set -eu

FILE="${1:?missing file argument}"

[[ "$(basename "$(dirname "$FILE")")" == stormforge_darwin_* ]] || { echo >&2 "skipping code signing on file '$1'"; exit; }

command -v security >/dev/null 2>&1 || { echo >&2 "skipping code signing, security not present"; exit; }

command -v codesign >/dev/null 2>&1 || { echo >&2 "skipping code signing, codesign not present"; exit; }

[ -n "${AC_IDENTITY_P12:-}" ] || { echo >&2 "skipping code signing, no signing identity"; exit; }

AC_IDENTITY_PASSPHRASE="${AC_IDENTITY_PASSPHRASE:-$AC_PASSWORD}"

KEYCHAIN_PASSWORD="$(openssl rand -base64 30)"

KEYCHAIN="$(mktemp -d)/codesigning.keychain-db"

removeKeychain() {

rm -rf "$(dirname "$KEYCHAIN")"

}

trap removeKeychain EXIT

security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"

security set-keychain-settings "$KEYCHAIN" # Unset keychain settings (disable lock)

security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"

security import <(printenv AC_IDENTITY_P12 | base64 -D) -f pkcs12 -k "$KEYCHAIN" -P "$AC_IDENTITY_PASSPHRASE" -T "$(command -v codesign)" >/dev/null

IDENTITY="$(security find-identity -v -p "codesigning" "$KEYCHAIN" | grep "1)" | awk '{print $2}')"

[ -n "${IDENTITY:-}" ] || { echo >&2 "failed to import signing identity"; exit 1; }

echo >&2 "signing with id=$IDENTITY"

security list-keychains -d user -s "$KEYCHAIN"

restoreKeychain() {

security list-keychains -d user -s login.keychain

}

trap restoreKeychain EXIT

codesign --keychain "$KEYCHAIN" --sign "$IDENTITY" --force --verbose --timestamp --options "runtime" "$FILE"