+
+SIGNATURE_INFO="$(codesign -dv --verbose=4 "$APP_PATH" 2>&1)"
+
+printf '%s\n' "$SIGNATURE_INFO"
+
+if [[ "$SIGNATURE_INFO" != *"(runtime)"* ]]; then
+    echo "ERROR: Hardened runtime signing failed."
+    exit 1
+fi
+
+echo "Hardened runtime verified."
+
+
 [[ -d "$APP_PATH" ]] || { echo "ERROR: Exported app missing: $APP_PATH" >&2; exit 1; }
 
 echo '==> Checking application signature and hardened runtime...'