#!/usr/bin/env bash
set -euo pipefail
[[ $# == 2 ]] || { echo 'Usage: scripts/notarize-macos.sh PACKAGE_DIRECTORY NEW_DMG_PATH' >&2; exit 2; }
: "${SIZED_SIGN_IDENTITY:?Set a Developer ID Application identity.}"
package=$1
dmg=$2
[[ ! -e $dmg && ! -L $dmg ]] || { echo 'Refusing existing DMG.' >&2; exit 1; }
codesign --force --sign "$SIZED_SIGN_IDENTITY" --identifier com.gamertan.sized --options runtime --timestamp "$package/sized"
codesign --verify --strict --verbose=2 "$package/sized"
printf '\nMac distribution: Developer ID signed; see the notarized, stapled DMG.\n' >> "$package/BUILD-INFO.txt"
hdiutil create -quiet -volname 'Sized 2.0.0' -srcfolder "$package" -format UDZO "$dmg"
codesign --sign "$SIZED_SIGN_IDENTITY" --timestamp "$dmg"
xcrun notarytool submit "$dmg" --keychain-profile "${SIZED_NOTARY_PROFILE:-sizequeen-notary}" --wait --output-format json > "$dmg.notarization.json"
test "$(plutil -extract status raw "$dmg.notarization.json")" = Accepted
xcrun stapler staple "$dmg"
xcrun stapler validate "$dmg"
spctl --assess --type open --context context:primary-signature --verbose=2 "$dmg"
echo 'Signed, notarized and stapled disk image verified.'