CleanMM/scripts/atlas/signing-common.sh

#!/bin/bash

atlas_local_signing_keychain_path() {
  printf '%s\n' "${ATLAS_LOCAL_SIGNING_KEYCHAIN_PATH:-$HOME/Library/Keychains/AtlasLocalSigning.keychain-db}"
}

atlas_local_signing_keychain_password() {
  printf '%s\n' "${ATLAS_LOCAL_SIGNING_KEYCHAIN_PASSWORD:-atlas-local-signing}"
}

atlas_local_signing_identity_name() {
  printf '%s\n' "${ATLAS_LOCAL_SIGNING_IDENTITY_NAME:-Atlas Local Development}"
}

atlas_detect_release_app_identity() {
  security find-identity -v -p codesigning 2>/dev/null \
    | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' \
    | head -1
}

atlas_detect_development_app_identity() {
  local output
  output="$(security find-identity -v -p codesigning 2>/dev/null || true)"

  local identity
  identity="$(printf '%s\n' "$output" | sed -n 's/.*"\(Apple Development:.*\)"/\1/p' | head -1)"
  if [[ -n "$identity" ]]; then
    printf '%s\n' "$identity"
    return 0
  fi

  printf '%s\n' "$output" | sed -n 's/.*"\(Mac Developer:.*\)"/\1/p' | head -1
}

atlas_detect_installer_identity() {
  security find-identity -v -p basic 2>/dev/null \
    | sed -n 's/.*"\(Developer ID Installer:.*\)"/\1/p' \
    | head -1
}

atlas_local_identity_exists() {
  local keychain_path identity_name
  keychain_path="$(atlas_local_signing_keychain_path)"
  identity_name="$(atlas_local_signing_identity_name)"

  [[ -f "$keychain_path" ]] || return 1
  security find-certificate -a -c "$identity_name" "$keychain_path" >/dev/null 2>&1
}

atlas_unlock_local_signing_keychain() {
  local keychain_path keychain_password
  keychain_path="$(atlas_local_signing_keychain_path)"
  keychain_password="$(atlas_local_signing_keychain_password)"

  [[ -f "$keychain_path" ]] || return 0
  security unlock-keychain -p "$keychain_password" "$keychain_path" >/dev/null 2>&1 || true
  security set-keychain-settings -lut 21600 "$keychain_path" >/dev/null 2>&1 || true
  atlas_add_local_signing_keychain_to_search_list
}

atlas_add_local_signing_keychain_to_search_list() {
  local keychain_path
  keychain_path="$(atlas_local_signing_keychain_path)"

  [[ -f "$keychain_path" ]] || return 0

  local current_keychains=()
  while IFS= read -r line; do
    line="${line#"${line%%[![:space:]]*}"}"
    line="${line%\"}"
    line="${line#\"}"
    [[ -n "$line" ]] && current_keychains+=("$line")
  done < <(security list-keychains -d user 2>/dev/null || true)

  if printf '%s\n' "${current_keychains[@]}" | grep -Fx "$keychain_path" >/dev/null 2>&1; then
    return 0
  fi

  security list-keychains -d user -s "$keychain_path" "${current_keychains[@]}" >/dev/null 2>&1 || true
}

atlas_local_identity_usable() {
  atlas_local_identity_exists || return 1

  local keychain_path identity_name sample_file
  keychain_path="$(atlas_local_signing_keychain_path)"
  identity_name="$(atlas_local_signing_identity_name)"

  atlas_unlock_local_signing_keychain

  sample_file="$(mktemp "${TMPDIR:-/tmp}/atlas-local-signing-check.XXXXXX")"
  printf 'atlas local signing check\n' > "$sample_file"
  if ! /usr/bin/codesign --force --sign "$identity_name" --keychain "$keychain_path" "$sample_file" >/dev/null 2>&1; then
    rm -f "$sample_file"
    return 1
  fi

  rm -f "$sample_file"
  return 0
}

atlas_signing_mode_for_identity() {
  local identity="${1:-}"
  local local_identity_name
  local_identity_name="$(atlas_local_signing_identity_name)"

  if [[ -z "$identity" || "$identity" == "-" ]]; then
    printf '%s\n' "adhoc"
  elif [[ "$identity" == Developer\ ID\ Application:* ]]; then
    printf '%s\n' "developer-id"
  elif [[ "$identity" == "$local_identity_name" ]]; then
    printf '%s\n' "local-stable"
  else
    printf '%s\n' "local-stable"
  fi
}

atlas_resolve_app_signing_identity() {
  if [[ -n "${ATLAS_CODESIGN_IDENTITY:-}" ]]; then
    printf '%s\n' "$ATLAS_CODESIGN_IDENTITY"
    return 0
  fi

  local identity
  identity="$(atlas_detect_release_app_identity)"
  if [[ -n "$identity" ]]; then
    printf '%s\n' "$identity"
    return 0
  fi

  identity="$(atlas_detect_development_app_identity)"
  if [[ -n "$identity" ]]; then
    printf '%s\n' "$identity"
    return 0
  fi

  if atlas_local_identity_usable; then
    printf '%s\n' "$(atlas_local_signing_identity_name)"
    return 0
  fi

  printf '%s\n' "-"
}

atlas_resolve_app_signing_keychain() {
  local identity="${1:-}"

  if [[ -n "${ATLAS_CODESIGN_KEYCHAIN:-}" ]]; then
    printf '%s\n' "$ATLAS_CODESIGN_KEYCHAIN"
    return 0
  fi

  if [[ "$identity" == "$(atlas_local_signing_identity_name)" ]] && atlas_local_identity_exists; then
    printf '%s\n' "$(atlas_local_signing_keychain_path)"
    return 0
  fi

  printf '%s\n' ""
}

atlas_resolve_installer_signing_identity() {
  if [[ -n "${ATLAS_INSTALLER_SIGN_IDENTITY:-}" ]]; then
    printf '%s\n' "$ATLAS_INSTALLER_SIGN_IDENTITY"
    return 0
  fi

  atlas_detect_installer_identity
}