Add advanced monitoring and release infrastructure

scripts/notarize-release.sh

@@ -0,0 +1,35 @@
+#!/bin/zsh
+set -euo pipefail
+
+PROJECT_DIR="${0:A:h:h}"
+DMG_PATH="${1:-$PROJECT_DIR/dist/puter-macOS.dmg}"
+APP_PATH="$PROJECT_DIR/dist/puter.app"
+NOTARY_PROFILE="${PUTER_NOTARY_PROFILE:-}"
+NOTARY_KEY_PATH="${PUTER_NOTARY_KEY_PATH:-}"
+NOTARY_KEY_ID="${PUTER_NOTARY_KEY_ID:-}"
+NOTARY_ISSUER="${PUTER_NOTARY_ISSUER:-}"
+
+if [[ -z "$NOTARY_PROFILE" && ( -z "$NOTARY_KEY_PATH" || -z "$NOTARY_KEY_ID" || -z "$NOTARY_ISSUER" ) ]]; then
+    print -u2 "Set PUTER_NOTARY_PROFILE or the PUTER_NOTARY_KEY_PATH, PUTER_NOTARY_KEY_ID, and PUTER_NOTARY_ISSUER variables."
+    exit 2
+fi
+if [[ ! -f "$DMG_PATH" ]]; then
+    print -u2 "DMG not found: $DMG_PATH"
+    exit 2
+fi
+
+codesign --verify --strict "$DMG_PATH"
+if [[ -n "$NOTARY_PROFILE" ]]; then
+    xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
+else
+    xcrun notarytool submit "$DMG_PATH" \
+        --key "$NOTARY_KEY_PATH" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER" --wait
+fi
+xcrun stapler staple "$DMG_PATH"
+xcrun stapler validate "$DMG_PATH"
+if [[ -d "$APP_PATH" ]]; then
+    xcrun stapler staple "$APP_PATH"
+    xcrun stapler validate "$APP_PATH"
+fi
+spctl --assess --type open --context context:primary-signature -v "$DMG_PATH"
+print "Notarized and stapled $DMG_PATH"