Clean release snapshot

2026-08-16 05:37:40 +00:00 · 2026-06-16 18:48:12 +02:00
commit bd603184d5
291 changed files with 47318 additions and 0 deletions
@@ -0,0 +1,98 @@
+#!/bin/bash
+# Sign every native binary inside resources/bin and resources/python/runtime
+# with the Developer ID Application certificate so the .app passes
+# notarization. Runs as part of the macOS bundle step, after binaries
+# are downloaded/copied but before verify_bundled_binaries runs them
+# (signing also clears the quarantine attribute that GitHub release
+# downloads carry by default).
+#
+# Skips silently when APPLE_SIGNING_IDENTITY is unset — local builds
+# without a Developer ID cert still produce a (Gatekeeper-rejected)
+# unsigned .app, same as before this script existed.
+#
+# Required env (set by CI):
+#   APPLE_SIGNING_IDENTITY  Full identity string, e.g.
+#                           "Developer ID Application: Name (TEAMID)"
+#                           Must already be present in the active keychain.
+
+set -euo pipefail
+
+if [[ -z "${APPLE_SIGNING_IDENTITY:-}" ]]; then
+    echo "[sign-macos] APPLE_SIGNING_IDENTITY not set — skipping (unsigned build)"
+    exit 0
+fi
+
+if [[ "$OSTYPE" != "darwin"* ]]; then
+    echo "[sign-macos] not on macOS — skipping" >&2
+    exit 0
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+ENTITLEMENTS="$PROJECT_DIR/resources/entitlements.mac.plist"
+
+if [[ ! -f "$ENTITLEMENTS" ]]; then
+    echo "[sign-macos] entitlements file missing: $ENTITLEMENTS" >&2
+    exit 1
+fi
+
+sign_one() {
+    local target="$1"
+    [[ -e "$target" ]] || return 0
+    # Skip symlinks — they get followed during bundling and signing the
+    # link target separately is enough.
+    [[ -L "$target" ]] && return 0
+    echo "  $target"
+    codesign --force --options runtime --timestamp \
+        --sign "$APPLE_SIGNING_IDENTITY" \
+        --entitlements "$ENTITLEMENTS" \
+        "$target"
+}
+
+echo "[sign-macos] signing bundled binaries with: $APPLE_SIGNING_IDENTITY"
+
+# 1. Top-level executables and bundled dylibs in resources/bin.
+#    dylibbundler copies fluidsynth's deps into this directory and
+#    rewrites their install names to @executable_path/, so each one
+#    has to be signed individually before the app bundle is built.
+BIN_DIR="$PROJECT_DIR/resources/bin"
+if [[ -d "$BIN_DIR" ]]; then
+    while IFS= read -r -d '' f; do
+        sign_one "$f"
+    done < <(find "$BIN_DIR" -maxdepth 1 -type f \( -perm -u+x -o -name '*.dylib' \) -print0)
+fi
+
+# 2. Embedded CPython runtime — interpreter + libpython dylib + every
+#    compiled extension. Notarization rejects the bundle if any of
+#    these is unsigned.
+PY_RUNTIME="$PROJECT_DIR/resources/python/runtime"
+if [[ -d "$PY_RUNTIME" ]]; then
+    # Interpreter binaries (python3, python3.x, etc.)
+    while IFS= read -r -d '' f; do
+        sign_one "$f"
+    done < <(find "$PY_RUNTIME/bin" -maxdepth 1 -type f -perm -u+x -print0 2>/dev/null || true)
+
+    # libpython dylib(s) and any other shared libs
+    while IFS= read -r -d '' f; do
+        sign_one "$f"
+    done < <(find "$PY_RUNTIME/lib" -maxdepth 2 -type f -name '*.dylib' -print0 2>/dev/null || true)
+
+    # Compiled extension modules — both stdlib lib-dynload and any
+    # site-packages C extensions installed via pip.
+    while IFS= read -r -d '' f; do
+        sign_one "$f"
+    done < <(find "$PY_RUNTIME/lib" -type f \( -name '*.so' -o -name '*.dylib' \) -print0 2>/dev/null || true)
+fi
+
+echo "[sign-macos] done"
+
+# Spot-check a couple of binaries so a botched sign call fails the
+# build here rather than mid-notarization 2 minutes later.
+for probe in "$BIN_DIR/fluidsynth" "$BIN_DIR/ffmpeg" "$BIN_DIR/vgmstream-cli"; do
+    if [[ -f "$probe" ]]; then
+        codesign --verify --strict "$probe" || {
+            echo "[sign-macos] verification failed: $probe" >&2
+            exit 1
+        }
+    fi
+done