mag/SQLWorkbench
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new release script

Browse Source
This commit is contained in:
Mark Gregory
2026-10-18 14:57:05 +01:00
parent 4306211981
commit d6d39937ed
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PHASE60-DIRECT-DISTRIBUTION.md
+9
View File
@@ -0,0 +1,9 @@
# DBSyn Phase 60 — Direct Distribution
Run `chmod +x scripts/release-dbsyn-direct.sh` then `./scripts/release-dbsyn-direct.sh` from the project root.
Uses Developer ID team `39R6U3437D`, signing identity `B99D353C88996866C49E4389B375645F76870A3F`, and notarytool Keychain profile `orion-notary`. Override using environment variables `TEAM_ID`, `SIGNING_IDENTITY`, and `NOTARY_PROFILE`.
Creates `releases/DBSyn.dmg` only after successful app signing, app notarization, DMG signing, DMG notarization, and Gatekeeper verification.
Requires a Mac with Xcode, Developer ID signing certificate, valid notarytool profile and network connectivity. Does not run on Linux.
scripts/release-dbsyn.sh → scripts/release-dbsyn-direct.sh
+8 -3
View File
@@ -76,12 +76,17 @@ APP_PATH="$EXPORT_DIR/$APP_NAME.app"
echo '==> Checking application signature and hardened runtime...'
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
codesign -dv --verbose=4 "$APP_PATH" 2>&1 | grep -E 'Identifier=|Authority=|TeamIdentifier=|Runtime Version=|flags=' || true
ACTUAL_TEAM="$(codesign -dv --verbose=4 "$APP_PATH" 2>&1 | sed -n 's/^TeamIdentifier=//p' | head -1)"
# codesign -d prints details to stderr and may return a nonzero status even
# when the signature is valid. Under `set -o pipefail`, piping it to grep
# can therefore reject a correctly signed app. Capture once and inspect.
SIGNATURE_INFO="$(codesign -dv --verbose=4 "$APP_PATH" 2>&1 || true)"
ACTUAL_TEAM="$(printf '%s\n' "$SIGNATURE_INFO" | sed -n 's/^TeamIdentifier=//p' | head -n 1)"
[[ "$ACTUAL_TEAM" == "$TEAM_ID" ]] || { echo "ERROR: Unexpected signing team: $ACTUAL_TEAM" >&2; exit 1; }
codesign -dv --verbose=4 "$APP_PATH" 2>&1 | grep -q 'runtime' || {
if ! grep -Eq 'flags=0x[[:xdigit:]]+\(runtime\)' <<< "$SIGNATURE_INFO"; then
echo 'ERROR: App is not signed with the hardened runtime required for notarization.' >&2
exit 1
}
fi
echo '==> Hardened runtime verified.'
echo '==> Notarizing application...'
ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"