#!/bin/zsh
set -euo pipefail

APP_PATH="${1:-}"
PROFILE="${NOTARY_PROFILE:-SonarDesk-Notary}"

if [[ -z "$APP_PATH" || ! -d "$APP_PATH" ]]; then
  echo "Usage: NOTARY_PROFILE=SonarDesk-Notary $0 /path/to/SonarDesk.app" >&2
  exit 64
fi

APP_PATH="$(cd "$(dirname "$APP_PATH")" && pwd)/$(basename "$APP_PATH")"
WORK_DIR="$(mktemp -d)"
ZIP_PATH="$WORK_DIR/SonarDesk.zip"
trap 'rm -rf "$WORK_DIR"' EXIT

echo "Verifying Developer ID signature and hardened runtime..."
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
spctl --assess --type execute --verbose=4 "$APP_PATH" || true

echo "Preparing notarization upload..."
ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"

echo "Submitting to Apple notary service..."
xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$PROFILE" --wait

echo "Stapling notarization ticket..."
xcrun stapler staple "$APP_PATH"
xcrun stapler validate "$APP_PATH"

echo "Final Gatekeeper assessment..."
spctl --assess --type execute --verbose=4 "$APP_PATH"
echo "SonarDesk is signed, notarized, and stapled."