Skip to content

ci: codesign + staple the DMG, and staple the app #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VU3ESV merged 1 commit into from
Jun 4, 2026
Merged

ci: codesign + staple the DMG, and staple the app #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 31 additions & 7 deletions scripts/package-signed.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,18 +79,42 @@ else
fi
codesign --verify --strict --verbose=2 "$APP"

# --- helper: submit to the notary service ----------------------------------------------
notarize() { # $1 = path to a .zip or .dmg to submit
xcrun notarytool submit "$1" \
--apple-id "$NOTARY_APPLE_ID" --team-id "${NOTARY_TEAM_ID:-}" --password "$NOTARY_PASSWORD" --wait
}
HAVE_NOTARY=0
if [ -n "$IDENTITY" ] && [ -n "${NOTARY_APPLE_ID:-}" ] && [ -n "${NOTARY_PASSWORD:-}" ]; then
HAVE_NOTARY=1
fi

# Notarize the APP and staple it first, so the bundle carries its ticket even offline and
# once copied out of the DMG (not just while the DMG is mounted).
if [ "$HAVE_NOTARY" = 1 ]; then
echo "==> Notarizing the app + stapling (a few minutes)…"
AZIP="$(mktemp -d)/app.zip"
ditto -c -k --keepParent "$APP" "$AZIP"
notarize "$AZIP"
xcrun stapler staple "$APP"
fi

echo "==> Building DMG"
VERSION="$VERSION" ./scripts/make-dmg.sh
DMG="dist/LP-700-App-${VERSION}.dmg"

# --- notarize + staple the DMG ----------------------------------------------------------
if [ -n "$IDENTITY" ] && [ -n "${NOTARY_APPLE_ID:-}" ] && [ -n "${NOTARY_PASSWORD:-}" ]; then
echo "==> Notarizing $DMG (a few minutes)…"
xcrun notarytool submit "$DMG" \
--apple-id "$NOTARY_APPLE_ID" --team-id "${NOTARY_TEAM_ID:-}" --password "$NOTARY_PASSWORD" --wait
# Codesign the DMG container too (so `spctl -t open` accepts it and it mounts without a
# Gatekeeper prompt), then notarize + staple the DMG itself.
if [ -n "$IDENTITY" ]; then
echo "==> Codesigning the DMG"
codesign --force -s "$IDENTITY" --timestamp "$DMG"
fi
if [ "$HAVE_NOTARY" = 1 ]; then
echo "==> Notarizing the DMG + stapling (a few minutes)…"
notarize "$DMG"
xcrun stapler staple "$DMG"
echo "==> Notarized + stapled."
echo "==> Notarized + stapled (app + DMG)."
else
echo "==> Skipping notarization (no NOTARY_* secrets) — DMG signed but not notarized."
echo "==> Skipping notarization (no NOTARY_* secrets) — signed but not notarized."
fi
echo "==> Done: $DMG"