native-packages 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af0462ecd5b50ab3aeb8415ff1c95c7d910b858ef1f3804b18526cfd41ada930
-  data.tar.gz: 48c6d9f15ad4b8ed60617416780fa5a03f294bc4f629949a5e31af7e041c84fd
+  metadata.gz: ccc727393fcd07bd511465e0b2c46b19679a387b6ffee081693231061424fbd9
+  data.tar.gz: 9a402ad593dd1035f1ab350e9cdc1a81292f0976303d6454c2ad9a3ecc53ae91
 SHA512:
-  metadata.gz: ed735938724f514a10b46a50b21ac3131abc1d07981544b0f6f89d5010137b9e7674e041aeed97828de39d1fc2ff243241047f051a7ae78ac75beda8a446e30b
-  data.tar.gz: 5bb0021eeab1b651c10170de7a57c1e38036714477e15a9e8d698ad68fe836d136de70107b8f180734225b502cd161ada0b01df234a382c9b582e9789a79bc54
+  metadata.gz: ee7950fbfd3a6d8e8d934e2c51a2620e717644c30803d660617d3e44d9c2274819fdc37dd815208493244b553976df685d2d3ec2d129eede0301bb61f7dd80d5
+  data.tar.gz: a57e20ba12b60b53bcbe0b9e5d896fb874d2535ae73f6f24a03b067ef9310eb35133bd51654d29a58d6e2990577a7dd6d4d056bf796ed44905c00866a087d983

data/README.md

@@ -61,6 +61,10 @@ the application's existing packaging commands on macOS or Windows, using the
 same verified build manifests as Linux packages. Native recipes consume prepared
 directories and need no nFPM installation. The gem checks Mach-O/PE architecture,
 preserves safe internal bundle links and hashes the output after signing hooks.
+With complete Apple credentials, macOS DMG builds automatically sign their owned
+app copy, notarize the image, staple and validate its ticket before recording
+checksums. `notarize-macos INPUT --output OUTPUT` prepares signed, notarized
+portable code for an application-owned archive. See [Apple notarization](docs/apple-notarization.md).
 App compilation, installer policy and signing identities stay in the application
 repository.
 
@@ -84,6 +88,14 @@ Release mode verifies the declared binary assets against the release checksum fi
 
 Outputs include packages, prepared recipes, checksums and `build.json`. Publication verifies their hashes, configuration identity and complete target set. Partial builds can be combined with `aggregate DIR... --output DIRECTORY`. Native filenames come from nFPM.
 
+Since 0.4.0, `build --defer-recipes` lets each platform package its
+own inputs without acquiring global recipe assets or requiring AUR tools.
+Then `aggregate --finalize-recipes` generates the downstream recipes once,
+using hashes of the completed packages. This allows a Homebrew cask to reference
+the DMG being built in the same release. Deferred builds cannot be published.
+See [deferred recipe generation](docs/configuration.md#deferred-recipe-generation)
+for the finalizer's inputs and checks.
+
 Optional `repositories` and `templates` sections replace the old separate registries. Existing `stage`, `diff`, `publish TARGET` and `status` commands support reviewed downstream updates. AUR uses PKGBUILD/`.SRCINFO`; Homebrew uses formulae/casks. Each destination has an independent ignored Git clone, with no application submodules or extra remotes. Native source repositories still apply their own validation and review.
 
 ## GitHub Actions
@@ -95,7 +107,7 @@ packaging:
   needs: release
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.3.1
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.5.0
   with:
     version: ${{ github.ref_name }}
     publish: true
@@ -121,7 +133,7 @@ Migration combines `packaging/project.yml`, its nFPM definition and repository r
 bundle install
 bundle exec ruby -Ilib -e 'Dir["test/*_test.rb"].sort.each { |path| require_relative path }'
 gem build native-packages.gemspec
-ruby test/gem_install.rb native-packages-0.3.1.gem
+ruby test/gem_install.rb native-packages-0.5.0.gem
 ```
 
 Tests build real packages, inspect their payloads and exercise repository publication against local Git fixtures. CI additionally runs disposable Linux install/upgrade/remove checks, SRPM rebuilds and Windows MSIX acceptance. Runtime build manifests report installation as `not-tested`: CI fixture coverage is not a substitute for testing each application's packages.

data/docs/acceptance/0.5.0-notarization.md

@@ -0,0 +1,30 @@
+# Native Apple notarization acceptance, 2026-09-13
+
+A private Mac test used the candidate 0.5.0 implementation with the owner's
+Developer ID Application certificate and app-specific notarization credentials.
+No application release was created or replaced.
+
+- Verified the published Fastpotify v0.7.1 universal DMG against its release
+  checksum, then copied its app and notices into an isolated test input.
+- The shared native build signed its owned copy, verified both arm64 and x86_64
+  Mach-O slices, packaged a new DMG, obtained Apple acceptance, and stapled and
+  validated the notarization ticket before recording the package hash.
+- Gatekeeper accepted both the resulting DMG and its contained app with
+  `source=Notarized Developer ID`. The app binary ran `--version` successfully.
+- The portable command signed a newly compiled ARM64 executable, companion dylib
+  and app bundle, submitted a temporary ZIP, and obtained Apple acceptance
+  (submission `6a096e26-0f47-409f-b15d-654ff2a32292`). The app's stapled ticket
+  validated and Gatekeeper accepted it. Both standalone and bundled executables
+  successfully called the signed dylib after packaging. Non-code fixture data
+  remained unchanged, and the returned tree was archived as a tarball.
+
+All images were detached after inspection. The gem's temporary signing keychains
+were deleted. Original source payloads were not signed in place. Unit coverage
+also exercises absent/partial credentials, failed acceptance/stapling, private
+error redaction, inside-out signing and existing after-package hooks on both Mac
+and Windows, including Apple variables present on a Windows target.
+
+This is actual Apple service and native Gatekeeper evidence on the available
+Apple Silicon Mac. It is not an Intel execution test, a fresh-machine GUI test,
+or validation of Fastpotify playback, RekordFlash inference/models, FastsApp
+messaging or TonePush hardware. Those remain application acceptance work.

data/docs/apple-notarization.md

@@ -0,0 +1,86 @@
+# Apple signing and notarization
+
+Since native-packages 0.5.0, a native macOS DMG build automatically signs and
+notarizes when all six environment variables below are present. No variables
+preserves existing local/unsigned behavior. Any incomplete set fails with the
+missing variable names before packaging. Linux and Windows targets ignore these
+Apple variables. `validate` and `build --dry-run` remain offline.
+
+| Environment variable | Value |
+| --- | --- |
+| `APPLE_CERTIFICATE_P12` | Base64-encoded Developer ID Application certificate and private key, exported as PKCS#12 |
+| `APPLE_CERTIFICATE_PASSWORD` | Password protecting that export |
+| `APPLE_SIGNING_IDENTITY` | Exact `Developer ID Application: Name (TEAMID)` identity |
+| `APPLE_ID` | Apple Account email |
+| `APPLE_TEAM_ID` | Developer Program Team ID |
+| `APPLE_APP_PASSWORD` | Apple Account app-specific password |
+
+Store these in CI secrets and expose them as environment variables only in the
+trusted macOS release job. The gem does not fetch secrets from a password manager
+or GitHub. A free Apple account cannot replace Developer Program membership and
+a valid Developer ID Application certificate.
+
+## Native DMG builds
+
+Build the application's complete `.app` and prepare its configured native input
+first, then run the normal command on macOS:
+
+```sh
+native-packages --config native-packages.macos.yaml build \
+  --version 1.2.3 --target macos-universal --output dist/macos-packages
+```
+
+The gem imports the certificate and notary credentials into a fresh, temporary
+keychain. It never replaces the default keychain or its search list, and deletes
+its keychain after success or failure. Credential values are excluded from
+manifests and redacted from tool errors.
+
+The input is copied and checked before signing. All Mach-O code and nested
+frameworks/app bundles in the owned copy are signed from the inside out with a
+secure timestamp and hardened runtime. Existing entitlements and requirements
+are preserved; the gem does not invent exceptions such as disabling library
+validation. The application remains responsible for any required entitlements.
+
+Signing finishes **before `native.command`**. Its recipe must copy `@PAYLOAD@`
+unchanged, create the configured DMG, and avoid replacing signatures with ad-hoc
+ones. The original application input remains unchanged. `after_package` still
+runs, then the gem signs the DMG, submits it with `notarytool`, waits for Apple's
+`Accepted` result, staples and validates the ticket, and verifies the image.
+Only then are package hashes and the build manifest written. The manifest's
+package validation records Apple acceptance, submission ID and stapling.
+
+Remove redundant Apple signing and notarization from application hooks when
+adopting this flow. Existing Inno/MSIX signing hooks remain independent.
+Submission waits up to 30 minutes; failure or timeout prevents publication of a
+completed build. Apple may continue processing a timed-out submission.
+
+## Portable macOS archives
+
+A standalone executable cannot carry a stapled ticket, and Apple does not accept
+`.tar.gz` as a submission. Prepare the entire portable tree, including binaries,
+dylibs, models and notices, then use:
+
+```sh
+native-packages notarize-macos portable-input \
+  --output signed/Example-1.2.3-macos-arm64
+tar czf Example-1.2.3-macos-arm64.tar.gz \
+  -C signed Example-1.2.3-macos-arm64
+```
+
+The destination must be new and outside the input directory. This command needs
+no application configuration. With credentials, it signs only its copy, submits
+that exact code through a temporary ZIP, waits for acceptance, and staples and
+validates any `.app` bundles. It then publishes the signed directory atomically.
+Archive only that returned tree; do not modify its signed contents. Without
+credentials it copies the input unchanged and explicitly reports that signing
+and notarization were skipped.
+
+Standalone binaries rely on Gatekeeper's online ticket lookup. An accepted
+portable submission does not claim offline stapling support for raw executables.
+Notarization also does not replace app startup, model/GPU, entitlement, OS-version
+or installation testing. Test a fresh downloaded package with Gatekeeper before
+announcing the first notarized release.
+
+Apple references: [Developer ID certificates](https://developer.apple.com/help/account/certificates/create-developer-id-certificates/),
+[signing distribution code](https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac/),
+[notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution).

data/docs/configuration.md

@@ -39,7 +39,7 @@ before_build: [./scripts/build-linux.sh, '@ARCH@']
 
 It runs once per selected target in the configuration directory, before copying local inputs. `NATIVE_PACKAGES_TARGET` and `NATIVE_PACKAGES_VERSION` are also set. It is skipped in release mode and never executed by `validate`, `doctor` or a dry run. A shell script remains responsible for complex build operations.
 
-`after_package` is an optional argument array invoked once per generated package, before output hashes are recorded. It additionally receives `@PACKAGE@` and `@FORMAT@`. Use it for existing native signing tools, for example a Windows SDK SignTool script. It runs in local and release mode and must preserve the output filename and file set. The MSIX acceptance test uses SignTool because Windows rejected the signature produced by nFPM 2.47.0's built-in signer in that test.
+`after_package` is an optional argument array invoked once per generated package, before output hashes are recorded. For native DMG targets, automatic [Apple notarization](apple-notarization.md) runs after this hook; input signing completes before the native recipe. It additionally receives `@PACKAGE@` and `@FORMAT@`. Use it for existing native signing tools, for example a Windows SDK SignTool script. It runs in local and release mode and must preserve the output filename and file set. The MSIX acceptance test uses SignTool because Windows rejected the signature produced by nFPM 2.47.0's built-in signer in that test.
 
 ## Tokens and additional assets
 
@@ -65,3 +65,62 @@ native-packages publish --from dist/complete --to github
 ```
 
 Each build must use the same configuration, release version and timestamp. Aggregate rejects duplicate target/format outputs, conflicting recipe files and incomplete sets. Publishing recipes can still use the existing reviewed sequence: `stage TARGET DIRECTORY/recipes`, `diff TARGET`, then `publish TARGET --body-file FILE` where required by a submission destination.
+
+
+## Deferred recipe generation
+
+Since 0.4.0, use this opt-in sequence when downstream recipes depend
+on packages built in separate jobs. The existing build and aggregate commands
+keep generating and checking recipes as before when the new flags are absent.
+There are no new configuration keys.
+
+```sh
+# Run each target on its required host, with the same checkout and epoch.
+native-packages doctor --target linux-amd64 --defer-recipes
+native-packages build --version 1.2.3 --target linux-amd64 --defer-recipes --output dist/linux
+native-packages build --version 1.2.3 --target macos-universal --defer-recipes --output dist/macos
+native-packages build --version 1.2.3 --target windows-amd64 --defer-recipes --output dist/windows
+
+# Download those build directories and remaining recipe assets onto Linux.
+native-packages aggregate dist/linux dist/macos dist/windows --finalize-recipes --output dist/complete
+# Run the application's package installation/upgrade/removal checks here.
+native-packages publish --from dist/complete --to github,aur,homebrew
+```
+
+A deferred build still validates configuration, selected inputs, architecture,
+container contents and signing hooks. It does not acquire the global `assets`
+or generate `templates`. `doctor --defer-recipes` likewise omits recipe tooling;
+the selected package formats still need their own tools. Asset filenames and
+URLs are available as tokens, but unknown `@KEY_SHA256@` values cannot be used
+by a target's input, package definition or hooks. Such a target must use the
+normal build path with its assets already available. Release-mode target inputs
+still require their published checksums, even with `--defer-recipes`.
+
+The finalizer first verifies every input manifest and the complete target set.
+All inputs must defer recipes and agree on configuration, version, timestamp,
+tool and recipe metadata, including Git version. Use the same Git history depth
+and `SOURCE_DATE_EPOCH` on every host. Mixing ordinary and deferred builds fails.
+Neither a partial target set nor a deferred build can be published. An ordinary
+aggregate rejects deferred inputs unless `--finalize-recipes` is supplied.
+
+For each global asset, finalization first looks for a verified package whose
+release filename exactly matches the asset's rendered `file`. For example,
+`assets.MACOS.file: app-v@VERSION@-macos-universal.dmg` resolves to a native target
+with that output filename. Its hash includes the completed signing/notarization
+hook. A stale `local` file cannot override that package. Duplicate package
+filenames are rejected. The manifest records this asset by package filename
+and digest, without a temporary staging path.
+
+Other assets, such as portable or source archives, must be staged at their
+configured `local` paths on the finalization host. Finalization reads local
+inputs and does not download recipe assets from a release. This also applies
+when the deferred target builds used `--release`. Recipe tools run only here:
+AUR templates require makepkg or working Docker, and recipe archives require
+tar and xz. The finalizer renders and validates recipes, writes the recipe
+archive and complete manifest, and atomically creates a fresh output directory.
+Failure leaves the original target directories intact and creates no completed
+output. Existing destinations are never overwritten.
+
+Deferral does not enable stable downstream recipes in a prerelease configuration.
+The existing preview-format and stable-recipe restrictions still apply. Use a
+preview configuration without downstream templates when building previews.

data/docs/legacy.md

@@ -8,7 +8,7 @@ Applications keep their own configuration and templates. This repository holds t
 
 | Layer | Responsibility |
 | --- | --- |
-| Application build jobs | Compile for each OS and architecture; create compatible binaries, macOS bundles and Windows installers; sign and notarize where required. |
+| Application build jobs | Compile for each OS and architecture; create compatible binaries, macOS bundles and Windows installers; provide Apple credentials to shared native builds or retain their existing signing tools. |
 | nFPM | Turn a set of built files and package metadata into native package files. |
 | native-packages | Verify release checksums, render recipes, check Linux ELF dependencies, invoke nFPM, attach packaging assets, and stage or publish downstream updates. |
 | Distribution infrastructure | Build and review submitted recipes, host package indexes, and make packages available to users. |

data/docs/native-recipes.md

@@ -1,14 +1,16 @@
-# Native DMG and Inno recipes (0.3)
+# Native DMG and Inno recipes
 
 The shared build command can coordinate existing macOS and Windows packaging
 scripts. These are native command adapters, separate from nFPM. They do not
-generate an installer recipe, compile an app, supply signing identities or
-automatically notarize anything. The application retains those decisions.
+generate an installer recipe or compile an app. Since 0.5.0, complete Apple
+credentials automatically enable Developer ID signing and notarization for DMG
+targets. The application supplies its identity, bundle contents and entitlements.
+See [Apple notarization](apple-notarization.md).
 
 ```yaml
 schema: 1
 tool:
-  version: '0.3.0'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app
@@ -43,15 +45,21 @@ targets:
 
 Run each target on its own host using `build --version VERSION --target ID`.
 Use the normal `aggregate` command to combine complete target results later.
-Use the same configuration and `SOURCE_DATE_EPOCH` across jobs. No nFPM binary
+Use the same configuration and `SOURCE_DATE_EPOCH` across jobs.
+Since 0.4.0, configurations with AUR/Homebrew recipes can use
+`build --defer-recipes` on each host, then `aggregate --finalize-recipes` on
+Linux. This avoids requiring the finished DMG before its own build or running
+AUR tools on macOS/Windows. The finalizer resolves recipe assets from the
+completed package filenames and locally staged external assets. See
+[deferred recipe generation](configuration.md#deferred-recipe-generation). No nFPM binary
 is required when only native targets are selected; its version remains part of
 the configuration for compatibility with mixed Linux/native builds.
 
 `native.command` is a nonempty argument array, including `@PACKAGE@`, which
 resolves to the exact output filename in a fresh directory. `@PAYLOAD@` is an
-owned copy of the input directory's contents. It does not retain the original
-directory's basename: a DMG script should copy it into its own temporary
-`Example.app` folder before calling hdiutil. Other existing target tokens apply.
+owned copy of the input directory's contents. A top-level `.app` retains its basename; other input directories use `payload`.
+A DMG script should copy the owned input into its own temporary
+`Example.app` folder or image staging directory before calling hdiutil. Other existing target tokens apply.
 Commands run in the application configuration directory and receive the same
 target/version environment as other build hooks.
 
@@ -64,17 +72,18 @@ must check its own additional tools. Mac architecture inspection also needs
 Apple's `lipo`. Supported Mac targets are `amd64`, `arm64` and `universal` (both).
 
 Input copying preserves file modes and internal relative symlinks, including
-framework links. Escaping, dangling and special-file entries fail. The staged
-tree must match the original digest and remain unchanged after packaging and
-signing hooks. Package only this staged input; do not read another application
+framework links. Escaping, dangling and special-file entries fail. The initial staged tree must match the original digest. Automatic Apple
+signing then signs only that owned copy. The signed staged tree must remain
+unchanged after application packaging and `after_package` hooks. Package only this staged input; do not read another application
 build from a global location. Recipes should preserve existing destinations,
 clean only their own temporary files and use argument arrays for subprocesses.
 
 The command must create exactly its declared `.dmg` or `.exe` file. The adapter
 checks a UDIF trailer or PE container respectively. This is a container check,
-not proof of a valid installer, signature or application. The existing
-`after_package` hook can sign/notarize the output in place before the final hash
-is recorded. Do not modify a package after building its manifest: signature
+not proof of a valid installer, signature or application. The existing `after_package` hook runs before automatic Apple DMG signing,
+notarization and stapling, all before the final hash is recorded. Remove redundant
+Apple signing/notarization hooks when enabling automatic credentials. Other
+application-specific output hooks remain supported. Do not modify a package after building its manifest: signature
 stapling changes bytes and must run inside that hook if the manifest is to verify.
 
 Applications should invoke hdiutil's verification, platform signature checks and

data/docs/platforms.md

@@ -12,11 +12,11 @@ All seven nFPM 2.47.0 packagers are exposed by the v0.2 CLI. Each target explici
 | MSIX | nFPM `msix`, PE architecture checks, `after_package` hook for native signing | Windows executables/DLLs, application identity, assets, capabilities and signing certificate |
 | SRPM | nFPM `srpm`, source/spec input validation | A correct spec and sources, native rebuild testing |
 | AUR | Template rendering, `.SRCINFO`, staged Git publication | Native PKGBUILD source/bin/git variants and build checks |
-| Homebrew | Hash/render supplied formulae or casks and publish a tap | macOS bundles, signing/notarization, native recipe logic |
+| Homebrew | Hash/render supplied formulae or casks and publish a tap | Completed macOS assets, native recipe logic |
 | Nixpkgs/Gentoo/Void and similar repositories | Template rendering and configured Git/PR/MR publication | Native recipes, dependency hashes, distro checks and review |
 | Flatpak | No build/publication adapter yet | Use flatpak-builder and native manifests/runtime/sandbox settings |
 | Inno Setup | Native command adapter, PE inspection, copied input and final output hashes | Inno recipe/compiler, application version mapping, signing and installation tests |
-| macOS DMG | Native command adapter, Mach-O inspection, copied bundle and final output hashes | Bundle, hdiutil recipe, signing/notarization, update/rollback testing |
+| macOS DMG | Native command adapter, Mach-O inspection, automatic Developer ID signing/notarization with Apple credentials, final stapled hashes | Bundle, hdiutil recipe, Apple credentials/entitlements, update/rollback testing |
 | Other Windows installers | No adapter for NSIS/WiX yet | Existing native tools and WinGet/Scoop integrations |
 
 The IPK acceptance fixture targets OpenWrt 24.10.8. OpenWrt 25.12 switched to APK, so IPK is not the package format for every OpenWrt release. [OpenWrt 25.12 release notes](https://openwrt.org/releases/25.12/notes-25.12.0)

data/docs/releasing.md

@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
 Create a GitHub release for that commit:
 
 ```sh
-gh release create v0.3.1 --target main --title 'native-packages 0.3.1' --notes-file release-notes.md
+gh release create v0.4.0 --target main --title 'native-packages 0.4.0' --notes-file release-notes.md
 ```
 
 Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.3.1'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.3.1'
+  version: '0.5.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/build.rb

@@ -3,6 +3,7 @@
 require_relative "configuration"
 require_relative "inspection"
 require_relative "native_recipe"
+require_relative "macos_signing"
 
 module NativePackages
   class Build
@@ -27,7 +28,7 @@ module NativePackages
       version
     end
 
-    def doctor(ids: [], formats: [], release: false)
+    def doctor(ids: [], formats: [], release: false, defer_recipes: false)
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
       nfpm_version if selected.values.any? { |target| (target.fetch("formats") & Configuration::NATIVE_FORMATS).empty? }
@@ -35,18 +36,25 @@ module NativePackages
         next unless target["native"]
         metadata = configuration.target_tokens(configuration.tokens("9.8.7"), id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
         NativeRecipe.new(root).doctor(target, render_tree(target.fetch("native").fetch("command"), metadata))
+        MacosSigning.new(root).doctor if target["platform"] == "macos"
       end
       required = []
       required << "readelf" if selected.values.any? { |target| target["platform"] == "linux" && target.fetch("kind", "binary") == "binary" }
       required << "bsdtar" if selected.values.any? { |target| target.fetch("input").fetch("kind", "archive") == "archive" }
       required << "curl" if release
-      required += %w[tar xz] unless configuration.data.fetch("templates").empty?
       missing = required.uniq.reject { |tool| available?(tool) }
       raise Error, "install required tools: #{missing.join(', ')}" unless missing.empty?
+      recipe_tools unless defer_recipes
+      selected
+    end
+
+    def recipe_tools
+      return if configuration.data.fetch("templates").empty?
+      missing = %w[tar xz].reject { |tool| available?(tool) }
+      raise Error, "install required recipe tools: #{missing.join(', ')}" unless missing.empty?
       if configuration.data.fetch("templates").keys.any? { |path| path.match?(%r{\Aarch/[^/]+/PKGBUILD\z}) }
         raise Error, "AUR metadata needs makepkg or accessible Docker" unless available?("makepkg") || available?("docker")
       end
-      selected
     end
 
     def version(value, release)
@@ -73,7 +81,7 @@ module NativePackages
       configuration.tokens(version, epoch: epoch).merge("GIT_VERSION" => git_version)
     end
 
-    def run_build(value: nil, release: nil, ids: [], formats: [], output: nil, dry_run: false)
+    def run_build(value: nil, release: nil, ids: [], formats: [], output: nil, dry_run: false, defer_recipes: false)
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
       number = version(value, release)
@@ -84,15 +92,26 @@ module NativePackages
       output = Pathname.new(output || root / "dist/packages" / number).expand_path(root)
       if dry_run
         puts JSON.pretty_generate("version" => number, "mode" => release ? "release" : "local", "output" => output.to_s,
-          "targets" => selected.transform_values { |target| target.slice("formats", "platform", "arch", "input", "before_build", "after_package", "native") })
+          "recipes" => defer_recipes ? "deferred" : "included", "targets" => selected.transform_values { |target| target.slice("formats", "platform", "arch", "input", "before_build", "after_package", "native") })
         return
       end
       raise Error, "output exists: #{output}; choose a fresh --output" if output.exist?
-      doctor(ids: ids, formats: formats, release: !!release)
+      doctor(ids: ids, formats: formats, release: !!release, defer_recipes: defer_recipes)
       info = metadata(number, release: !!release)
       sources = []
       expected = release ? release_checksums(info) : nil
-      acquire_assets(info, expected, sources)
+      if defer_recipes
+        # Asset hashes are unknown until finalization. Do not silently pass the
+        # validation placeholders into a target's input, hooks or package data.
+        configuration.data.fetch("assets").each_key { |key| info.delete("#{key}_SHA256") }
+        selected.each do |id, target|
+          tokens = configuration.target_tokens(info, id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
+          render_tree(target, tokens)
+          render_tree(configuration.package(target), tokens)
+        end
+      else
+        acquire_assets(info, expected, sources)
+      end
       output.dirname.mkpath
       Dir.mktmpdir(".native-packages-", output.dirname) do |temporary|
         staging = Pathname.new(temporary) / "result"
@@ -112,66 +131,69 @@ module NativePackages
           digest = native ? native.digest(source) : input_digest(source)
           sources << { "target" => id, "path" => source.to_s, "sha256" => digest }
           Dir.mktmpdir("native-packages-input-") do |directory|
-            payload = Pathname.new(directory) / "payload"
+            payload = Pathname.new(directory) / (native && source.extname == ".app" ? source.basename : "payload")
             if native
               FileUtils.cp_r(source, payload, preserve: true)
               raise Error, "native input changed while staging" unless native.digest(payload) == digest
             else
               copy_input(source, payload, input.fetch("kind", "archive"))
             end
-            target.fetch("formats").each do |format|
-              destination = staging / "packages" / id / format
-              destination.mkpath
-              if native
-                inspection = native.inspect(payload, target)
-                recipe = target.fetch("native")
-                tokens = configuration.target_tokens(info, id, target, payload)
-                package_path = destination / render(recipe.fetch("output"), tokens)
-                run(*render_tree(recipe.fetch("command"), tokens.merge("PACKAGE" => package_path.to_s, "FORMAT" => format)),
-                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s, "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
-                packages = files(destination)
-                raise Error, "native recipe must create only its declared output" unless packages == [package_path]
-                native.check_output(package_path, format)
-              else
-                package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
-                if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
-                  raise Error, "prerelease package versions must use unmodified nFPM semver conversion"
+            signer = target["platform"] == "macos" ? MacosSigning.new(root) : nil
+            with_signing(signer) do |signing|
+              signing.sign_payload(payload) if signing
+              payload_digest = native && native.digest(payload)
+              target.fetch("formats").each do |format|
+                destination = staging / "packages" / id / format
+                destination.mkpath
+                if native
+                  inspection = native.inspect(payload, target)
+                  recipe = target.fetch("native")
+                  tokens = configuration.target_tokens(info, id, target, payload)
+                  package_path = destination / render(recipe.fetch("output"), tokens)
+                  run(*render_tree(recipe.fetch("command"), tokens.merge("PACKAGE" => package_path.to_s, "FORMAT" => format)),
+                    env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s, "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                  packages = files(destination)
+                  raise Error, "native recipe must create only its declared output" unless packages == [package_path]
+                  native.check_output(package_path, format)
+                else
+                  package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+                  if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
+                    raise Error, "prerelease package versions must use unmodified nFPM semver conversion"
+                  end
+                  package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
+                    "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
+                  inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+                  config_path = Pathname.new(directory) / "nfpm.yaml"
+                  write(config_path, YAML.dump(package))
+                  run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
+                    env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
+                  packages = files(destination)
+                  raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
                 end
-                package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
-                  "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
-                inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
-                config_path = Pathname.new(directory) / "nfpm.yaml"
-                write(config_path, YAML.dump(package))
-                run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
-                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
-                packages = files(destination)
-                raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
-              end
-              if target["after_package"]
-                signing = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
-                run(*render_tree(target.fetch("after_package"), signing), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
-                raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
-              end
-              if native
-                native.check_output(packages.first, format)
-                raise Error, "native recipes/signing must not change their input payload" unless native.digest(payload) == digest
+                if target["after_package"]
+                  hook_tokens = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
+                  run(*render_tree(target.fetch("after_package"), hook_tokens), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                  raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
+                end
+                if native
+                  native.check_output(packages.first, format)
+                  raise Error, "native recipes/signing must not change their input payload" unless native.digest(payload) == payload_digest
+                end
+                inspection["apple"] = signing.notarize(packages.first) if signing
+                records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
+                  "sha256" => sha256(packages.first), "validation" => inspection }
               end
-              records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
-                "sha256" => sha256(packages.first), "validation" => inspection }
             end
           end
         end
-        recipes = staging / "recipes"
-        project.generate(recipes, info)
-        project.check(recipes, prerelease: number.include?("-"))
-        if !configuration.data.fetch("templates").empty?
-          project.recipe_archive(recipes, staging, name: configuration.name, version: number, epoch: info.fetch("SOURCE_DATE_EPOCH"))
-          (staging / "packaging-checksums.txt").delete
-        end
+        write_recipes(staging, info) unless defer_recipes
         manifest = { "schema" => 1, "name" => configuration.name, "version" => number, "configuration" => configuration.digest,
           "tool" => configuration.data.fetch("tool"), "epoch" => info.fetch("SOURCE_DATE_EPOCH"), "inputs" => sources,
           "targets" => selected.transform_values { |target| target.fetch("formats") }, "packages" => records,
           "files" => files(staging).to_h { |file| [file.relative_path_from(staging).to_s, sha256(file)] } }
+        if defer_recipes
+          manifest["recipes"] = { "state" => "deferred", "metadata" => info.reject { |key, _| key == "ROOT" } }
+        end
         write(staging / "build.json", JSON.pretty_generate(manifest) + "\n")
         write(staging / "packaging-checksums.txt", files(staging).map { |file| "#{sha256(file)}  #{file.relative_path_from(staging)}\n" }.join)
         staging.rename(output)
@@ -180,6 +202,14 @@ module NativePackages
       output
     end
 
+    def with_signing(signer)
+      if signer&.enabled?
+        signer.with_identity { |active| yield active }
+      else
+        yield nil
+      end
+    end
+
     def release_cache(info)
       repository = configuration.data.fetch("release").fetch("repository")
       raise Error, "release.repository must be owner/repository" unless /\A[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\z/.match?(repository)
@@ -212,10 +242,12 @@ module NativePackages
       path
     end
 
-    def acquire_assets(info, expected, sources)
+    def acquire_assets(info, expected, sources, packages: {})
       configuration.data.fetch("assets").each do |key, definition|
         asset = render_tree(definition, info)
-        path = if expected
+        path = if packages.key?(asset.fetch("file"))
+          packages.fetch(asset.fetch("file"))
+        elsif expected
           release_input(asset.merge("release_asset" => asset.fetch("file")), info, expected, checksummed: asset.fetch("checksummed", true))
         else
           root / asset.fetch("local") { raise Error, "assets.#{key}: declare local input or use --release" }
@@ -224,7 +256,15 @@ module NativePackages
         info["#{key}_SHA256"] = digest
         info["#{key}_FILE"] = asset.fetch("file")
         info["#{key}_URL"] = asset.fetch("url", "#{info.fetch('UPSTREAM')}/releases/download/#{info.fetch('TAG')}/#{asset.fetch('file')}")
-        sources << { "asset" => key, "path" => path.to_s, "sha256" => digest }
+        source = { "asset" => key, "sha256" => digest }
+        # An aggregated package survives under its release filename; the
+        # finalizer's temporary staging path does not survive the rename.
+        if packages.key?(asset.fetch("file"))
+          source["package"] = asset.fetch("file")
+        else
+          source["path"] = path.to_s
+        end
+        sources << source
       end
     end
 
@@ -248,6 +288,48 @@ module NativePackages
       end
     end
 
+    def write_recipes(output, info)
+      recipes = output / "recipes"
+      project.generate(recipes, info)
+      project.check(recipes, prerelease: info.fetch("VERSION").include?("-"))
+      unless configuration.data.fetch("templates").empty?
+        project.recipe_archive(recipes, output, name: configuration.name, version: info.fetch("VERSION"), epoch: info.fetch("SOURCE_DATE_EPOCH"))
+        (output / "packaging-checksums.txt").delete
+      end
+    end
+
+    def verify_recipes(output, manifest, complete:)
+      if manifest.key?("recipes")
+        phase = manifest.fetch("recipes")
+        unless phase.is_a?(Hash) && phase["state"] == "deferred" && phase["metadata"].is_a?(Hash)
+          raise Error, "invalid recipe phase"
+        end
+        info = phase.fetch("metadata")
+        unless info.values_at("NAME", "VERSION", "SOURCE_DATE_EPOCH") == manifest.values_at("name", "version", "epoch")
+          raise Error, "deferred recipe metadata disagrees with build"
+        end
+        package_paths = manifest.fetch("packages").map { |entry| entry.fetch("path") }
+        raise Error, "deferred build contains recipe files" unless (manifest.fetch("files").keys - package_paths).empty?
+        raise Error, "recipes are deferred; aggregate with --finalize-recipes before publishing" if complete
+        return
+      end
+      # Require the recipe files as well as hashes, so dropping the deferred
+      # marker cannot make an unfinished build appear publishable.
+      required = ["recipes/release.json"]
+      raise Error, "missing recipe metadata" unless manifest.fetch("files").key?(required.first)
+      info = JSON.parse((output / required.first).read)
+      configuration.data.fetch("templates").each_key do |path|
+        relative = render(path, info.merge("ROOT" => root.to_s))
+        required << "recipes/#{relative_path(relative)}"
+        required << "recipes/#{File.dirname(relative)}/.SRCINFO" if relative.match?(%r{\Aarch/[^/]+/PKGBUILD\z})
+      end
+      unless configuration.data.fetch("templates").empty?
+        required << "#{configuration.name}-#{manifest.fetch('version')}-packaging.tar.xz"
+      end
+      missing = required - manifest.fetch("files").keys
+      raise Error, "missing recipe outputs: #{missing.join(', ')}" unless missing.empty?
+    end
+
     def verify(output, complete: true)
       output = Pathname.new(output).expand_path(root)
       manifest = JSON.parse((output / "build.json").read)
@@ -271,6 +353,7 @@ module NativePackages
       manifest.fetch("packages").each do |entry|
         raise Error, "package hash does not match file manifest" unless entry.fetch("sha256") == manifest.fetch("files").fetch(entry.fetch("path"))
       end
+      verify_recipes(output, manifest, complete: complete)
       manifest
     end
 
@@ -304,7 +387,7 @@ module NativePackages
       end
     end
 
-    def aggregate(inputs, output:)
+    def aggregate(inputs, output:, finalize_recipes: false)
       configuration.validate
       output = Pathname.new(output).expand_path(root)
       raise Error, "output exists: #{output}" if output.exist?
@@ -314,6 +397,14 @@ module NativePackages
       %w[version epoch tool].each do |key|
         raise Error, "builds disagree on #{key}" unless manifests.map { |entry| entry.fetch(key) }.uniq.length == 1
       end
+      phases = manifests.map { |entry| entry["recipes"] }
+      if phases.any?
+        raise Error, "do not mix deferred and completed recipe builds" if phases.any?(&:nil?)
+        raise Error, "deferred recipe metadata differs between builds" unless phases.uniq.length == 1
+        raise Error, "deferred builds require --finalize-recipes" unless finalize_recipes
+      elsif finalize_recipes
+        raise Error, "--finalize-recipes requires builds made with --defer-recipes"
+      end
       result = Marshal.load(Marshal.dump(manifests.first))
       result.merge!("targets" => {}, "packages" => [], "files" => {}, "inputs" => manifests.flat_map { |entry| entry.fetch("inputs") }.uniq)
       output.dirname.mkpath
@@ -338,6 +429,21 @@ module NativePackages
         configuration.targets.each do |id, target|
           result["targets"][id] = target.fetch("formats").select { |format| result["targets"].fetch(id, []).include?(format) }
         end
+        if finalize_recipes
+          expected = configuration.targets.transform_values { |target| target.fetch("formats") }
+          raise Error, "incomplete target set; aggregate all configured targets before finalizing recipes" unless result.fetch("targets") == expected
+          recipe_tools
+          info = result.fetch("recipes").fetch("metadata").merge("ROOT" => root.to_s)
+          packages = result.fetch("packages").each_with_object({}) do |entry, paths|
+            name = File.basename(entry.fetch("path"))
+            raise Error, "ambiguous recipe asset filename: #{name}" if paths.key?(name)
+            paths[name] = staging / entry.fetch("path")
+          end
+          acquire_assets(info, nil, result.fetch("inputs"), packages: packages)
+          write_recipes(staging, info)
+          result.delete("recipes")
+          result["files"] = files(staging).to_h { |file| [file.relative_path_from(staging).to_s, sha256(file)] }
+        end
         write(staging / "build.json", JSON.pretty_generate(result) + "\n")
         write(staging / "packaging-checksums.txt", files(staging).map { |file| "#{sha256(file)}  #{file.relative_path_from(staging)}\n" }.join)
         verify(staging)

data/lib/native_packages/cli.rb

@@ -13,7 +13,10 @@ module NativePackages
         build [--version VERSION | --release TAG]  Build all configured packages
           [--target ID] [--format FORMAT]          Select targets/formats (repeatable)
           [--output DIRECTORY] [--dry-run]         Choose output or inspect the plan
+          [--defer-recipes]                        Build targets without recipe assets/tools
+        notarize-macos DIRECTORY --output DIRECTORY Copy, sign and notarize portable Mac code
         aggregate DIR... --output DIRECTORY        Combine target builds before publishing
+          [--finalize-recipes]                    Generate recipes from deferred builds
         publish --from DIRECTORY --to github,aur   Publish a complete, verified build
         migrate [--dry-run]                        Convert packaging/project.yml
         repositories                               List downstream destinations
@@ -44,17 +47,19 @@ module NativePackages
       parser = OptionParser.new do |flags|
         flags.on("--config FILE") { |value| config_path = value }
         flags.on("--help", "-h") { puts HELP; return }
-        flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare].include?(command)
+        flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare notarize-macos].include?(command)
         flags.on("--body-file FILE") { |value| options[:body_file] = Pathname.new(value).expand_path(root) } if command == "publish"
         if %w[build doctor].include?(command)
           flags.on("--target ID") { |value| options[:ids] << value }
           flags.on("--format FORMAT") { |value| options[:formats] << value }
           flags.on("--release TAG") { |value| options[:release] = value }
+          flags.on("--defer-recipes") { options[:defer_recipes] = true }
         end
         if command == "build"
           flags.on("--version VERSION") { |value| options[:value] = value }
           flags.on("--dry-run") { options[:dry_run] = true }
         end
+        flags.on("--finalize-recipes") { options[:finalize_recipes] = true } if command == "aggregate"
         if command == "init"
           flags.on("--interactive") { options[:interactive] = true }
           flags.on("--name NAME") { |value| options[:name] = value }
@@ -74,7 +79,7 @@ module NativePackages
       parser.parse!(arguments)
       arity = { "init" => 0..0, "migrate" => 0..0, "build" => 0..0, "doctor" => 0..0, "aggregate" => 1..,
         "prepare" => 1..1, "check" => 1..1, "artifacts" => 1..1, "publish-release" => 2..2,
-        "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
+        "notarize-macos" => 1..1, "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
         "publish-aur" => 1..1, "status" => 0..1, "check-version" => 1..1, "validate" => 0..0 }[command]
       raise Error, HELP unless arity&.cover?(arguments.length)
       if command == "init"
@@ -82,19 +87,23 @@ module NativePackages
         return Scaffold.new(root).init(**options.slice(:interactive, :name, :input).merge(formats: options[:init_formats]))
       end
       return Scaffold.new(root).migrate(dry_run: options[:dry_run]) if command == "migrate"
+      if command == "notarize-macos"
+        raise Error, "notarize-macos requires --output" unless options[:output]
+        return MacosSigning.new(root).prepare_directory(arguments.first, output: options.fetch(:output))
+      end
       path = Configuration.discover(root, config_path)
       configuration = path && Configuration.new(path)
       if %w[build doctor aggregate].include?(command) || options[:from]
         raise Error, "create native-packages.yaml with init, or convert existing packaging with migrate" unless configuration
         builder = Build.new(configuration)
         case command
-        when "build" then return builder.run_build(**options.slice(:value, :release, :ids, :formats, :output, :dry_run))
+        when "build" then return builder.run_build(**options.slice(:value, :release, :ids, :formats, :output, :dry_run, :defer_recipes))
         when "doctor"
-          builder.doctor(**options.slice(:ids, :formats, :release))
+          builder.doctor(**options.slice(:ids, :formats, :release, :defer_recipes))
           return puts "Configuration and packaging tools are ready. Build checks input files and package contents."
         when "aggregate"
           raise Error, "aggregate requires --output" unless options[:output]
-          return builder.aggregate(arguments, output: options.fetch(:output))
+          return builder.aggregate(arguments, output: options.fetch(:output), finalize_recipes: options.fetch(:finalize_recipes, false))
         when "publish" then return builder.publish(options.fetch(:from), options.fetch(:destinations), body_file: options[:body_file])
         end
       end

data/lib/native_packages/macos_signing.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+module NativePackages
+  # Apple credentials opt native DMG builds into Developer ID distribution.
+  # Only the owned staging copy is signed; caller inputs and keychains survive.
+  class MacosSigning
+    include Support
+    VARIABLES = %w[APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD].freeze
+    BUNDLES = %w[.app .framework .xpc .appex .bundle .plugin].freeze
+    attr_reader :root
+
+    def initialize(root, environment = ENV)
+      @root = root
+      @credentials = VARIABLES.to_h { |name| [name, environment[name].to_s] }
+      @redactions = @credentials.values.reject(&:empty?)
+    end
+
+    def enabled? = @credentials.values.any? { |value| !value.empty? }
+
+    def doctor
+      return unless enabled?
+      missing = @credentials.select { |_, value| value.strip.empty? }.keys
+      raise Error, "incomplete Apple notarization credentials: configure #{missing.join(', ')}" unless missing.empty?
+      identity = @credentials.fetch("APPLE_SIGNING_IDENTITY")
+      team = @credentials.fetch("APPLE_TEAM_ID")
+      unless identity.start_with?("Developer ID Application: ") && identity.end_with?("(#{team})")
+        raise Error, "APPLE_SIGNING_IDENTITY must be a Developer ID Application identity for APPLE_TEAM_ID"
+      end
+      begin
+        @certificate = @credentials.fetch("APPLE_CERTIFICATE_P12").delete("\r\n").unpack1("m0")
+        raise ArgumentError if @certificate.empty?
+      rescue ArgumentError
+        raise Error, "APPLE_CERTIFICATE_P12 must contain a base64-encoded PKCS#12 certificate and private key"
+      end
+      missing_tools = %w[security codesign xcrun hdiutil ditto].reject { |tool| available?(tool) }
+      raise Error, "install required Apple tools: #{missing_tools.join(', ')}" unless missing_tools.empty?
+      execute "xcrun", "--find", "notarytool"
+      execute "xcrun", "--find", "stapler"
+    end
+
+    def with_identity
+      doctor
+      return yield(nil) unless enabled?
+      Dir.mktmpdir("native-packages-signing-") do |directory|
+        @keychain = Pathname.new(directory) / "signing.keychain-db"
+        certificate = Pathname.new(directory) / "certificate.p12"
+        File.write(certificate, @certificate, mode: "wb", perm: 0o600)
+        password = OpenSSL::Random.random_bytes(32).unpack1("H*")
+        @redactions << password
+        begin
+          execute "security", "create-keychain", "-p", password, @keychain
+          execute "security", "set-keychain-settings", "-lut", "21600", @keychain
+          execute "security", "unlock-keychain", "-p", password, @keychain
+          execute "security", "import", certificate, "-k", @keychain,
+            "-P", @credentials.fetch("APPLE_CERTIFICATE_PASSWORD"), "-T", "/usr/bin/codesign"
+          execute "security", "set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-k", password, @keychain
+          identities = execute "security", "find-identity", "-v", "-p", "codesigning", @keychain
+          unless identities.include?(%Q{"#{@credentials.fetch("APPLE_SIGNING_IDENTITY")}"})
+            raise Error, "imported P12 has no valid private signing identity matching APPLE_SIGNING_IDENTITY"
+          end
+          execute "xcrun", "notarytool", "store-credentials", "native-packages", "--keychain", @keychain,
+            "--apple-id", @credentials.fetch("APPLE_ID"), "--team-id", @credentials.fetch("APPLE_TEAM_ID"),
+            "--password", @credentials.fetch("APPLE_APP_PASSWORD")
+          yield self
+        ensure
+          # Never replace the user's search list or default keychain. Deleting
+          # just this keychain also removes its own entry from the search list.
+          execute "security", "delete-keychain", @keychain if @keychain.exist?
+          @keychain = nil
+        end
+      end
+    end
+
+    def sign_payload(payload)
+      tree = NativeRecipe.new(root).tree(payload)
+      paths = tree.filter_map do |relative, kind, *|
+        path = payload / relative
+        if kind == "file" && NativeRecipe::MACHO.include?(path.binread(4).unpack1("H*"))
+          path
+        elsif kind == "directory" && (BUNDLES.include?(path.extname) || (path / "Contents/Info.plist").file?)
+          path
+        end
+      end
+      raise Error, "Apple signing needs a payload containing Mach-O code" if paths.empty?
+      # Files first, then their containing code bundles, including frameworks.
+      paths.sort_by { |path| [-path.each_filename.count, path.to_s] }.each do |path|
+        metadata = path.directory? ? "entitlements,requirements" : "identifier,entitlements,requirements"
+        execute "codesign", "--force", "--timestamp", "--options", "runtime",
+          "--preserve-metadata=#{metadata}", "--keychain", @keychain,
+          "--sign", @credentials.fetch("APPLE_SIGNING_IDENTITY"), path
+        execute "codesign", "--verify", "--strict", path
+      end
+    end
+
+    def notarize(package)
+      execute "hdiutil", "verify", package
+      execute "codesign", "--force", "--timestamp", "--keychain", @keychain,
+        "--sign", @credentials.fetch("APPLE_SIGNING_IDENTITY"), package
+      execute "codesign", "--verify", "--strict", package
+      response = submit(package)
+      execute "xcrun", "stapler", "staple", package
+      execute "xcrun", "stapler", "validate", package
+      execute "hdiutil", "verify", package
+      puts "Apple accepted #{package.basename}; its notarization ticket is stapled and validated."
+      { "signature" => "developer-id", "notarization" => "accepted", "submission_id" => response.fetch("id"), "stapled" => true }
+    end
+
+    def submit(package)
+      puts "Submitting #{package.basename} to Apple's notary service..."
+      response = JSON.parse(execute("xcrun", "notarytool", "submit", package,
+        "--keychain-profile", "native-packages", "--keychain", @keychain,
+        "--wait", "--timeout", "30m", "--output-format", "json"))
+      unless response["status"] == "Accepted"
+        raise Error, "Apple notarization was not accepted (submission #{response.fetch('id', 'unknown')}); inspect the notarytool log before distributing"
+      end
+      response.fetch("id")
+      response
+    rescue JSON::ParserError, KeyError
+      raise Error, "Apple notary service returned an invalid result; no package was published"
+    end
+
+    # A portable tarball cannot itself be submitted or stapled. Apple accepts
+    # the exact signed code through a temporary ZIP; the app owns the final tar.
+    def prepare_directory(source, output:)
+      source = Pathname.new(source).expand_path(root)
+      output = Pathname.new(output).expand_path(root)
+      raise Error, "output exists: #{output}; choose a fresh --output" if output.exist?
+      if output.to_s.start_with?(source.to_s + File::SEPARATOR)
+        raise Error, "signed output must be outside the input directory"
+      end
+      native = NativeRecipe.new(root)
+      original = native.digest(source)
+      raise Error, "macOS signing must run on macOS" if enabled? && NativeRecipe.host != "macos"
+      output.dirname.mkpath
+      Dir.mktmpdir(".native-packages-macos-", output.dirname) do |directory|
+        copied = Pathname.new(directory) / source.basename
+        FileUtils.cp_r(source, copied, preserve: true)
+        raise Error, "native input changed while staging" unless native.digest(copied) == original
+        with_identity do |signing|
+          if signing
+            sign_payload(copied)
+            archive = Pathname.new(directory) / "notarization.zip"
+            execute "ditto", "-c", "-k", "--keepParent", copied, archive
+            response = submit(archive)
+            native.tree(copied).each do |relative, kind, *|
+              bundle = copied / relative
+              next unless kind == "directory" && bundle.extname == ".app"
+              execute "xcrun", "stapler", "staple", bundle
+              execute "xcrun", "stapler", "validate", bundle
+            end
+            puts "Apple accepted portable code (submission #{response.fetch('id')}). Standalone executables use online ticket lookup."
+          else
+            puts "Apple credentials are absent; copying portable code without signing or notarization."
+          end
+        end
+        copied.rename(output)
+      end
+      output
+    end
+
+    def execute(*arguments)
+      capture(*arguments)
+    rescue Error => error
+      message = error.message.b
+      @redactions.sort_by { |value| -value.bytesize }.each { |value| message.gsub!(value.b, "[REDACTED]") }
+      raise Error, message
+    end
+  end
+end

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.3.1"
+  VERSION = "0.5.0"
   class Error < StandardError; end
 
   module Support

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Carmine Paolino
@@ -18,6 +18,8 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - README.md
+- docs/acceptance/0.5.0-notarization.md
+- docs/apple-notarization.md
 - docs/cli-design.md
 - docs/configuration.md
 - docs/legacy.md
@@ -36,6 +38,7 @@ files:
 - lib/native_packages/cli.rb
 - lib/native_packages/configuration.rb
 - lib/native_packages/inspection.rb
+- lib/native_packages/macos_signing.rb
 - lib/native_packages/native_recipe.rb
 - lib/native_packages/project.rb
 - lib/native_packages/repositories.rb