#!/bin/zsh
set -euo pipefail

PROJECT_DIR="${0:A:h:h}"
DMG_PATH="${1:-$PROJECT_DIR/dist/puter-macOS.dmg}"
APP_PATH="$PROJECT_DIR/dist/puter.app"
NOTARY_PROFILE="${PUTER_NOTARY_PROFILE:-}"
NOTARY_KEY_PATH="${PUTER_NOTARY_KEY_PATH:-}"
NOTARY_KEY_ID="${PUTER_NOTARY_KEY_ID:-}"
NOTARY_ISSUER="${PUTER_NOTARY_ISSUER:-}"

if [[ -z "$NOTARY_PROFILE" && ( -z "$NOTARY_KEY_PATH" || -z "$NOTARY_KEY_ID" || -z "$NOTARY_ISSUER" ) ]]; then
    print -u2 "Set PUTER_NOTARY_PROFILE or the PUTER_NOTARY_KEY_PATH, PUTER_NOTARY_KEY_ID, and PUTER_NOTARY_ISSUER variables."
    exit 2
fi
if [[ ! -f "$DMG_PATH" ]]; then
    print -u2 "DMG not found: $DMG_PATH"
    exit 2
fi

codesign --verify --strict "$DMG_PATH"
if [[ -n "$NOTARY_PROFILE" ]]; then
    xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
else
    xcrun notarytool submit "$DMG_PATH" \
        --key "$NOTARY_KEY_PATH" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER" --wait
fi
xcrun stapler staple "$DMG_PATH"
xcrun stapler validate "$DMG_PATH"
if [[ -d "$APP_PATH" ]]; then
    xcrun stapler staple "$APP_PATH"
    xcrun stapler validate "$APP_PATH"
fi
spctl --assess --type open --context context:primary-signature -v "$DMG_PATH"
print "Notarized and stapled $DMG_PATH"