Adopt pinned public core snapshot and prepare Sized 2.0.0

2026-10-10 13:11:02 -04:00
parent c2cc458f27
commit e0707447ad
30 changed files with 1533 additions and 101 deletions
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+[[ $# == 2 ]] || { echo 'Usage: scripts/notarize-macos.sh PACKAGE_DIRECTORY NEW_DMG_PATH' >&2; exit 2; }
+: "${SIZED_SIGN_IDENTITY:?Set a Developer ID Application identity.}"
+package=$1
+dmg=$2
+[[ ! -e $dmg && ! -L $dmg ]] || { echo 'Refusing existing DMG.' >&2; exit 1; }
+codesign --force --sign "$SIZED_SIGN_IDENTITY" --identifier com.gamertan.sized --options runtime --timestamp "$package/sized"
+codesign --verify --strict --verbose=2 "$package/sized"
+printf '\nMac distribution: Developer ID signed; see the notarized, stapled DMG.\n' >> "$package/BUILD-INFO.txt"
+hdiutil create -quiet -volname 'Sized 2.0.0' -srcfolder "$package" -format UDZO "$dmg"
+codesign --sign "$SIZED_SIGN_IDENTITY" --timestamp "$dmg"
+xcrun notarytool submit "$dmg" --keychain-profile "${SIZED_NOTARY_PROFILE:-sizequeen-notary}" --wait --output-format json > "$dmg.notarization.json"
+test "$(plutil -extract status raw "$dmg.notarization.json")" = Accepted
+xcrun stapler staple "$dmg"
+xcrun stapler validate "$dmg"
+spctl --assess --type open --context context:primary-signature --verbose=2 "$dmg"
+echo 'Signed, notarized and stapled disk image verified.'