130 lines
3.7 KiB
Bash
Executable File
130 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# 对已经 Developer ID 签名的 DMG 做 Apple 公证并 staple。
|
||
# 已钉票则直接退出，避免重复上传。
|
||
# notarytool --wait 有时会一直 In Progress，即使苹果已 Accepted；超时后仍尝试 staple。
|
||
set -u
|
||
|
||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
VERSION="$(node -p "require('$ROOT_DIR/package.json').version")"
|
||
DMG="${1:-$ROOT_DIR/release/v$VERSION/macos-arm64/OpsXShell_${VERSION}_aarch64.dmg}"
|
||
APPLE_ID="${APPLE_ID:-}"
|
||
TEAM_ID="${APPLE_TEAM_ID:-B8DVUUUF6W}"
|
||
WAIT_TIMEOUT="${NOTARY_WAIT_TIMEOUT:-15m}"
|
||
: "${WAIT_TIMEOUT:=15m}"
|
||
|
||
if [ ! -f "$DMG" ]; then
|
||
echo "找不到安装包：$DMG" >&2
|
||
exit 1
|
||
fi
|
||
|
||
# 挂载中的 DMG 无法 staple / validate
|
||
if hdiutil info 2>/dev/null | grep -Fq "$DMG"; then
|
||
echo "DMG 仍挂载，请先在 Finder 弹出 /Volumes 下的 OpsXShell，再重试。" >&2
|
||
hdiutil info | grep -E "image-path|/Volumes/" || true
|
||
exit 1
|
||
fi
|
||
|
||
export http_proxy="${http_proxy:-http://127.0.0.1:7897}"
|
||
export https_proxy="${https_proxy:-http://127.0.0.1:7897}"
|
||
export HTTP_PROXY="$http_proxy"
|
||
export HTTPS_PROXY="$https_proxy"
|
||
export ALL_PROXY="${ALL_PROXY:-socks5://127.0.0.1:7897}"
|
||
export no_proxy="localhost,127.0.0.1,::1"
|
||
export NO_PROXY="$no_proxy"
|
||
|
||
already_stapled() {
|
||
xcrun stapler validate "$DMG" >/dev/null 2>&1
|
||
}
|
||
|
||
try_staple() {
|
||
echo "尝试 staple（从苹果拉票据钉进 DMG，不需要专用密码）…"
|
||
if xcrun stapler staple "$DMG"; then
|
||
xcrun stapler validate "$DMG"
|
||
echo
|
||
echo "完成（已钉票）：$DMG"
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
if already_stapled; then
|
||
echo "这份 DMG 已经公证并 staple，不用再执行。"
|
||
echo "$DMG"
|
||
xcrun stapler validate "$DMG"
|
||
exit 0
|
||
fi
|
||
|
||
echo "尚未钉票。先看苹果是否已经公证通过（常见于 --wait 卡住）。"
|
||
if try_staple; then
|
||
exit 0
|
||
fi
|
||
|
||
if [ -z "$APPLE_ID" ]; then
|
||
APPLE_ID="$(
|
||
osascript <<'APPLESCRIPT'
|
||
tell application "System Events"
|
||
activate
|
||
set dlg to display dialog "Apple ID（开发者账号邮箱）" default answer "" with title "OpsXShell 公证" buttons {"取消", "继续"} default button "继续" cancel button "取消"
|
||
return text returned of dlg
|
||
end tell
|
||
APPLESCRIPT
|
||
)" || exit 1
|
||
fi
|
||
|
||
echo
|
||
echo "需要提交公证。请输入 App 专用密码，不要发到聊天。"
|
||
PASSWORD="$(
|
||
osascript <<'APPLESCRIPT'
|
||
tell application "System Events"
|
||
activate
|
||
set dlg to display dialog "App 专用密码（xxxx-xxxx-xxxx-xxxx）" default answer "" with hidden answer with title "OpsXShell 公证" buttons {"取消", "提交"} default button "提交" cancel button "取消"
|
||
return text returned of dlg
|
||
end tell
|
||
APPLESCRIPT
|
||
)" || {
|
||
echo "已取消。" >&2
|
||
exit 1
|
||
}
|
||
|
||
if [ -z "$PASSWORD" ] || [ -z "$APPLE_ID" ]; then
|
||
echo "未输入 Apple ID 或专用密码，已取消。" >&2
|
||
exit 1
|
||
fi
|
||
|
||
echo "正在提交 ${DMG} (最多等 ${WAIT_TIMEOUT}) …"
|
||
set +e
|
||
SUBMIT_LOG="$(mktemp)"
|
||
xcrun notarytool submit "$DMG" \
|
||
--apple-id "$APPLE_ID" \
|
||
--password "$PASSWORD" \
|
||
--team-id "$TEAM_ID" \
|
||
--wait \
|
||
--timeout "${WAIT_TIMEOUT}" | tee "$SUBMIT_LOG"
|
||
SUBMIT_STATUS="${PIPESTATUS[0]}"
|
||
set -e
|
||
|
||
SUB_ID="$(awk '/id: / { print $2; exit }' "$SUBMIT_LOG")"
|
||
rm -f "$SUBMIT_LOG"
|
||
|
||
if [ -n "$SUB_ID" ]; then
|
||
echo "提交号：$SUB_ID"
|
||
fi
|
||
|
||
if [ "$SUBMIT_STATUS" -eq 0 ]; then
|
||
echo "notarytool 报告处理结束。"
|
||
else
|
||
echo "等待超时或状态未刷新 (exit ${SUBMIT_STATUS}). 改为直接 staple。"
|
||
fi
|
||
|
||
if try_staple; then
|
||
exit 0
|
||
fi
|
||
|
||
echo >&2
|
||
echo "staple 仍失败。可等几分钟再执行本脚本（已公证则不会重新上传）。" >&2
|
||
if [ -n "${SUB_ID:-}" ]; then
|
||
echo " xcrun notarytool info $SUB_ID --apple-id \"$APPLE_ID\" --team-id \"$TEAM_ID\"" >&2
|
||
fi
|
||
echo "不要对同一份未变化的 DMG 连续第三次提交。" >&2
|
||
exit 1
|