From 060c2904e76c394fceb29cb81f7ba25be4bd0e10 Mon Sep 17 00:00:00 2001
From: VU3ESV <vinodes@aol.com>
Date: Thu, 4 Jun 2026 15:46:01 +0200
Subject: [PATCH] ci: codesign + staple the DMG, and staple the app

package-signed.sh now notarizes + staples the *app* before building the DMG (so
the bundle carries its ticket offline / once copied out), then codesigns the
DMG and notarizes + staples the DMG itself. Without the DMG codesignature
`spctl -a -t open` rejects it ("no usable signature") and a downloaded DMG can
prompt Gatekeeper on mount even though the app is notarized. Two notary
submissions; gated on secrets as before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/package-signed.sh | 38 +++++++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/scripts/package-signed.sh b/scripts/package-signed.sh
index f2a9ec8..8d1d7d8 100755
--- a/scripts/package-signed.sh
+++ b/scripts/package-signed.sh
@@ -79,18 +79,42 @@ else
 fi
 codesign --verify --strict --verbose=2 "$APP"
 
+# --- helper: submit to the notary service ----------------------------------------------
+notarize() {  # $1 = path to a .zip or .dmg to submit
+  xcrun notarytool submit "$1" \
+    --apple-id "$NOTARY_APPLE_ID" --team-id "${NOTARY_TEAM_ID:-}" --password "$NOTARY_PASSWORD" --wait
+}
+HAVE_NOTARY=0
+if [ -n "$IDENTITY" ] && [ -n "${NOTARY_APPLE_ID:-}" ] && [ -n "${NOTARY_PASSWORD:-}" ]; then
+  HAVE_NOTARY=1
+fi
+
+# Notarize the APP and staple it first, so the bundle carries its ticket even offline and
+# once copied out of the DMG (not just while the DMG is mounted).
+if [ "$HAVE_NOTARY" = 1 ]; then
+  echo "==> Notarizing the app + stapling (a few minutes)…"
+  AZIP="$(mktemp -d)/app.zip"
+  ditto -c -k --keepParent "$APP" "$AZIP"
+  notarize "$AZIP"
+  xcrun stapler staple "$APP"
+fi
+
 echo "==> Building DMG"
 VERSION="$VERSION" ./scripts/make-dmg.sh
 DMG="dist/LP-700-App-${VERSION}.dmg"
 
-# --- notarize + staple the DMG ----------------------------------------------------------
-if [ -n "$IDENTITY" ] && [ -n "${NOTARY_APPLE_ID:-}" ] && [ -n "${NOTARY_PASSWORD:-}" ]; then
-  echo "==> Notarizing $DMG (a few minutes)…"
-  xcrun notarytool submit "$DMG" \
-    --apple-id "$NOTARY_APPLE_ID" --team-id "${NOTARY_TEAM_ID:-}" --password "$NOTARY_PASSWORD" --wait
+# Codesign the DMG container too (so `spctl -t open` accepts it and it mounts without a
+# Gatekeeper prompt), then notarize + staple the DMG itself.
+if [ -n "$IDENTITY" ]; then
+  echo "==> Codesigning the DMG"
+  codesign --force -s "$IDENTITY" --timestamp "$DMG"
+fi
+if [ "$HAVE_NOTARY" = 1 ]; then
+  echo "==> Notarizing the DMG + stapling (a few minutes)…"
+  notarize "$DMG"
   xcrun stapler staple "$DMG"
-  echo "==> Notarized + stapled."
+  echo "==> Notarized + stapled (app + DMG)."
 else
-  echo "==> Skipping notarization (no NOTARY_* secrets) — DMG signed but not notarized."
+  echo "==> Skipping notarization (no NOTARY_* secrets) — signed but not notarized."
 fi
 echo "==> Done: $DMG"