ruby_everywhere 0.0.1 → 0.1.1

data/support/macos/notarize.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+#
+# Sign (Developer ID + hardened runtime), notarize, and staple a .app bundle
+# so it launches without Gatekeeper warnings on other Macs.
+#
+# Secrets never live in this script. Provide them via the environment — the
+# easiest way is to source your release env first:
+#
+#     source ~/Projects/atlastools.dev/atlas-workspaces/.env.release
+#     cli/support/macos/notarize.sh "example/dist/Example Notes.app"
+#
+# Required env vars (these match Tauri's names, so your existing .env works):
+#   APPLE_SIGNING_IDENTITY   e.g. "Developer ID Application: Your Name (TEAMID)"
+#   APPLE_ID                 your Apple ID email
+#   APPLE_PASSWORD           app-specific password (NOT your Apple account password)
+#   APPLE_TEAM_ID            your 10-char team id
+#
+# Optional:
+#   NOTARY_PROFILE           if set, uses `--keychain-profile "$NOTARY_PROFILE"`
+#                            instead of APPLE_ID/APPLE_PASSWORD/APPLE_TEAM_ID.
+#                            Create it once with:
+#                              xcrun notarytool store-credentials "$NOTARY_PROFILE" \
+#                                --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" \
+#                                --password "$APPLE_PASSWORD"
+
+set -euo pipefail
+
+APP="${1:?usage: notarize.sh /path/to/App.app}"
+[ -d "$APP" ] || { echo "not a .app bundle: $APP" >&2; exit 1; }
+
+# Load secrets from a dotenv-style file when ENV_FILE is set. This parses
+# KEY=VALUE line-by-line and exports each var, so it handles unquoted values
+# containing spaces/parens (e.g. APPLE_SIGNING_IDENTITY=Developer ID
+# Application: Name (TEAM)) that plain `source .env.release` cannot.
+#
+#   ENV_FILE=.env.release cli/support/macos/notarize.sh "App.app"
+if [ -n "${ENV_FILE:-}" ]; then
+  [ -f "$ENV_FILE" ] || { echo "ENV_FILE not found: $ENV_FILE" >&2; exit 1; }
+  while IFS= read -r line || [ -n "$line" ]; do
+    line="${line%$'\r'}"                        # strip trailing CR (CRLF files)
+    case "$line" in ''|'#'*) continue ;; esac   # skip blank / comment lines
+    [ "${line#*=}" = "$line" ] && continue       # no '=' on the line -> skip
+    key="${line%%=*}"; val="${line#*=}"
+    key="${key#export }"                         # allow "export KEY=..."
+    key="${key#"${key%%[![:space:]]*}"}"         # trim leading whitespace
+    key="${key%"${key##*[![:space:]]}"}"         # trim trailing whitespace
+    # strip one layer of matching surrounding quotes from the value
+    if   [ "${val#\"}" != "$val" ] && [ "${val%\"}" != "$val" ]; then val="${val#\"}"; val="${val%\"}"
+    elif [ "${val#\'}" != "$val" ] && [ "${val%\'}" != "$val" ]; then val="${val#\'}"; val="${val%\'}"
+    fi
+    export "$key=$val"
+  done < "$ENV_FILE"
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ENTITLEMENTS="$SCRIPT_DIR/entitlements.plist"
+
+: "${APPLE_SIGNING_IDENTITY:?set APPLE_SIGNING_IDENTITY (source your .env.release)}"
+
+# --- 1. Sign inside-out: nested Mach-O first, then the bundle --------------
+echo "==> signing with: $APPLE_SIGNING_IDENTITY"
+# Sign every executable/dylib under Contents/MacOS individually so nested
+# helpers (app-server, the tebako binary) each carry the entitlements. The
+# bundle sign at the end seals resources and the main executable.
+while IFS= read -r -d '' bin; do
+  echo "    sign $bin"
+  codesign --force --timestamp --options runtime \
+    --entitlements "$ENTITLEMENTS" \
+    --sign "$APPLE_SIGNING_IDENTITY" "$bin"
+done < <(find "$APP/Contents/MacOS" -type f -print0)
+
+echo "    sign $APP"
+codesign --force --timestamp --options runtime \
+  --entitlements "$ENTITLEMENTS" \
+  --sign "$APPLE_SIGNING_IDENTITY" "$APP"
+
+echo "==> verifying signature"
+codesign --verify --deep --strict --verbose=2 "$APP"
+
+# --- 2. Notarize ----------------------------------------------------------
+ZIP="${APP%.app}.zip"
+echo "==> zipping for notarization: $ZIP"
+rm -f "$ZIP"
+ditto -c -k --keepParent "$APP" "$ZIP"
+
+echo "==> submitting to Apple notary service (this can take a few minutes)"
+if [ -n "${NOTARY_KEY:-}" ]; then
+  # App Store Connect API key (.p8) — how the Platform runner notarizes with a
+  # custodied key. NOTARY_KEY is a path to the .p8.
+  : "${NOTARY_KEY_ID:?set NOTARY_KEY_ID with NOTARY_KEY}"
+  : "${NOTARY_ISSUER:?set NOTARY_ISSUER with NOTARY_KEY}"
+  xcrun notarytool submit "$ZIP" \
+    --key "$NOTARY_KEY" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER" --wait
+elif [ -n "${NOTARY_PROFILE:-}" ]; then
+  xcrun notarytool submit "$ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
+else
+  # Accept APPLE_APP_SPECIFIC_PASSWORD as an alias for APPLE_PASSWORD.
+  APPLE_PASSWORD="${APPLE_PASSWORD:-${APPLE_APP_SPECIFIC_PASSWORD:-}}"
+  : "${APPLE_ID:?set APPLE_ID or NOTARY_PROFILE}"
+  : "${APPLE_PASSWORD:?set APPLE_PASSWORD (or APPLE_APP_SPECIFIC_PASSWORD) or NOTARY_PROFILE}"
+  : "${APPLE_TEAM_ID:?set APPLE_TEAM_ID or NOTARY_PROFILE}"
+  xcrun notarytool submit "$ZIP" \
+    --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_PASSWORD" \
+    --wait
+fi
+
+# --- 3. Staple + verify ---------------------------------------------------
+echo "==> stapling ticket"
+xcrun stapler staple "$APP"
+xcrun stapler validate "$APP"
+
+echo "==> Gatekeeper assessment"
+spctl -a -vvv "$APP"
+
+# --- 4. Re-zip the stapled app for distribution ---------------------------
+echo "==> re-zipping stapled app for distribution"
+rm -f "$ZIP"
+ditto -c -k --keepParent "$APP" "$ZIP"
+
+echo ""
+echo "✅ Done. Send this to your friend: $ZIP"
+echo "   (Stapled, so it works even offline. Send the .zip, not the raw .app —"
+echo "    zipping preserves the signature; AirDrop/Finder-copy of a bare .app can strip it.)"

data/support/shell/splash/index.html

@@ -0,0 +1,40 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Starting…</title>
+  <style>
+    :root { color-scheme: light dark; }
+    body {
+      margin: 0; height: 100vh; display: grid; place-items: center;
+      font-family: -apple-system, system-ui, sans-serif;
+      background: var(--bg, light-dark(#faf9f7, #1c1b1a));
+      color: light-dark(#333, #ddd);
+    }
+    .boot { text-align: center; }
+    .gem { font-size: 56px; animation: pulse 1.2s ease-in-out infinite; }
+    @keyframes pulse { 50% { opacity: 0.35; transform: scale(0.92); } }
+    h1 { margin: 12px 0 0; font-size: 17px; font-weight: 600; }
+    p { margin-top: 4px; font-size: 13px; opacity: 0.6; }
+  </style>
+</head>
+<body>
+  <div class="boot">
+    <div class="gem">💎</div>
+    <h1 id="name"></h1>
+    <p>Starting…</p>
+  </div>
+  <script>
+    // The shell injects window.__EVERYWHERE_CONFIG__ (from config/everywhere.yml)
+    // into every page, this splash included.
+    const cfg = window.__EVERYWHERE_CONFIG__ || {};
+    if (cfg.name) {
+      document.getElementById("name").textContent = cfg.name;
+      document.title = cfg.name;
+    }
+    const dark = matchMedia("(prefers-color-scheme: dark)").matches;
+    const bg = cfg.background_color && (dark ? cfg.background_color.dark : cfg.background_color.light);
+    if (bg) document.body.style.setProperty("--bg", bg);
+  </script>
+</body>
+</html>