From d5abdb5ed5580c8fa62a9a2d10a965d4b34aba51 Mon Sep 17 00:00:00 2001
From: idealclover <idealclover@live.com>
Date: Tue, 21 Apr 2026 22:51:34 +0800
Subject: [PATCH] =?UTF-8?q?:computer:=20=E5=A2=9E=E5=8A=A0mac=E5=85=AC?=
 =?UTF-8?q?=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/build_universal_dmg.sh | 83 +++++++++++++++++++++++-----------
 src-tauri/Topdo.entitlements   | 14 ++++++
 src-tauri/tauri.conf.json      |  3 +-
 3 files changed, 72 insertions(+), 28 deletions(-)
 create mode 100644 src-tauri/Topdo.entitlements

diff --git a/scripts/build_universal_dmg.sh b/scripts/build_universal_dmg.sh
index 4a16f42..b103e21 100755
--- a/scripts/build_universal_dmg.sh
+++ b/scripts/build_universal_dmg.sh
@@ -7,22 +7,42 @@ cd "$ROOT_DIR"
 PRODUCT="Topdo"
 VERSION="1.0.0"
 APP_NAME="$PRODUCT.app"
-NOTICE_FILE="$ROOT_DIR/docs/01_安装说明.txt"
+
+SIGNING_IDENTITY="Developer ID Application: Ronghao cui (6Z4232N2L9)"
+
+check_notarization_env() {
+  if [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+echo "========================================="
+echo "  $PRODUCT v$VERSION 构建脚本"
+echo "========================================="
+echo ""
+
+if check_notarization_env; then
+  echo "[信息] 检测到公证环境变量，构建后将自动公证"
+else
+  echo "[警告] 未检测到公证环境变量 (APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID)"
+  echo "        应用将仅签名，不进行公证。分发给其他用户时可能会被 Gatekeeper 拦截。"
+  echo "        设置方法: export APPLE_ID=xxx APPLE_PASSWORD=xxx APPLE_TEAM_ID=6Z4232N2L9"
+fi
+echo ""
 
 echo "[1/3] 确保 Rust 双目标已安装..."
 rustup target add x86_64-apple-darwin >/dev/null
 
-echo "[2/3] 构建 Universal app + dmg..."
+echo "[2/3] 构建 Universal app + dmg（含签名）..."
 pnpm tauri build --target universal-apple-darwin --bundles app,dmg
 
 BUNDLE_BASE="$ROOT_DIR/src-tauri/target/universal-apple-darwin/release/bundle"
 DMG_DIR="$BUNDLE_BASE/dmg"
 MACOS_DIR="$BUNDLE_BASE/macos"
-BUNDLE_DMG_SH="$DMG_DIR/bundle_dmg.sh"
-VOL_ICON="$DMG_DIR/icon.icns"
 APP_PATH="$MACOS_DIR/$APP_NAME"
 OUTPUT_DMG="$DMG_DIR/${PRODUCT}_${VERSION}_universal.dmg"
-TEMP_DMG="$DMG_DIR/${PRODUCT}_${VERSION}_universal_with_notice.dmg"
 
 if [ ! -d "$APP_PATH" ]; then
   echo "[错误] 未找到 app: $APP_PATH"
@@ -32,29 +52,38 @@ if [ ! -f "$OUTPUT_DMG" ]; then
   echo "[错误] 未找到 dmg: $OUTPUT_DMG"
   exit 1
 fi
-if [ ! -f "$BUNDLE_DMG_SH" ]; then
-  echo "[错误] 未找到 bundle_dmg.sh: $BUNDLE_DMG_SH"
-  exit 1
-fi
-if [ ! -f "$NOTICE_FILE" ]; then
-  echo "[错误] 未找到安装说明: $NOTICE_FILE"
-  exit 1
+
+echo "签名 DMG..."
+codesign --sign "$SIGNING_IDENTITY" --force "$OUTPUT_DMG"
+
+echo ""
+echo "[3/3] 验证签名..."
+codesign --verify --deep --strict --verbose=2 "$APP_PATH" 2>&1 || true
+codesign --verify --verbose=2 "$OUTPUT_DMG" 2>&1 || true
+echo ""
+
+if check_notarization_env; then
+  echo "提交 DMG 公证..."
+  NOTARY_SUBMIT_OUTPUT=$(xcrun notarytool submit "$OUTPUT_DMG" \
+    --apple-id "$APPLE_ID" \
+    --password "$APPLE_PASSWORD" \
+    --team-id "$APPLE_TEAM_ID" \
+    --wait 2>&1) || true
+  echo "$NOTARY_SUBMIT_OUTPUT"
+
+  if echo "$NOTARY_SUBMIT_OUTPUT" | grep -q "status: Accepted"; then
+    echo "公证成功，装订票据到 DMG..."
+    xcrun stapler staple "$OUTPUT_DMG"
+    echo ""
+    echo "[完成] 已签名并公证的发布包已生成"
+  else
+    echo "[警告] 公证未通过，请检查输出日志"
+    echo "  可运行 xcrun notarytool log <submission-id> --apple-id \$APPLE_ID --password \$APPLE_PASSWORD --team-id \$APPLE_TEAM_ID 查看详情"
+  fi
+else
+  echo "[完成] 已签名的发布包已生成（未公证）"
 fi
 
-echo "[3/3] 重新打包 DMG（注入安装说明）..."
-rm -f "$TEMP_DMG"
-"$BUNDLE_DMG_SH" \
-  --volname "$PRODUCT" \
-  --icon "$APP_NAME" 180 220 \
-  --app-drop-link 480 220 \
-  --window-size 660 400 \
-  --hide-extension "$APP_NAME" \
-  --add-file "01_安装说明.txt" "$NOTICE_FILE" 330 320 \
-  --volicon "$VOL_ICON" \
-  "$TEMP_DMG" \
-  "$APP_PATH"
-mv -f "$TEMP_DMG" "$OUTPUT_DMG"
-
-echo "[完成] 发布包已生成"
+echo ""
 echo "Universal app: $APP_PATH"
 echo "Universal dmg: $OUTPUT_DMG"
diff --git a/src-tauri/Topdo.entitlements b/src-tauri/Topdo.entitlements
new file mode 100644
index 0000000..363eba2
--- /dev/null
+++ b/src-tauri/Topdo.entitlements
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+</dict>
+</plist>
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index e5fb323..c1fa26a 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -36,7 +36,8 @@
     "targets": ["app", "dmg"],
     "category": "Productivity",
     "macOS": {
-      "signingIdentity": "-",
+      "signingIdentity": "Developer ID Application: Ronghao cui (6Z4232N2L9)",
+      "entitlements": "./Topdo.entitlements",
       "minimumSystemVersion": "10.15",
       "dmg": {
         "windowSize": {