#!/usr/bin/env sh
set -eu

# Sign build/omairc.app. Developer ID when CODESIGN_IDENTITY is set (CI);
# otherwise ad-hoc so local Homebrew-Qt builds stay simple.

ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
APP="${1:-$ROOT/build/omairc.app}"
ENTITLEMENTS="$ROOT/packaging/macos/Omairc.entitlements"

if [ "$(uname -s)" != "Darwin" ]; then
  echo "bin/sign-macos must run on macOS." >&2
  exit 1
fi

if [ ! -d "$APP" ]; then
  echo "Expected $APP. Run bin/build-macos first." >&2
  exit 1
fi

if ! command -v codesign >/dev/null 2>&1; then
  echo "codesign is required to sign $APP." >&2
  exit 1
fi

adhoc_sign() {
  echo "Ad-hoc signing $APP"
  codesign --force --deep --sign - "$APP"
}

identity="${CODESIGN_IDENTITY:-}"
case "$identity" in
  ""|-)
    if [ "${OMAIRC_REQUIRE_DEVELOPER_ID:-}" = 1 ]; then
      echo "OMAIRC_REQUIRE_DEVELOPER_ID=1 but CODESIGN_IDENTITY is not set." >&2
      exit 1
    fi
    adhoc_sign
    exit 0
    ;;
esac

if [ ! -f "$ENTITLEMENTS" ]; then
  echo "Expected entitlements at $ENTITLEMENTS" >&2
  exit 1
fi

if [ -n "${APPLE_TEAM_ID:-}" ]; then
  case "$identity" in
    *"$APPLE_TEAM_ID"*) ;;
    *)
      echo "CODESIGN_IDENTITY does not contain APPLE_TEAM_ID=$APPLE_TEAM_ID: $identity" >&2
      exit 1
      ;;
  esac
fi

sign_one() {
  echo "  $1"
  codesign --force --options runtime --timestamp --sign "$identity" "$1"
}

# Deepest paths first so nested code is signed before its parent bundle.
depth_first() {
  awk '{ print gsub(/\//, "/") "\t" $0 }' | sort -nr | cut -f2-
}

echo "Signing $APP with $identity"
# Nested code first, no app entitlements. Do not use --deep: it can stamp the
# app entitlements onto Qt plugins and is the path Apple documents as broken.
find "$APP/Contents" -name '*.dylib' -type f | depth_first | while IFS= read -r f; do
  [ -n "$f" ] || continue
  sign_one "$f"
done
find "$APP/Contents" -name '*.framework' -type d | depth_first | while IFS= read -r f; do
  [ -n "$f" ] || continue
  sign_one "$f"
done
codesign --force --options runtime --timestamp \
  --entitlements "$ENTITLEMENTS" --sign "$identity" "$APP"
codesign --verify --deep --strict --verbose=2 "$APP"
echo "Signed $APP"
