mirror of
https://github.com/BigMarc/grammargem.git
synced 2026-10-13 17:01:55 +02:00
e8b7dff65d
Installed apps now show an 'Update available' button (menu bar) and can one-click install signed updates. Adds the Sparkle dependency, an UpdaterManager wired into AppState, the menu-bar banner + 'Check for Updates', and Info.plist SUFeedURL (https://grammagem.app/appcast.xml), SUPublicEDKey, and scheduled background checks. Build / release: - build.sh embeds + rpaths Sparkle.framework; sign-app.sh signs it inside-out (XPC services, Updater.app, Autoupdate, framework, then app) for a valid, notarizable signature. - release.sh stamps the version, builds, signs, notarizes, staples, zips, and emits the EdDSA-signed appcast.xml to upload to grammagem.app. - A hidden --update-selftest checks a feed headlessly (CI/build pipeline). Verified: a v0.1.0 build detects a v0.2.0 update against a local signed appcast (UPDATE_FOUND: 0.2.0); the signed app passes codesign --strict. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
47 lines
1.6 KiB
Bash
Executable File
47 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build (universal), codesign (Hardened Runtime + Developer ID), notarize, and
|
|
# staple GrammaGem.app. Requires the Apple Developer Program ($99/yr) — a FIXED
|
|
# cost, not per-user.
|
|
#
|
|
# Credentials are read from the environment or a stored keychain profile — never
|
|
# hard-coded here. Provide ONE of:
|
|
# • NOTARY_PROFILE (a profile saved via: xcrun notarytool store-credentials)
|
|
# • APPLE_ID + TEAM_ID + NOTARY_PASSWORD (Apple ID + Team ID + app-specific pw)
|
|
#
|
|
# DEV_ID defaults to this project's identity; override if signing as someone else.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
DEV_ID="${DEV_ID:-Developer ID Application: Marc Schultheiss (D5KT5B9Z9M)}"
|
|
APP="dist/GrammaGem.app"
|
|
ZIP="dist/GrammaGem.zip"
|
|
ENTITLEMENTS="AppSupport/GrammaGem.entitlements"
|
|
|
|
echo "==> Building universal bundle"
|
|
./scripts/build.sh >/dev/null
|
|
|
|
echo "==> Codesigning (Hardened Runtime, inside-out incl. Sparkle)"
|
|
DEV_ID="$DEV_ID" ./scripts/sign-app.sh "$APP"
|
|
|
|
echo "==> Zipping"
|
|
ditto -c -k --keepParent "$APP" "$ZIP"
|
|
|
|
echo "==> Notarizing"
|
|
if [[ -n "${NOTARY_PROFILE:-}" ]]; then
|
|
xcrun notarytool submit "$ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
|
|
elif [[ -n "${APPLE_ID:-}" && -n "${TEAM_ID:-}" && -n "${NOTARY_PASSWORD:-}" ]]; then
|
|
xcrun notarytool submit "$ZIP" \
|
|
--apple-id "$APPLE_ID" --team-id "$TEAM_ID" --password "$NOTARY_PASSWORD" --wait
|
|
else
|
|
echo "ERROR: set NOTARY_PROFILE, or APPLE_ID + TEAM_ID + NOTARY_PASSWORD." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Stapling + verifying"
|
|
xcrun stapler staple "$APP"
|
|
spctl -a -vvv -t install "$APP"
|
|
|
|
echo "✓ Signed, notarized, stapled (universal): $APP"
|