accounts and email

apps/macos-sync/scripts/sign-dev.sh

@@ -0,0 +1,63 @@
+#!/bin/zsh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PACKAGE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$PACKAGE_DIR"
+
+product="${1:-CairnquireSync}"
+case "$product" in
+  CairnquireSync)
+    signing_identifier="com.cairnquire.sync"
+    ;;
+  cairnquire-cli)
+    signing_identifier="com.cairnquire.cli"
+    ;;
+  *)
+    echo "Unsupported product: $product" >&2
+    echo "Usage: scripts/sign-dev.sh [CairnquireSync|cairnquire-cli]" >&2
+    exit 2
+    ;;
+esac
+
+identity="${CAIRNQUIRE_CODESIGN_IDENTITY:-}"
+if [[ -z "$identity" ]]; then
+  identity="$(
+    security find-identity -v -p codesigning \
+      | awk -F '"' '/Apple Development/ { print $2; exit }'
+  )"
+fi
+
+if [[ -z "$identity" ]]; then
+  echo "No Apple Development signing identity found." >&2
+  echo "Create one in Xcode, then verify with:" >&2
+  echo "  security find-identity -v -p codesigning" >&2
+  exit 1
+fi
+
+swift build --product "$product"
+
+executable=".build/debug/$product"
+if [[ ! -f "$executable" ]]; then
+  executable="$(find .build -path "*/debug/$product" -type f -perm -111 | head -n 1)"
+fi
+
+if [[ -z "$executable" || ! -f "$executable" ]]; then
+  echo "Built executable not found for product: $product" >&2
+  exit 1
+fi
+
+codesign \
+  --force \
+  --sign "$identity" \
+  --identifier "$signing_identifier" \
+  --timestamp=none \
+  "$executable"
+
+echo "Signed $executable"
+codesign -dvvv --requirements - "$executable" 2>&1 | sed -n '1,80p'
+echo
+echo "Run the signed executable directly:"
+echo "  $executable"
+echo
+echo "Avoid 'swift run $product' after signing; it can rebuild and replace the signed executable."