shifathosn
/
lightcraft
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge PR #959

This commit is contained in:
Claude 2026-10-11 11:51:56 +00:00
parent 62ece65ac9 0b960d39e3
commit 5ce115a505
No known key found for this signature in database
1 changed files with 59 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
packaging/macos/package.sh
View File

@ -112,6 +112,10 @@ printf 'APPL????' >"$APP/Contents/PkgInfo"
mkdir -p "$APP/Contents/Resources/Licenses"
copy_docs "$APP/Contents/Resources/Licenses"
# Remove inherited build-time extended attributes BEFORE code signing.
# Never repair, re-sign or strip metadata from the published release after signing.
xattr -cr "$APP"
# Sign inside-out: nested code first, then the bundle itself (no --deep on the final signature).
# Today the only nested code is the main executable; frameworks/helpers would be signed here too.
sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/MacOS/LightCraft"
@ -136,15 +140,63 @@ ln -s /Applications "$STAGE/Applications"
mkdir -p "$STAGE/.background"
cp "$HERE/dmg/background.tiff" "$STAGE/.background/background.tiff"
cp "$HERE/dmg/dmg-layout.DS_Store" "$STAGE/.DS_Store"
rm -f "$DMG" "$WORK/raw.dmg"
# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
# The volume name has no version: .DS_Store finds the background through an alias that includes it.
hdiutil makehybrid -hfs -hfs-volume-name "LightCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
rm -f "$WORK/raw.dmg"
rm -f "$DMG"
# hdiutil makehybrid -hfs injects FinderInfo metadata into the signed app.
# create -srcfolder preserves the signed app and the existing .DS_Store layout.
# hdiutil may transiently return "Resource busy" on CI; retry boundedly.
hdiutil_retry() {
local attempt
for attempt in 1 2 3 4 5; do
if hdiutil "$@"; then
return 0
fi
if [ "$attempt" = 5 ]; then
echo "error: hdiutil $1 failed after five attempts" >&2
return 1
fi
warn "hdiutil $1 attempt $attempt failed; retrying"
sleep $((attempt * 10))
done
}
hdiutil_retry create -srcfolder "$STAGE" -volname "LightCraft" -fs HFS+ -format UDZO \
-imagekey zlib-level=9 -ov "$DMG"
sign "$DMG"
codesign --verify --strict --verbose=2 "$DMG"
# Verification must use the FINISHED image (and a normal ditto-installed copy).
# Signatures of the DMG container alone do not validate the bundle in the image.
verify_dmg_app() {
local mount="$WORK/dmg-verify-mount" copy="$WORK/dmg-verify-copy" rc=0
mkdir -p "$mount" "$copy"
if ! hdiutil_retry attach -readonly -nobrowse -noautoopen -mountpoint "$mount" "$DMG" >/dev/null; then
echo "error: unable to mount finished $DMG" >&2
hdiutil detach "$mount" >/dev/null 2>&1 || true
return 1
fi
echo "==> strict codesign of LightCraft.app in finished DMG"
codesign --verify --deep --strict --verbose=2 "$mount/LightCraft.app" || rc=1
if [ "$rc" = 0 ]; then
ditto "$mount/LightCraft.app" "$copy/LightCraft.app" || rc=1
fi
if [ "$rc" = 0 ]; then
echo "==> strict codesign of LightCraft.app after ditto install-copy"
codesign --verify --deep --strict --verbose=2 "$copy/LightCraft.app" || rc=1
fi
if [ "$rc" = 0 ] && [ "$NOTARIZE" = 1 ]; then
spctl --assess --type execute -vvv "$copy/LightCraft.app" || rc=1
fi
if [ "$rc" != 0 ]; then
echo "error: published-image app verification failed; reject $DMG" >&2
xattr -lr "$mount/LightCraft.app" >&2 || true
fi
if ! hdiutil_retry detach "$mount" >/dev/null; then
echo "error: could not detach verification mount" >&2
rc=1
fi
rm -rf "$copy"
return "$rc"
}
verify_dmg_app
if [ "$NOTARIZE" = 1 ]; then
notarize "$DMG"
xcrun stapler staple "$DMG"