T26: a release's macOS disk image is signed with the owner's Developer ID and notarized: mac-app.sh signs under the hardened runtime and notarizes and staples the image when given an identity and the App Store Connect key; the Release workflow, dispatched by hand, runs it on the macos-signing runner and puts the image on the draft through release-asset.sh

scripts/mac-app.sh

@@ -1,7 +1,18 @@
 #!/bin/sh
-# mac-app.sh: ELYTerminal.app in target/release, signed ad hoc, and its disk image.
+# mac-app.sh: ELYTerminal.app in target/release and its disk image, signed ad hoc, or by SIGN_IDENTITY and notarized.
 set -eu
 cd "$(dirname "$0")/.."
+sign=${SIGN_IDENTITY:-}
+if [ -n "$sign" ]; then
+  [ -s "${NOTARY_KEY:-}" ] && [ -n "${NOTARY_KEY_ID:-}" ] && [ -n "${NOTARY_ISSUER:-}" ] || {
+    echo "mac-app: SIGN_IDENTITY needs NOTARY_KEY (a .p8 file), NOTARY_KEY_ID and NOTARY_ISSUER" >&2
+    exit 1
+  }
+  security find-identity -v -p codesigning | grep -q -F "\"$sign\"" || {
+    echo "mac-app: no valid identity \"$sign\" in the keychains" >&2
+    exit 1
+  }
+fi
 cargo build --release --locked
 version=$(cargo pkgid)
 version=${version##*[#@]}
@@ -38,11 +49,29 @@ cat > "$app/Contents/Info.plist" <<EOF
 </plist>
 EOF
 plutil -lint -s "$app/Contents/Info.plist"
-codesign --force --sign - "$app"
+if [ -n "$sign" ]; then
+  codesign --force --options runtime --timestamp --sign "$sign" "$app"
+else
+  codesign --force --sign - "$app"
+fi
 mkdir "$work/disk"
 ditto "$app" "$work/disk/ELYTerminal.app"
 ln -s /Applications "$work/disk/Applications"
 dmg=$out/ELYTerminal-$version.dmg
 hdiutil create -quiet -volname ELYTerminal -srcfolder "$work/disk" -ov -format UDZO "$dmg"
+if [ -n "$sign" ]; then
+  codesign --force --timestamp --sign "$sign" "$dmg"
+  notary() { xcrun notarytool "$@" --key "$NOTARY_KEY" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"; }
+  notary submit "$dmg" --wait --output-format json > "$work/notary.json" || true
+  status=$(plutil -extract status raw -o - "$work/notary.json" 2>/dev/null || echo none)
+  echo "mac-app: notarization $status"
+  if [ "$status" != Accepted ]; then
+    cat "$work/notary.json" >&2
+    id=$(plutil -extract id raw -o - "$work/notary.json" 2>/dev/null) && notary log "$id" >&2
+    exit 1
+  fi
+  xcrun stapler staple "$dmg"
+  spctl --assess --type open --context context:primary-signature --verbose "$dmg"
+fi
 echo "mac-app: $app"
 echo "mac-app: $dmg"

scripts/release-asset.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# release-asset.sh FILE: puts FILE on the Gitea release of this version, a draft too, in place of one of its name.
+set -eu
+cd "$(dirname "$0")/.."
+file=$1
+[ -f "$file" ] || { echo "release-asset: no file $file" >&2; exit 1; }
+: "${RELEASE_API:?release-asset: RELEASE_API names the repository API, https://HOST/api/v1/repos/OWNER/REPO}"
+: "${RELEASE_TOKEN:?release-asset: RELEASE_TOKEN is a token that may edit the releases}"
+version=$(cargo pkgid)
+version=${version##*[#@]}
+name=$(basename "$file")
+auth="Authorization: token $RELEASE_TOKEN"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+curl -fsS -H "$auth" "$RELEASE_API/releases?limit=50" > "$work/releases.json"
+ids=$(python3 -c '
+import json, sys
+tag, name, path = sys.argv[1:]
+found = [r for r in json.load(open(path)) if r["tag_name"] == tag]
+if len(found) != 1:
+    sys.exit(f"release-asset: {len(found)} releases tagged {tag}")
+print(found[0]["id"], *(a["id"] for a in found[0]["assets"] if a["name"] == name))
+' "v$version" "$name" "$work/releases.json")
+set -- $ids
+release=$1
+shift
+for old in "$@"; do
+  curl -fsS -X DELETE -H "$auth" "$RELEASE_API/releases/$release/assets/$old"
+  echo "release-asset: removed the old $name"
+done
+curl -fsS -H "$auth" -F "attachment=@$file" "$RELEASE_API/releases/$release/assets?name=$name" > /dev/null
+echo "release-asset: $name on release $release, v$version"