From 4058095a946406be63285a6de1264a5134c99671 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Mon, 30 Mar 2026 21:24:30 -0700 Subject: [PATCH] refactor(release): enhance DMG notarization and stapling process - Updated the build script to re-create the DMG with the stapled .app, ensuring compliance with Apple notarization requirements. - Added notarization step for the DMG using xcrun notarytool, improving the overall security and integrity of the release process. - Enhanced comments for clarity on the new notarization and stapling steps. --- scripts/build-macos-signed.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/scripts/build-macos-signed.sh b/scripts/build-macos-signed.sh index f0aa0b04a..cdc4b95a2 100755 --- a/scripts/build-macos-signed.sh +++ b/scripts/build-macos-signed.sh @@ -210,13 +210,21 @@ else echo "Stapling notarization ticket..." xcrun stapler staple "$APP_PATH" - # Re-create DMG after stapling if dmg was in bundle targets + # Re-create DMG with stapled .app, notarize the DMG, then staple it DMG_PATH="$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -maxdepth 1 2>/dev/null | head -1)" if [[ -n "$DMG_PATH" ]]; then echo "Re-creating DMG with stapled .app..." DMG_TEMP="$(mktemp /tmp/OpenHuman-XXXXXX.dmg)" hdiutil create -volname "OpenHuman" -srcfolder "$APP_PATH" -ov -format UDZO "$DMG_TEMP" mv "$DMG_TEMP" "$DMG_PATH" + + echo "Notarizing DMG..." + xcrun notarytool submit "$DMG_PATH" \ + --apple-id "$APPLE_ID" \ + --password "$APPLE_PASSWORD" \ + --team-id "$APPLE_TEAM_ID" \ + --wait + xcrun stapler staple "$DMG_PATH" fi