From d6d39937eddff1c49d04804228030b5e5abd8824 Mon Sep 17 00:00:00 2001
From: Mark Gregory <mark.gregory@abbeysoftware.com>
Date: Sun, 18 Oct 2026 14:57:05 +0100
Subject: [PATCH] new release script

---
 docs/PHASE60-DIRECT-DISTRIBUTION.md                   |  9 +++++++++
 scripts/{release-dbsyn.sh => release-dbsyn-direct.sh} | 11 ++++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)
 create mode 100644 docs/PHASE60-DIRECT-DISTRIBUTION.md
 rename scripts/{release-dbsyn.sh => release-dbsyn-direct.sh} (90%)

diff --git a/docs/PHASE60-DIRECT-DISTRIBUTION.md b/docs/PHASE60-DIRECT-DISTRIBUTION.md
new file mode 100644
index 0000000..e958664
--- /dev/null
+++ b/docs/PHASE60-DIRECT-DISTRIBUTION.md
@@ -0,0 +1,9 @@
+# DBSyn Phase 60 — Direct Distribution
+
+Run `chmod +x scripts/release-dbsyn-direct.sh` then `./scripts/release-dbsyn-direct.sh` from the project root.
+
+Uses Developer ID team `39R6U3437D`, signing identity `B99D353C88996866C49E4389B375645F76870A3F`, and notarytool Keychain profile `orion-notary`. Override using environment variables `TEAM_ID`, `SIGNING_IDENTITY`, and `NOTARY_PROFILE`.
+
+Creates `releases/DBSyn.dmg` only after successful app signing, app notarization, DMG signing, DMG notarization, and Gatekeeper verification.
+
+Requires a Mac with Xcode, Developer ID signing certificate, valid notarytool profile and network connectivity. Does not run on Linux.
diff --git a/scripts/release-dbsyn.sh b/scripts/release-dbsyn-direct.sh
similarity index 90%
rename from scripts/release-dbsyn.sh
rename to scripts/release-dbsyn-direct.sh
index 1ccb6e4..8150ce9 100755
--- a/scripts/release-dbsyn.sh
+++ b/scripts/release-dbsyn-direct.sh
@@ -76,12 +76,17 @@ APP_PATH="$EXPORT_DIR/$APP_NAME.app"
 echo '==> Checking application signature and hardened runtime...'
 codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 codesign -dv --verbose=4 "$APP_PATH" 2>&1 | grep -E 'Identifier=|Authority=|TeamIdentifier=|Runtime Version=|flags=' || true
-ACTUAL_TEAM="$(codesign -dv --verbose=4 "$APP_PATH" 2>&1 | sed -n 's/^TeamIdentifier=//p' | head -1)"
+# codesign -d prints details to stderr and may return a nonzero status even
+# when the signature is valid. Under `set -o pipefail`, piping it to grep
+# can therefore reject a correctly signed app. Capture once and inspect.
+SIGNATURE_INFO="$(codesign -dv --verbose=4 "$APP_PATH" 2>&1 || true)"
+ACTUAL_TEAM="$(printf '%s\n' "$SIGNATURE_INFO" | sed -n 's/^TeamIdentifier=//p' | head -n 1)"
 [[ "$ACTUAL_TEAM" == "$TEAM_ID" ]] || { echo "ERROR: Unexpected signing team: $ACTUAL_TEAM" >&2; exit 1; }
-codesign -dv --verbose=4 "$APP_PATH" 2>&1 | grep -q 'runtime' || {
+if ! grep -Eq 'flags=0x[[:xdigit:]]+\(runtime\)' <<< "$SIGNATURE_INFO"; then
     echo 'ERROR: App is not signed with the hardened runtime required for notarization.' >&2
     exit 1
-}
+fi
+echo '==> Hardened runtime verified.'
 
 echo '==> Notarizing application...'
 ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"