build.sh

#!/bin/bash
set -e

# Build and (optionally) sign+notarize the dir binary.
#
# For normal development you do not need this script:
#   go build -o dir .        # build in place
#   go install               # build and install to $GOPATH/bin (or $GOBIN)
#
# This script is only needed when distributing a signed+notarized binary.
# Run it from the root of the dir repository.

BINARY="dir"
IDENTITY='Developer ID Application: WILLIAM ANTONY MC NAMARA (VC4YYTGXP7)'
NOTARY_PROFILE="${NOTARY_PROFILE:-}"

NOBUILD=false
SIGN_BINARY=false
BUILD_UNIVERSAL=false

usage() {
    cat <<EOF
Usage: $0 [-nobuild] [-universal] [-sign] [-h|--help]

  For everyday development, use standard Go tooling instead:
    go build -o dir .     Build the binary in the current directory
    go install            Build and install to \$GOPATH/bin (or \$GOBIN)
    go test ./...         Run the test suite
    bash verify_search.sh Run integration verification

  This script adds:
    -universal   Build a universal (arm64 + x86_64) binary via lipo
    -sign        Code-sign and notarize with Developer ID (requires NOTARY_PROFILE)
    -nobuild     Skip the Go build; sign/notarize the existing binary
    -h/--help    Show this help

  Signing requires:
    1. Xcode Command Line Tools (xcrun, codesign, spctl)
    2. Developer ID Application certificate in your Keychain
    3. A notarytool credential profile, e.g.:
         xcrun notarytool store-credentials "AC_NOTARY" \\
           --apple-id "you@domain.com" \\
           --team-id "VC4YYTGXP7" \\
           --password "app-specific-password"
    4. NOTARY_PROFILE set to that profile name, e.g.:
         NOTARY_PROFILE=AC_NOTARY ./build.sh -sign

  Note: standalone binaries receive a notarization ticket but cannot be stapled.
  Distribute inside a signed+stapled .dmg or .pkg if Gatekeeper assessment is required.
EOF
}

verify_release_signature() {
    local binary="$1"
    local expected_identity='Developer ID Application: WILLIAM ANTONY MC NAMARA (VC4YYTGXP7)'
    local expected_team="VC4YYTGXP7"
    local details

    echo "🔎 Verifying release signature for $binary"

    if [ ! -f "$binary" ]; then
        echo "❌ Error: binary not found: $binary"
        return 1
    fi

    codesign --verify --strict --verbose=4 "$binary" || {
        echo "❌ Error: codesign verification failed for $binary"
        return 1
    }

    details="$(codesign -dv --verbose=4 "$binary" 2>&1)"

    if ! printf '%s\n' "$details" | grep -Fq "Authority=${expected_identity}"; then
        echo "❌ Error: $binary is not signed with the expected Developer ID identity."
        printf '%s\n' "$details"
        return 1
    fi

    if ! printf '%s\n' "$details" | grep -Fq "TeamIdentifier=${expected_team}"; then
        echo "❌ Error: $binary is not signed by the expected team (${expected_team})."
        printf '%s\n' "$details"
        return 1
    fi

    if ! printf '%s\n' "$details" | grep -Fq "flags=0x10000(runtime)"; then
        echo "❌ Error: $binary is missing the hardened runtime flag required for notarization."
        printf '%s\n' "$details"
        return 1
    fi

    echo "✅ Release signature verified"
}

assess_gatekeeper() {
    local binary="$1"
    local label="$2"
    local output status

    set +e
    output="$(spctl --assess --type execute --verbose=4 "$binary" 2>&1)"
    status=$?
    set -e

    printf '%s\n' "$output"
    if [ "$status" -eq 0 ]; then
        echo "$label: accepted"
        return 0
    fi

    if printf '%s\n' "$output" | grep -Fq "source=Unnotarized Developer ID"; then
        echo "$label: standalone binary assessed as Unnotarized Developer ID."
        echo "(Informational: standalone executables do not receive a stapled ticket.)"
        return 0
    fi

    echo "❌ $label: unexpected Gatekeeper assessment failure" >&2
    return 1
}

for arg in "$@"; do
    case $arg in
        -nobuild)
            NOBUILD=true
            echo "📦 Skipping build; will sign existing binary."
            ;;
        -universal)
            BUILD_UNIVERSAL=true
            echo "🧬 Universal binary (arm64 + x86_64) requested."
            ;;
        -sign)
            SIGN_BINARY=true
            echo "🔐 Code signing enabled."
            ;;
        -h|--help|-help)
            usage
            exit 0
            ;;
        *)
            echo "⚠️  Unknown flag: $arg" >&2
            usage >&2
            exit 1
            ;;
    esac
done

if [ "$NOBUILD" = true ] && [ "$BUILD_UNIVERSAL" = true ]; then
    echo "❌ Error: -nobuild and -universal are mutually exclusive." >&2
    exit 1
fi

# ── Step 1: Build ──────────────────────────────────────────────────────────────

if [ "$NOBUILD" = true ]; then
    echo "⏭️  Skipping build (-nobuild)."
    if [ ! -f "$BINARY" ]; then
        echo "❌ Error: $BINARY not found. Remove -nobuild or build first." >&2
        exit 1
    fi
elif [ "$BUILD_UNIVERSAL" = true ]; then
    echo "🔨 Building dir (arm64)..."
    GOARCH=arm64 GOOS=darwin go build -o "${BINARY}_arm64" .

    echo "🔨 Building dir (x86_64)..."
    GOARCH=amd64 GOOS=darwin go build -o "${BINARY}_amd64" .

    echo "🧬 Creating universal binary..."
    lipo -create "${BINARY}_arm64" "${BINARY}_amd64" -output "$BINARY"
    rm -f "${BINARY}_arm64" "${BINARY}_amd64"

    echo "🔍 Universal archs: $(lipo -archs "$BINARY")"
    echo "✅ Universal build complete."
else
    echo "🔨 Building dir..."
    go build -o "$BINARY" .
    echo "✅ Build complete."
fi

# ── Step 2: Sign and notarize ──────────────────────────────────────────────────

if [ "$SIGN_BINARY" = false ]; then
    echo ""
    echo "ℹ️  Binary built but not signed. Pass -sign to code-sign and notarize."
    exit 0
fi

if [ -z "$NOTARY_PROFILE" ]; then
    echo "❌ Error: NOTARY_PROFILE is not set." >&2
    echo "Example: NOTARY_PROFILE=AC_NOTARY ./build.sh -sign" >&2
    exit 1
fi

if ! command -v xcrun >/dev/null 2>&1; then
    echo "❌ Error: xcrun not found. Install Xcode Command Line Tools." >&2
    exit 1
fi
for tool in codesign security spctl zip shasum python3; do
    command -v "$tool" >/dev/null 2>&1 || {
        echo "❌ Error: required tool not found: $tool" >&2
        exit 1
    }
done

if ! security find-identity -v -p codesigning 2>/dev/null | grep -Fq "$IDENTITY"; then
    echo "❌ Error: signing identity not found in your Keychain:" >&2
    echo "  $IDENTITY" >&2
    echo "Available identities:" >&2
    security find-identity -v -p codesigning 2>/dev/null || true
    exit 1
fi

echo ""
echo "⚠️  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "⚠️  🔐 SIGNING dir BINARY WITH DEVELOPER ID"
echo "⚠️  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Binary:         $BINARY"
echo "Identity:       $IDENTITY"
echo "Notary profile: $NOTARY_PROFILE"
echo ""

echo "== Pre-sign status (if already signed) =="
codesign -dv --verbose=4 "$BINARY" 2>&1 || true
echo ""

chmod u+w "$BINARY" || true

echo "== Sign (Developer ID + hardened runtime + timestamp) =="
codesign --force \
    --sign "$IDENTITY" \
    --options runtime \
    --timestamp \
    --verbose \
    "$BINARY"

echo ""
echo "== Verify signature (codesign) =="
codesign --verify --strict --verbose=4 "$BINARY"
codesign -dv --verbose=4 "$BINARY" 2>&1

echo ""
echo "== Gatekeeper assessment (pre-notarization, informational) =="
assess_gatekeeper "$BINARY" "Pre-notarization"

echo ""
echo "== Create notarization archive =="
TMPDIR_NOTARY="$(mktemp -d)"
cleanup() { rm -rf "$TMPDIR_NOTARY"; }
trap cleanup EXIT

STAGE="$TMPDIR_NOTARY/stage"
mkdir -p "$STAGE"
cp -p "$BINARY" "$STAGE/$BINARY"

ZIP_OUT="$TMPDIR_NOTARY/dir_notarize.zip"
(
    cd "$STAGE"
    zip -qryX "$ZIP_OUT" "$BINARY"
)
echo "Zip: $ZIP_OUT"
echo "Zip SHA-256: $(shasum -a 256 "$ZIP_OUT" | awk '{print $1}')"

echo ""
echo "== Submit for notarization (waiting) =="
SUBMIT_JSON="$TMPDIR_NOTARY/notary_submit.json"
SUBMIT_ERROR="$TMPDIR_NOTARY/notary_submit.stderr"
set +e
xcrun notarytool submit "$ZIP_OUT" \
    --keychain-profile "$NOTARY_PROFILE" \
    --wait \
    --output-format json 2>"$SUBMIT_ERROR" | tee "$SUBMIT_JSON"
SUBMIT_STATUS=${PIPESTATUS[0]}
set -e
cat "$SUBMIT_ERROR" >&2

if [ "$SUBMIT_STATUS" -ne 0 ]; then
    if grep -Eiq 'required agreement is missing|agreement.*(expired|not been signed)' \
            "$SUBMIT_ERROR" "$SUBMIT_JSON" 2>/dev/null; then
        echo "" >&2
        echo "❌ Apple Developer agreement action required." >&2
        echo "   Sign in as the team Account Holder and accept the pending agreement:" >&2
        echo "   https://developer.apple.com/account/" >&2
        echo "   Look for the \"Review Agreement\" banner, accept, then retry." >&2
    fi
    exit "$SUBMIT_STATUS"
fi

echo ""
echo "== Notarization summary =="
python3 - <<'PY' "$SUBMIT_JSON"
import json, sys
data = json.load(open(sys.argv[1]))
for k in ("id", "status", "message", "createdDate", "finishedDate"):
    if k in data:
        print(f"{k}: {data[k]}")
status = data.get("status", "").lower()
if status not in ("accepted", "success"):
    raise SystemExit(2)
PY

REQUEST_ID="$(python3 - <<'PY' "$SUBMIT_JSON"
import json, sys
print(json.load(open(sys.argv[1])).get("id", ""))
PY
)"

echo ""
echo "== Notarization log =="
if [ -n "$REQUEST_ID" ]; then
    xcrun notarytool log "$REQUEST_ID" --keychain-profile "$NOTARY_PROFILE" || true
fi

echo ""
echo "== Post-notarization verification =="
codesign --verify --strict --verbose=4 "$BINARY"
codesign -dv --verbose=4 "$BINARY" 2>&1

echo ""
echo "== Gatekeeper assessment (post-notarization, informational) =="
assess_gatekeeper "$BINARY" "Post-notarization"

echo ""
verify_release_signature "$BINARY" || exit 1

echo ""
echo "✅ dir is built, signed, and notarized."
echo "Note: standalone binaries cannot be stapled. Wrap in a signed+stapled .dmg"
echo "or .pkg if distributing in a context where Gatekeeper assessment is required."