mirror of
https://github.com/BigMarc/grammargem.git
synced 2026-10-13 17:01:55 +02:00
e8b7dff65d
Installed apps now show an 'Update available' button (menu bar) and can one-click install signed updates. Adds the Sparkle dependency, an UpdaterManager wired into AppState, the menu-bar banner + 'Check for Updates', and Info.plist SUFeedURL (https://grammagem.app/appcast.xml), SUPublicEDKey, and scheduled background checks. Build / release: - build.sh embeds + rpaths Sparkle.framework; sign-app.sh signs it inside-out (XPC services, Updater.app, Autoupdate, framework, then app) for a valid, notarizable signature. - release.sh stamps the version, builds, signs, notarizes, staples, zips, and emits the EdDSA-signed appcast.xml to upload to grammagem.app. - A hidden --update-selftest checks a feed headlessly (CI/build pipeline). Verified: a v0.1.0 build detects a v0.2.0 update against a local signed appcast (UPDATE_FOUND: 0.2.0); the signed app passes codesign --strict. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.2 KiB
Bash
Executable File
36 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Code-sign GrammaGem.app with Developer ID + Hardened Runtime, signing the
|
|
# embedded Sparkle.framework's nested helpers INSIDE-OUT first (required for a
|
|
# valid, notarizable signature).
|
|
#
|
|
# Usage: ./scripts/sign-app.sh [path/to/GrammaGem.app]
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
DEV_ID="${DEV_ID:-Developer ID Application: Marc Schultheiss (D5KT5B9Z9M)}"
|
|
ENTITLEMENTS="AppSupport/GrammaGem.entitlements"
|
|
APP="${1:-dist/GrammaGem.app}"
|
|
|
|
sign() { codesign --force --timestamp --options runtime --sign "$DEV_ID" "$@"; }
|
|
|
|
FW="${APP}/Contents/Frameworks/Sparkle.framework"
|
|
if [ -d "$FW" ]; then
|
|
echo "==> Signing Sparkle.framework (inside-out)"
|
|
V="${FW}/Versions/B"
|
|
for xpc in "$V"/XPCServices/*.xpc; do [ -e "$xpc" ] && sign "$xpc"; done
|
|
[ -e "$V/Updater.app/Contents/MacOS/Autoupdate" ] && sign "$V/Updater.app/Contents/MacOS/Autoupdate" || true
|
|
[ -e "$V/Updater.app" ] && sign "$V/Updater.app"
|
|
[ -e "$V/Autoupdate" ] && sign "$V/Autoupdate"
|
|
sign "$FW"
|
|
fi
|
|
|
|
echo "==> Signing ${APP}"
|
|
codesign --force --timestamp --options runtime \
|
|
--entitlements "$ENTITLEMENTS" --sign "$DEV_ID" "$APP"
|
|
|
|
echo "==> Verifying"
|
|
codesign --verify --strict --verbose=2 "$APP"
|
|
echo "✓ signed: $APP"
|