Andros Fenollosa
ba9bbbf3b9
Some checks are pending
build-windows / windows-exe (push) Waiting to run
sign-macos.sh signs neotalk.app with the Developer ID under the hardened runtime; release-macos.sh builds, signs, notarizes, staples and can publish the zip to the Gitea releases page. Credentials are read from the environment.
32 lines
1 KiB
Bash
Executable file
32 lines
1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Sign a neotalk.app with a Developer ID for distribution, under the hardened
|
|
# runtime. Run on macOS after building the bundle.
|
|
#
|
|
# ./packaging/sign-macos.sh [path/to/neotalk.app]
|
|
#
|
|
# Override the identity with NEOTALK_SIGN_IDENTITY if needed.
|
|
set -euo pipefail
|
|
|
|
APP="${1:-dist/neotalk.app}"
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
ENTITLEMENTS="$HERE/entitlements.plist"
|
|
IDENTITY="${NEOTALK_SIGN_IDENTITY:-Developer ID Application: ANDROS FENOLLOSA HURTADO (M3K3T47KXF)}"
|
|
|
|
if [ ! -d "$APP" ]; then
|
|
echo "App not found: $APP" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Signing nested libraries…"
|
|
find "$APP/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) -print0 |
|
|
while IFS= read -r -d '' lib; do
|
|
codesign --force --options runtime --timestamp --sign "$IDENTITY" "$lib"
|
|
done
|
|
|
|
echo "Signing the bundle…"
|
|
codesign --force --options runtime --timestamp \
|
|
--entitlements "$ENTITLEMENTS" --sign "$IDENTITY" "$APP"
|
|
|
|
echo "Verifying…"
|
|
codesign --verify --deep --strict --verbose=2 "$APP"
|
|
echo "Signed: $APP"
|