#!/bin/sh
# Package the built app as dist/code-browser.app, ad-hoc signed, to move to
# /Applications. There's no signed release to download: each machine builds
# and signs its own, and a bundle built here carries no quarantine flag, so
# Gatekeeper doesn't stop it. `make app` runs this after the build, native and
# guest steps; `make install` copies the result to /Applications.
#
# The app goes in Contents/Resources/app unpacked, not in an asar: the VZ
# addon and the guest's kernel and disk images must be real files, and the
# main process finds them from app.getAppPath() as in dev (native/, guest/out/).
set -eu
[ "$(uname)" = Darwin ] || { echo "code-browser.app is macOS only" >&2; exit 1; }
root="$(cd "$(dirname "$0")/.." && pwd)"
src="$root/node_modules/electron/dist/code-browser.app"
dist="$root/dist"
app="$dist/code-browser.app"
res="$app/Contents/Resources"
bundle_id="${BUNDLE_ID:-eu.havmand.code-browser}"
version="$(sed -n 's/^  "version": "\(.*\)",$/\1/p' "$root/package.json")"

for f in "$src" "$root/out/main/index.js" "$root/native/code-browser-vz.node" \
  "$root/guest/out/Image" "$root/guest/out/initramfs.cpio" "$root/guest/out/rootfs.erofs"; do
  [ -e "$f" ] || { echo "missing $f: run make app, which builds it" >&2; exit 1; }
done

rm -rf "$app"
mkdir -p "$dist"
# The dev bundle is already renamed and named code-browser (sign-electron-dev.sh).
ditto "$src" "$app"
rm -f "$res/default_app.asar"

mkdir -p "$res/app/native" "$res/app/guest/out" "$res/app/resources"
cp "$root/package.json" "$root/bun.lock" "$res/app/"
ditto "$root/out" "$res/app/out"
# The window and Dock icons: the build points `?asset` imports at resources/ rather than copying them.
cp "$root/resources/icon.png" "$root/resources/icon-512.png" "$res/app/resources/"
cp "$root/native/code-browser-vz.node" "$res/app/native/"
cp "$root/guest/out/Image" "$root/guest/out/initramfs.cpio" "$root/guest/out/rootfs.erofs" "$res/app/guest/out/"
# The main process loads its dependencies at run time (the build leaves them external).
(cd "$res/app" && bun install --production --frozen-lockfile --ignore-scripts --silent)
rm -f "$res/app/bun.lock"

cp "$root/resources/icon.icns" "$res/electron.icns"
plist="$app/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier $bundle_id" "$plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $version" "$plist"
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $version" "$plist"

# Last, since editing Info.plist or the resources invalidates the signature.
codesign --force --deep --sign - --entitlements "$root/native/entitlements.plist" "$app"
codesign --verify --deep --strict "$app"
echo "built $app ($(du -sh "$app" | cut -f1)), ad-hoc signed as $bundle_id"