34 lines
1.0 KiB
Bash
Executable File
34 lines
1.0 KiB
Bash
Executable File
#!/bin/zsh
|
|
set -euo pipefail
|
|
|
|
APP_PATH="${1:-}"
|
|
PROFILE="${NOTARY_PROFILE:-SonarDesk-Notary}"
|
|
|
|
if [[ -z "$APP_PATH" || ! -d "$APP_PATH" ]]; then
|
|
echo "Usage: NOTARY_PROFILE=SonarDesk-Notary $0 /path/to/SonarDesk.app" >&2
|
|
exit 64
|
|
fi
|
|
|
|
APP_PATH="$(cd "$(dirname "$APP_PATH")" && pwd)/$(basename "$APP_PATH")"
|
|
WORK_DIR="$(mktemp -d)"
|
|
ZIP_PATH="$WORK_DIR/SonarDesk.zip"
|
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
|
echo "Verifying Developer ID signature and hardened runtime..."
|
|
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
|
|
spctl --assess --type execute --verbose=4 "$APP_PATH" || true
|
|
|
|
echo "Preparing notarization upload..."
|
|
ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
|
|
|
|
echo "Submitting to Apple notary service..."
|
|
xcrun notarytool submit "$ZIP_PATH" --keychain-profile "$PROFILE" --wait
|
|
|
|
echo "Stapling notarization ticket..."
|
|
xcrun stapler staple "$APP_PATH"
|
|
xcrun stapler validate "$APP_PATH"
|
|
|
|
echo "Final Gatekeeper assessment..."
|
|
spctl --assess --type execute --verbose=4 "$APP_PATH"
|
|
echo "SonarDesk is signed, notarized, and stapled."
|