George BrancoviciandClaude Opus 4.6
c9492c90ea
Enables distributing Galaxy.app to end users without Gatekeeper warnings. Uses Samsung Developer ID Application certificate with hardened runtime. Pipeline: cargo bundle → sign.sh → notarize.sh → package.sh → Galaxy.dmg Entitlements: - network.client (AWS Bedrock API calls) - automation.apple-events (osascript for CLI install) - cs.allow-unsigned-executable-memory (Metal shader compilation) Orchestration scripts: - build-debug.sh: full pipeline with debug build - build-release.sh: full pipeline with release build Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
57 lines
1.5 KiB
Bash
Executable File
57 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
cd "$(dirname "$0")"
|
|
|
|
SIGNING_IDENTITY="Developer ID Application: SAMSUNG ELECTRONICS AMERICA, INC. (3JU72Z7Y3J)"
|
|
ENTITLEMENTS="BuildSupport/Galaxy.entitlements"
|
|
|
|
if [ "$1" = "--release" ]; then
|
|
APP_PATH="target/release/bundle/osx/Galaxy.app"
|
|
else
|
|
APP_PATH="target/debug/bundle/osx/Galaxy.app"
|
|
fi
|
|
|
|
if [ ! -d "$APP_PATH" ]; then
|
|
echo "Error: $APP_PATH not found."
|
|
echo "Run first: cargo bundle --bin galaxy-oss --package galaxy"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$ENTITLEMENTS" ]; then
|
|
echo "Error: $ENTITLEMENTS not found."
|
|
exit 1
|
|
fi
|
|
|
|
JUNK=$(find "$APP_PATH" -maxdepth 1 -not -name "Contents" -not -path "$APP_PATH" 2>/dev/null || true)
|
|
if [ -n "$JUNK" ]; then
|
|
echo "Removing unsealed items from bundle root: $JUNK"
|
|
echo "$JUNK" | xargs rm -rf
|
|
fi
|
|
|
|
echo "Removing .DS_Store files..."
|
|
find "$APP_PATH" -name '.DS_Store' -delete 2>/dev/null || true
|
|
|
|
echo "Stripping extended attributes..."
|
|
xattr -cr "$APP_PATH"
|
|
|
|
echo "Signing $APP_PATH..."
|
|
codesign --force --sign "$SIGNING_IDENTITY" \
|
|
--entitlements "$ENTITLEMENTS" \
|
|
--options runtime \
|
|
--timestamp \
|
|
"$APP_PATH/Contents/MacOS/galaxy-oss"
|
|
|
|
codesign --force --sign "$SIGNING_IDENTITY" \
|
|
--entitlements "$ENTITLEMENTS" \
|
|
--options runtime \
|
|
--timestamp \
|
|
"$APP_PATH"
|
|
|
|
echo "Verifying signature..."
|
|
codesign --verify --strict "$APP_PATH"
|
|
codesign -dvvv "$APP_PATH" 2>&1 | grep -E "Authority|TeamIdentifier|Runtime"
|
|
echo "Architecture: $(lipo -archs "$APP_PATH/Contents/MacOS/galaxy-oss")"
|
|
|
|
echo ""
|
|
echo "Done. Galaxy.app is signed and ready for notarization."
|