#!/usr/bin/env bash
# Sign a neotalk.app with a Developer ID for distribution, under the hardened
# runtime. Run on macOS after building the bundle.
#
#   ./packaging/sign-macos.sh [path/to/neotalk.app]
#
# Override the identity with NEOTALK_SIGN_IDENTITY if needed.
set -euo pipefail

APP="${1:-dist/neotalk.app}"
HERE="$(cd "$(dirname "$0")" && pwd)"
ENTITLEMENTS="$HERE/entitlements.plist"
IDENTITY="${NEOTALK_SIGN_IDENTITY:-Developer ID Application: ANDROS FENOLLOSA HURTADO (M3K3T47KXF)}"

if [ ! -d "$APP" ]; then
  echo "App not found: $APP" >&2
  exit 1
fi

echo "Signing nested libraries…"
find "$APP/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) -print0 |
  while IFS= read -r -d '' lib; do
    codesign --force --options runtime --timestamp --sign "$IDENTITY" "$lib"
  done

echo "Signing the bundle…"
codesign --force --options runtime --timestamp \
  --entitlements "$ENTITLEMENTS" --sign "$IDENTITY" "$APP"

echo "Verifying…"
codesign --verify --deep --strict --verbose=2 "$APP"
echo "Signed: $APP"