Fix Tart release signing

.ci/sign-release.sh

@@ -2,13 +2,15 @@
 
 set -eu
 
+APP_PATH="dist/tart_darwin_all/tart.app"
+
 if [ "${TART_RELEASE_SNAPSHOT:-false}" = "true" ]; then
   codesign \
     --force \
     --deep \
     --sign - \
     --entitlements Resources/tart-dev.entitlements \
-    dist/tart_darwin_all/tart.app
+    "$APP_PATH"
 else
   codesign \
     --force \
@@ -18,7 +20,22 @@ else
     --options runtime \
     --keychain "$RUNNER_TEMP/build.keychain" \
     --entitlements Resources/tart-prod.entitlements \
-    dist/tart_darwin_all/tart.app
-
-  codesign --verify --strict --verbose=2 dist/tart_darwin_all/tart.app
+    "$APP_PATH"
+fi
+
+codesign --verify --strict --verbose=2 "$APP_PATH"
+"$APP_PATH/Contents/MacOS/tart" --version
+
+if [ "${TART_RELEASE_SNAPSHOT:-false}" != "true" ]; then
+  NOTARIZATION_ARCHIVE="$RUNNER_TEMP/tart-notarization.zip"
+
+  ditto -c -k --keepParent "$APP_PATH" "$NOTARIZATION_ARCHIVE"
+  xcrun notarytool submit "$NOTARIZATION_ARCHIVE" \
+    --keychain-profile "notarytool" \
+    --keychain "$RUNNER_TEMP/build.keychain" \
+    --wait \
+    --timeout 20m
+  xcrun stapler staple "$APP_PATH"
+  xcrun stapler validate "$APP_PATH"
+  spctl --assess --type execute --verbose=4 "$APP_PATH"
 fi

.github/workflows/release.yml

@@ -28,6 +28,7 @@ jobs:
           persist-credentials: false
       - name: Import signing certificate
         env:
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           KEYCHAIN_PASSWORD: temporary-password
           MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
           P12_PASSWORD: password101
@@ -48,6 +49,11 @@ jobs:
             -k "$KEYCHAIN_PASSWORD" \
             "$RUNNER_TEMP/build.keychain"
           security list-keychain -d user -s "$RUNNER_TEMP/build.keychain"
+          xcrun notarytool store-credentials "notarytool" \
+            --apple-id "hello@cirruslabs.org" \
+            --team-id "9M2P8L4D89" \
+            --password "$AC_PASSWORD" \
+            --keychain "$RUNNER_TEMP/build.keychain"
       - name: Create release app token for this repo
         id: app-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1