mirror of
https://github.com/BigMarc/grammargem.git
synced 2026-10-13 17:01:55 +02:00
bb096bed7b
- LiveMonitor: menu-bar–resident; reads the focused field via the Accessibility API, runs the offline grammar engine, and shows live suggestions + a "Fix all". - Menu-bar icon now reflects status (issue count / paused); added Pause/Resume. - Page Blocker: exclude apps + websites (Safari domain detection) where GrammaGem stays out of the way; hotkeys + monitoring suppressed there. - build.sh now produces a universal (arm64 + x86_64) bundle; sign-notarize.sh is a turnkey codesign→notarize→staple flow reading creds from env/keychain (no secrets). - Clean entitlements plist (AMFI-compatible). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
1.7 KiB
Bash
Executable File
51 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build (universal), codesign (Hardened Runtime + Developer ID), notarize, and
|
|
# staple GrammaGem.app. Requires the Apple Developer Program ($99/yr) — a FIXED
|
|
# cost, not per-user.
|
|
#
|
|
# Credentials are read from the environment or a stored keychain profile — never
|
|
# hard-coded here. Provide ONE of:
|
|
# • NOTARY_PROFILE (a profile saved via: xcrun notarytool store-credentials)
|
|
# • APPLE_ID + TEAM_ID + NOTARY_PASSWORD (Apple ID + Team ID + app-specific pw)
|
|
#
|
|
# DEV_ID defaults to this project's identity; override if signing as someone else.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
DEV_ID="${DEV_ID:-Developer ID Application: Marc Schultheiss (D5KT5B9Z9M)}"
|
|
APP="dist/GrammaGem.app"
|
|
ZIP="dist/GrammaGem.zip"
|
|
ENTITLEMENTS="AppSupport/GrammaGem.entitlements"
|
|
|
|
echo "==> Building universal bundle"
|
|
./scripts/build.sh >/dev/null
|
|
|
|
echo "==> Codesigning (Hardened Runtime)"
|
|
codesign --force --timestamp --options runtime \
|
|
--entitlements "$ENTITLEMENTS" \
|
|
--sign "$DEV_ID" \
|
|
"$APP"
|
|
codesign --verify --strict --verbose=2 "$APP"
|
|
|
|
echo "==> Zipping"
|
|
ditto -c -k --keepParent "$APP" "$ZIP"
|
|
|
|
echo "==> Notarizing"
|
|
if [[ -n "${NOTARY_PROFILE:-}" ]]; then
|
|
xcrun notarytool submit "$ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
|
|
elif [[ -n "${APPLE_ID:-}" && -n "${TEAM_ID:-}" && -n "${NOTARY_PASSWORD:-}" ]]; then
|
|
xcrun notarytool submit "$ZIP" \
|
|
--apple-id "$APPLE_ID" --team-id "$TEAM_ID" --password "$NOTARY_PASSWORD" --wait
|
|
else
|
|
echo "ERROR: set NOTARY_PROFILE, or APPLE_ID + TEAM_ID + NOTARY_PASSWORD." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Stapling + verifying"
|
|
xcrun stapler staple "$APP"
|
|
spctl -a -vvv -t install "$APP"
|
|
|
|
echo "✓ Signed, notarized, stapled (universal): $APP"
|