fix: sign bundled DB tools with Developer ID for notarization (#15)

scripts/release-mac.sh

@@ -51,76 +51,6 @@ get_token() {
 
 GITEA_TOKEN="$(get_token)"
 
-# ---- build bundled DB tools (macOS) ----------------------------------------
-WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
-OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools"
-OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
-
-echo ">> Building PostgreSQL client tools..."
-mkdir -p "$OUT_PG"
-PG_VER="16.4"
-curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
-tar -xf /tmp/pg.tar.bz2 -C /tmp
-cd /tmp/postgresql-${PG_VER}
-ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
-sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c
-make -C src/backend generated-headers
-make -C src/interfaces/libpq all
-make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all
-make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all
-cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/
-cp src/bin/psql/psql "$OUT_PG"/
-cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib
-for b in pg_dump pg_restore psql; do
-  libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}')
-  install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b"
-done
-# install_name_tool invalidates the linker's ad-hoc signature; re-sign so the
-# bundle passes notarization (every code object inside must be signed).
-for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do
-  codesign --force --sign - "$f" 2>/dev/null || true
-done
-
-echo ">> Building MariaDB client tools..."
-mkdir -p "$OUT_MY"
-MARIADB_VER="11.4.5"
-git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
-cd /tmp/mariadb-server
-if [ "$(uname -m)" = arm64 ]; then
-  SSL_DIR="/opt/homebrew/opt/openssl"
-else
-  SSL_DIR="/usr/local/opt/openssl"
-fi
-[ -d "$SSL_DIR" ] || brew install openssl
-cmake -DCMAKE_BUILD_TYPE=Release \
-  -DWITHOUT_SERVER=ON \
-  -DWITHOUT_TOKUDB=1 \
-  -DWITHOUT_ROCKSDB=1 \
-  -DWITHOUT_MROONGA=1 \
-  -DWITHOUT_SPIDER=1 \
-  -DWITHOUT_SEQUENCE=1 \
-  -DWITH_UNIT_TESTS=OFF \
-  -DWITH_SSL="$SSL_DIR" \
-  -DWITH_ZLIB=bundled .
-make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb
-for b in mariadb-dump mariadb; do
-  src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
-  test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
-  test -n "$src" || { echo "build produced no $b binary"; exit 1; }
-  cp "$src" "$OUT_MY"/
-done
-for pass in 1 2 3 4 5 6; do
-  for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do
-    [ -f "$dylib" ] || continue
-    otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do
-      base=$(basename "$lib")
-      if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi
-      install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true
-    done || true
-    codesign --force --sign - "$dylib" 2>/dev/null || true
-  done
-done
-
 # ---- macOS signing + notarization -----------------------------------------
 # Requires a "Developer ID Application" certificate in the login keychain and
 # an App Store Connect API key for notarization. See the README's "macOS
@@ -173,6 +103,77 @@ else
   echo ">> Notarization: API key ${APPLE_API_KEY} (issuer ${APPLE_API_ISSUER})"
 fi
 
+# ---- build bundled DB tools (macOS) ----------------------------------------
+WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
+OUT_PG="${WORKSPACE}/desktop/src-tauri/resources/pg_tools"
+OUT_MY="${WORKSPACE}/desktop/src-tauri/resources/mysql_tools"
+
+echo ">> Building PostgreSQL client tools..."
+mkdir -p "$OUT_PG"
+PG_VER="16.4"
+curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.bz2" -o /tmp/pg.tar.bz2
+tar -xf /tmp/pg.tar.bz2 -C /tmp
+cd /tmp/postgresql-${PG_VER}
+ac_cv_func_strchrnul=no ./configure --prefix=/tmp/pgbuild --without-readline --without-icu CFLAGS="-O2"
+sed -i '' 's/strchrnul/pg_strchrnul/g' src/port/snprintf.c
+make -C src/backend generated-headers
+make -C src/interfaces/libpq all
+make -j"$(sysctl -n hw.ncpu)" -C src/bin/pg_dump all
+make -j"$(sysctl -n hw.ncpu)" -C src/bin/psql all
+cp src/bin/pg_dump/pg_dump src/bin/pg_dump/pg_restore "$OUT_PG"/
+cp src/bin/psql/psql "$OUT_PG"/
+cp src/interfaces/libpq/libpq.5.dylib "$OUT_PG"/libpq.5.dylib
+for b in pg_dump pg_restore psql; do
+  libpq=$(otool -L "$OUT_PG/$b" | awk '/libpq/ {print $1; exit}')
+  install_name_tool -change "$libpq" "@loader_path/libpq.5.dylib" "$OUT_PG/$b"
+done
+# install_name_tool invalidates the linker's signature; re-sign with the
+# Developer ID identity + hardened runtime + secure timestamp so the bundle
+# passes notarization (Apple rejects ad-hoc-signed nested executables).
+for f in "$OUT_PG"/pg_dump "$OUT_PG"/pg_restore "$OUT_PG"/psql "$OUT_PG"/libpq.5.dylib; do
+  codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$f"
+done
+
+echo ">> Building MariaDB client tools..."
+mkdir -p "$OUT_MY"
+MARIADB_VER="11.4.5"
+git clone --depth 1 --branch "mariadb-${MARIADB_VER}" https://github.com/MariaDB/server.git /tmp/mariadb-server
+cd /tmp/mariadb-server
+if [ "$(uname -m)" = arm64 ]; then
+  SSL_DIR="/opt/homebrew/opt/openssl"
+else
+  SSL_DIR="/usr/local/opt/openssl"
+fi
+[ -d "$SSL_DIR" ] || brew install openssl
+cmake -DCMAKE_BUILD_TYPE=Release \
+  -DWITHOUT_SERVER=ON \
+  -DWITHOUT_TOKUDB=1 \
+  -DWITHOUT_ROCKSDB=1 \
+  -DWITHOUT_MROONGA=1 \
+  -DWITHOUT_SPIDER=1 \
+  -DWITHOUT_SEQUENCE=1 \
+  -DWITH_UNIT_TESTS=OFF \
+  -DWITH_SSL="$SSL_DIR" \
+  -DWITH_ZLIB=bundled .
+make -j"$(sysctl -n hw.ncpu)" mariadb-dump mariadb
+for b in mariadb-dump mariadb; do
+  src=$(find client -maxdepth 1 -type f -name "$b" -print -quit 2>/dev/null || true)
+  test -n "$src" || src=$(find . -type f -name "$b" -print -quit || true)
+  test -n "$src" || { echo "build produced no $b binary"; exit 1; }
+  cp "$src" "$OUT_MY"/
+done
+for pass in 1 2 3 4 5 6; do
+  for dylib in "$OUT_MY"/*.dylib "$OUT_MY"/mariadb-dump "$OUT_MY"/mariadb; do
+    [ -f "$dylib" ] || continue
+    otool -L "$dylib" | awk 'NR>1 {print $1}' | grep -E '^/(usr/local|opt/homebrew)' | while read -r lib; do
+      base=$(basename "$lib")
+      if [ ! -f "$OUT_MY/$base" ]; then cp "$lib" "$OUT_MY/$base" 2>/dev/null || true; fi
+      install_name_tool -change "$lib" "@loader_path/$base" "$dylib" 2>/dev/null || true
+    done || true
+    codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$dylib"
+  done
+done
+
 # ---- build the app (both arches) ------------------------------------------
 cd "${WORKSPACE}/desktop"
 echo ">> Installing frontend dependencies..."