feat(KAN-65): add signed macOS updates and DMG distribution

native/release-macos.mjs

@@ -13,6 +13,7 @@ import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parseArgs } from 'node:util';
+import { createDiskImage } from './macos-dmg.mjs';
 
 export const appleTeamId = 'ZZX2KZGTHU';
 export const bundleIdentifier = 'de.kanbangit.desktop';
@@ -105,6 +106,11 @@ export function releaseMacos({
         throw new Error('--resume requires the Apple submission UUID.');
     }
 
+    if (!env.TAURI_SIGNING_PRIVATE_KEY?.trim()) {
+        throw new Error(
+            'Set TAURI_SIGNING_PRIVATE_KEY to the permanent updater signing key.',
+        );
+    }
     const identity = env.APPLE_SIGNING_IDENTITY?.trim();
     const profile = env.APPLE_NOTARY_KEYCHAIN_PROFILE?.trim();
 
@@ -405,20 +411,42 @@ export function releaseMacos({
             app,
         ]);
 
-        const name = `KanbanGit-${config.version}-${target}.zip`;
+        const name = `KanbanGit-${config.version}-${target}.dmg`;
         const archive = join(staging, name);
-        step('Packaging notarized download', 'ditto', [
-            '-c',
-            '-k',
-            '--sequesterRsrc',
-            '--keepParent',
+        createDiskImage({
             app,
             archive,
-        ]);
+            identity,
+            run: (command, args) =>
+                step('Packaging notarized download', command, args),
+        });
         const checksum = createHash('sha256')
             .update(readFileSync(archive))
             .digest('hex');
         writeFileSync(`${archive}.sha256`, `${checksum}  ${name}\n`);
+        const updaterName = `KanbanGit-${config.version}-${target}.app.tar.gz`;
+        const updaterArchive = join(staging, updaterName);
+        step('Packaging updater archive', 'tar', [
+            '-czf',
+            updaterArchive,
+            '-C',
+            dirname(app),
+            'KanbanGit.app',
+        ]);
+        step('Signing updater archive', 'pnpm', [
+            'exec',
+            'tauri',
+            'signer',
+            'sign',
+            updaterArchive,
+        ]);
+        const updaterChecksum = createHash('sha256')
+            .update(readFileSync(updaterArchive))
+            .digest('hex');
+        writeFileSync(
+            `${updaterArchive}.sha256`,
+            `${updaterChecksum}  ${updaterName}\n`,
+        );
         rmSync(submission, { force: true });
         renameSync(staging, destination);
         log(`Verified release: ${join(destination, name)}`);