#!/bin/sh

# Copyright (c) 2009 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Using codesign, sign the application.  Inner components are signed as needed,
# then the outermost bundle is signed, and everything is verified.

set -e

if [ $# -ne 3 ] ; then
  echo "usage: ${0} APP_PATH CODESIGN_KEYCHAIN CODESIGN_ID" >& 2
  exit 1
fi

APP_PATH="${1}"
CODESIGN_KEYCHAIN="${2}"
CODESIGN_ID="${3}"

# Use custom resource rules for the browser application.
BROWSER_APP_RULES="$(dirname "${0}")/app_resource_rules.plist"

# An .app bundle to be signed can be signed directly.  Normally, signging a
# framework bundle requires that each version within be signed individually.
# http://developer.apple.com/mac/library/technotes/tn2007/tn2206.html#TNTAG13
# In Chrome's case, the framework bundle is unversioned, so it too can be
# signed directly.  See copy_framework_unversioned.

BROWSER_APP="${APP_PATH}"
FRAMEWORK="${BROWSER_APP}/Contents/Versions/@VERSION@/@MAC_PRODUCT_NAME@ Framework.framework"
HELPER_APP="${BROWSER_APP}/Contents/Versions/@VERSION@/@MAC_PRODUCT_NAME@ Helper.app"

echo "${0}: signing..."

# Sign the outer .app last so that its seal includes the signed inner
# components.

codesign -s "${CODESIGN_ID}" --keychain "${CODESIGN_KEYCHAIN}" "${FRAMEWORK}"
codesign -s "${CODESIGN_ID}" --keychain "${CODESIGN_KEYCHAIN}" "${HELPER_APP}"
codesign -s "${CODESIGN_ID}" --keychain "${CODESIGN_KEYCHAIN}" \
    "${BROWSER_APP}" --resource-rules "${BROWSER_APP_RULES}"

# Verify everything to ensure that signing the outer bundle didn't break an
# inner bundle.

echo "${0}: verifying..."

codesign -v "${FRAMEWORK}"
codesign -v "${HELPER_APP}"
codesign -v "${BROWSER_APP}"