12set -euo pipefail34if [[ $# -ne 2 ]]; then5 echo "usage: sign-macos.sh <Atlas.app> <output.zip>" >&26 exit 27fi89app=$110output=$211keychain=""12certificate=""13notary_key=""14cleanup() {15 if [[ -n "$keychain" ]]; then16 security delete-keychain "$keychain" >/dev/null 2>&1 || true17 fi18 [[ -z "$certificate" ]] || rm -f "$certificate"19 [[ -z "$notary_key" ]] || rm -f "$notary_key"20}21trap cleanup EXIT2223if [[ -n "${MACOS_CERTIFICATE_P12_BASE64:-}" ]]; then24 : "${MACOS_CERTIFICATE_PASSWORD:?required with MACOS_CERTIFICATE_P12_BASE64}"25 : "${MACOS_SIGNING_IDENTITY:?required with MACOS_CERTIFICATE_P12_BASE64}"26 certificate="$RUNNER_TEMP/atlas-release.p12"27 keychain="$RUNNER_TEMP/atlas-release.keychain-db"28 printf '%s' "$MACOS_CERTIFICATE_P12_BASE64" | base64 -D > "$certificate"29 security create-keychain -p atlas-release "$keychain"30 security unlock-keychain -p atlas-release "$keychain"31 security import "$certificate" -k "$keychain" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign32 security set-key-partition-list -S apple-tool:,apple: -s -k atlas-release "$keychain"33 codesign --force --deep --options runtime --timestamp \34 --keychain "$keychain" --sign "$MACOS_SIGNING_IDENTITY" "$app"35 codesign --verify --deep --strict --verbose=2 "$app"36else37 # Go's linker ad-hoc signs the Mach-O, but adding Info.plist around that38 # executable changes the signed bundle boundary. Re-sign the completed app39 # so workflow-dispatch previews are structurally valid even though only a40 # Developer ID + notarization ticket can satisfy Gatekeeper after download.41 codesign --force --deep --sign - "$app"42 echo "MACOS_CERTIFICATE_P12_BASE64 is empty; packaging an ad-hoc signed preview"43fi4445codesign --verify --deep --strict --verbose=2 "$app"4647ditto -c -k --keepParent "$app" "$output"4849if [[ -n "${MACOS_NOTARY_KEY_BASE64:-}" ]]; then50 [[ -n "${MACOS_CERTIFICATE_P12_BASE64:-}" ]] || {51 echo "MACOS_CERTIFICATE_P12_BASE64 is required when notarization is configured" >&252 exit 253 }54 : "${MACOS_NOTARY_KEY_ID:?required with MACOS_NOTARY_KEY_BASE64}"55 : "${MACOS_NOTARY_ISSUER_ID:?required with MACOS_NOTARY_KEY_BASE64}"56 notary_key="$RUNNER_TEMP/AuthKey_$MACOS_NOTARY_KEY_ID.p8"57 printf '%s' "$MACOS_NOTARY_KEY_BASE64" | base64 -D > "$notary_key"58 xcrun notarytool submit "$output" --wait \59 --key "$notary_key" --key-id "$MACOS_NOTARY_KEY_ID" --issuer "$MACOS_NOTARY_ISSUER_ID"60 xcrun stapler staple "$app"61 xcrun stapler validate "$app"62 codesign --verify --deep --strict --verbose=2 "$app"63 rm -f "$output"64 ditto -c -k --keepParent "$app" "$output"65fi