build-and-notarize.sh

#!/bin/bash

# PrinceUI Build and Notarization Script
# This script builds, signs, notarizes, and packages PrinceUI for distribution

set -e  # Exit on any error

# Configuration
PROJECT_NAME="PrinceUI"
SCHEME="PrinceUI"
CONFIGURATION="Release"
TEAM_ID="4E5NT753KC"
SIGNING_IDENTITY="Developer ID Application: YesLogic Pty. Ltd. (4E5NT753KC)"
KEYCHAIN_PROFILE="PrinceUI-Notary"

# Directories
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILD_DIR="$PROJECT_DIR/build"
ARCHIVE_PATH="$BUILD_DIR/${PROJECT_NAME}.xcarchive"
EXPORT_PATH="$BUILD_DIR/export"
EXPORT_OPTIONS="$BUILD_DIR/ExportOptions.plist"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Functions
log_info() {
    echo -e "${BLUE}ℹ ${NC} $1"
}

log_success() {
    echo -e "${GREEN}✓${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}⚠${NC} $1"
}

log_error() {
    echo -e "${RED}✗${NC} $1"
}

log_step() {
    echo ""
    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
    echo -e "${BLUE}  $1${NC}"
    echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}"
}

# Check prerequisites
check_prerequisites() {
    log_step "Checking Prerequisites"

    # Check Xcode
    if ! command -v xcodebuild &> /dev/null; then
        log_error "Xcode command line tools not found"
        exit 1
    fi
    log_success "Xcode found: $(xcodebuild -version | head -1)"

    # Check signing identity
    if ! security find-identity -v -p codesigning | grep -q "$SIGNING_IDENTITY"; then
        log_error "Signing identity not found: $SIGNING_IDENTITY"
        log_info "Available identities:"
        security find-identity -v -p codesigning
        exit 1
    fi
    log_success "Signing identity verified"

    # Check keychain profile
    if ! xcrun notarytool history --keychain-profile "$KEYCHAIN_PROFILE" &> /dev/null; then
        log_warning "Keychain profile '$KEYCHAIN_PROFILE' not found"
        log_info "You'll need to set it up with:"
        log_info "  xcrun notarytool store-credentials \"$KEYCHAIN_PROFILE\" \\"
        log_info "    --apple-id \"your-apple-id@example.com\" \\"
        log_info "    --team-id \"$TEAM_ID\" \\"
        log_info "    --password \"your-app-specific-password\""
        echo ""
        read -p "Continue without notarization? (y/N) " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            exit 1
        fi
        SKIP_NOTARIZATION=true
    else
        log_success "Keychain profile verified"
        SKIP_NOTARIZATION=false
    fi
}

# Clean build directory
clean_build() {
    log_step "Cleaning Build Directory"

    if [ -d "$BUILD_DIR" ]; then
        rm -rf "$BUILD_DIR"
        log_success "Removed old build directory"
    fi

    mkdir -p "$BUILD_DIR"
    log_success "Created fresh build directory"
}

# Archive the application
archive_app() {
    log_step "Archiving Application"

    log_info "Building $PROJECT_NAME in $CONFIGURATION configuration..."

    xcodebuild archive \
        -project "$PROJECT_DIR/${PROJECT_NAME}.xcodeproj" \
        -scheme "$SCHEME" \
        -configuration "$CONFIGURATION" \
        -archivePath "$ARCHIVE_PATH" \
        CODE_SIGN_IDENTITY="$SIGNING_IDENTITY" \
        CODE_SIGN_STYLE=Manual \
        DEVELOPMENT_TEAM="$TEAM_ID" \
        | xcpretty || xcodebuild archive \
        -project "$PROJECT_DIR/${PROJECT_NAME}.xcodeproj" \
        -scheme "$SCHEME" \
        -configuration "$CONFIGURATION" \
        -archivePath "$ARCHIVE_PATH" \
        CODE_SIGN_IDENTITY="$SIGNING_IDENTITY" \
        CODE_SIGN_STYLE=Manual \
        DEVELOPMENT_TEAM="$TEAM_ID"

    if [ ! -d "$ARCHIVE_PATH" ]; then
        log_error "Archive failed"
        exit 1
    fi

    log_success "Archive created: $ARCHIVE_PATH"
}

# Export the application
export_app() {
    log_step "Exporting Application"

    # Create export options plist
    log_info "Creating export options..."
    cat > "$EXPORT_OPTIONS" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>developer-id</string>
    <key>signingStyle</key>
    <string>manual</string>
    <key>teamID</key>
    <string>$TEAM_ID</string>
    <key>signingCertificate</key>
    <string>Developer ID Application</string>
</dict>
</plist>
EOF

    log_info "Exporting archive..."
    xcodebuild -exportArchive \
        -archivePath "$ARCHIVE_PATH" \
        -exportPath "$EXPORT_PATH" \
        -exportOptionsPlist "$EXPORT_OPTIONS"

    if [ ! -d "$EXPORT_PATH/${PROJECT_NAME}.app" ]; then
        log_error "Export failed"
        exit 1
    fi

    log_success "Application exported: $EXPORT_PATH/${PROJECT_NAME}.app"
}

# Verify code signing
verify_signing() {
    log_step "Verifying Code Signing"

    APP_PATH="$EXPORT_PATH/${PROJECT_NAME}.app"

    log_info "Checking signature..."
    codesign -dv --verbose=4 "$APP_PATH" 2>&1 | head -10

    log_info "Checking entitlements..."
    codesign -d --entitlements - "$APP_PATH"

    log_info "Verifying with spctl..."
    if spctl -a -vv "$APP_PATH" 2>&1 | grep -q "accepted"; then
        log_success "Code signature verified"
    else
        log_warning "spctl verification returned warnings (this is normal before notarization)"
    fi
}

# Create ZIP for notarization
create_zip() {
    log_step "Creating ZIP for Notarization"

    cd "$EXPORT_PATH"
    ZIP_NAME="${PROJECT_NAME}.zip"

    log_info "Creating $ZIP_NAME..."
    ditto -c -k --keepParent "${PROJECT_NAME}.app" "$ZIP_NAME"

    cd "$PROJECT_DIR"
    log_success "ZIP created: $EXPORT_PATH/$ZIP_NAME"
}

# Notarize the application
notarize_app() {
    if [ "$SKIP_NOTARIZATION" = true ]; then
        log_warning "Skipping notarization (keychain profile not configured)"
        return
    fi

    log_step "Notarizing Application"

    ZIP_PATH="$EXPORT_PATH/${PROJECT_NAME}.zip"

    log_info "Submitting to Apple for notarization..."
    log_info "This may take several minutes..."

    SUBMISSION_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
        --keychain-profile "$KEYCHAIN_PROFILE" \
        --wait 2>&1)

    echo "$SUBMISSION_OUTPUT"

    if echo "$SUBMISSION_OUTPUT" | grep -q "status: Accepted"; then
        log_success "Notarization successful!"

        # Extract submission ID for reference
        SUBMISSION_ID=$(echo "$SUBMISSION_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
        log_info "Submission ID: $SUBMISSION_ID"

        return 0
    else
        log_error "Notarization failed"

        # Try to extract submission ID for logs
        SUBMISSION_ID=$(echo "$SUBMISSION_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
        if [ ! -z "$SUBMISSION_ID" ]; then
            log_info "Fetching detailed log..."
            xcrun notarytool log "$SUBMISSION_ID" --keychain-profile "$KEYCHAIN_PROFILE"
        fi

        exit 1
    fi
}

# Staple notarization ticket
staple_app() {
    if [ "$SKIP_NOTARIZATION" = true ]; then
        log_warning "Skipping stapling (notarization was skipped)"
        return
    fi

    log_step "Stapling Notarization Ticket"

    APP_PATH="$EXPORT_PATH/${PROJECT_NAME}.app"

    log_info "Stapling ticket to application..."
    xcrun stapler staple "$APP_PATH"

    log_info "Verifying staple..."
    xcrun stapler validate "$APP_PATH"

    log_success "Notarization ticket stapled successfully"

    log_info "Final verification with spctl..."
    spctl -a -vv "$APP_PATH"
}

# Create DMG
create_dmg() {
    log_step "Creating DMG"

    APP_PATH="$EXPORT_PATH/${PROJECT_NAME}.app"
    DMG_PATH="$BUILD_DIR/${PROJECT_NAME}.dmg"

    log_info "Creating disk image..."
    hdiutil create -volname "$PROJECT_NAME" \
        -srcfolder "$APP_PATH" \
        -ov -format UDZO \
        "$DMG_PATH"

    if [ ! -f "$DMG_PATH" ]; then
        log_error "DMG creation failed"
        exit 1
    fi

    log_success "DMG created: $DMG_PATH"

    # Get DMG size
    DMG_SIZE=$(du -h "$DMG_PATH" | cut -f1)
    log_info "DMG size: $DMG_SIZE"
}

# Notarize DMG
notarize_dmg() {
    if [ "$SKIP_NOTARIZATION" = true ]; then
        log_warning "Skipping DMG notarization"
        return
    fi

    log_step "Notarizing DMG"

    DMG_PATH="$BUILD_DIR/${PROJECT_NAME}.dmg"

    log_info "Submitting DMG for notarization..."
    SUBMISSION_OUTPUT=$(xcrun notarytool submit "$DMG_PATH" \
        --keychain-profile "$KEYCHAIN_PROFILE" \
        --wait 2>&1)

    echo "$SUBMISSION_OUTPUT"

    if echo "$SUBMISSION_OUTPUT" | grep -q "status: Accepted"; then
        log_success "DMG notarization successful!"

        log_info "Stapling ticket to DMG..."
        xcrun stapler staple "$DMG_PATH"

        log_info "Verifying DMG staple..."
        xcrun stapler validate "$DMG_PATH"

        log_success "DMG notarization complete"
    else
        log_error "DMG notarization failed"
        exit 1
    fi
}

# Print summary
print_summary() {
    log_step "Build Summary"

    APP_PATH="$EXPORT_PATH/${PROJECT_NAME}.app"
    DMG_PATH="$BUILD_DIR/${PROJECT_NAME}.dmg"

    echo ""
    log_success "Build and notarization complete!"
    echo ""
    echo "  Application: $APP_PATH"

    if [ -f "$DMG_PATH" ]; then
        echo "  DMG:         $DMG_PATH"
    fi

    echo ""

    if [ "$SKIP_NOTARIZATION" = true ]; then
        log_warning "Application was NOT notarized"
        log_info "To notarize, set up keychain profile and run again"
    else
        log_success "Application is signed and notarized"
        log_info "Ready for distribution"
    fi

    echo ""
    log_info "You can now distribute:"
    echo "  - The .app bundle (in a ZIP)"
    if [ -f "$DMG_PATH" ]; then
        echo "  - The .dmg file"
    fi
    echo ""
}

# Main execution
main() {
    echo ""
    echo "╔════════════════════════════════════════════════════════════╗"
    echo "║                                                            ║"
    echo "║          PrinceUI Build & Notarization Script              ║"
    echo "║                                                            ║"
    echo "╚════════════════════════════════════════════════════════════╝"
    echo ""

    check_prerequisites
    clean_build
    archive_app
    export_app
    verify_signing
    create_zip
    notarize_app
    staple_app
    create_dmg
    notarize_dmg
    print_summary
}

# Run main function
main "$@"