#!/bin/bash
set -euo pipefail
source &#34;$(dirname &#34;$0&#34;)/build_config.sh&#34;

DMG=&#34;$DMG_NAME&#34;

if [[ ! -f &#34;$DMG&#34; ]]; then
    echo &#34;Error: DMG not found at: $DMG&#34;
    exit 1
fi

ISSUER_ID=&#34;YOUR_ISSUER_ID&#34;
KEY_ID=&#34;YOUR_KEY_ID&#34;
PRIVATE_KEY_PATH=&#34;$HOME/keys/notarization.p8&#34;

create_jwt() {
    local header payload unsigned_token signature

    header=$(printf &#39;{&#34;alg&#34;:&#34;ES256&#34;,&#34;kid&#34;:&#34;%s&#34;}&#39; &#34;$KEY_ID&#34; | openssl base64 -e -A | tr &#39;+/&#39; &#39;-_&#39; | tr -d &#39;=&#39;)
    payload=$(printf &#39;{&#34;iss&#34;:&#34;%s&#34;,&#34;iat&#34;:%d,&#34;exp&#34;:%d}&#39; &#34;$ISSUER_ID&#34; &#34;$(date +%s)&#34; &#34;$(( $(date +%s) + 1200 ))&#34; \
        | openssl base64 -e -A | tr &#39;+/&#39; &#39;-_&#39; | tr -d &#39;=&#39;)

    unsigned_token=&#34;$header.$payload&#34;

    signature=$(printf &#39;%s&#39; &#34;$unsigned_token&#34; \
        | openssl dgst -sha256 -sign &#34;$PRIVATE_KEY_PATH&#34; \
        | openssl base64 -e -A | tr &#39;+/&#39; &#39;-_&#39; | tr -d &#39;=&#39;)

    echo &#34;$unsigned_token.$signature&#34;
}

echo &#34;=== Submitting DMG for notarization ===&#34;
JWT=$(create_jwt)

SUBMIT_RESPONSE=$(curl -s -X POST \
    -H &#34;Authorization: Bearer $JWT&#34; \
    -F &#34;file=@${DMG}&#34; \
    &#34;https://appstoreconnect.apple.com/notary/v2/submissions&#34;)

REQUEST_ID=$(echo &#34;$SUBMIT_RESPONSE&#34; | sed -n &#39;s/.*&#34;id&#34;:&#34;\([^&#34;]*\)&#34;.*/\1/p&#39;)

if [[ -z &#34;$REQUEST_ID&#34; ]]; then
    echo &#34;Failed to submit for notarization:&#34;
    echo &#34;$SUBMIT_RESPONSE&#34;
    exit 1
fi

echo &#34;Submission ID: $REQUEST_ID&#34;
echo &#34;Waiting for notarization result…&#34;

while true; do
    sleep 15
    JWT=$(create_jwt)

    STATUS_RESPONSE=$(curl -s -X GET \
        -H &#34;Authorization: Bearer $JWT&#34; \
        &#34;https://appstoreconnect.apple.com/notary/v2/submissions/$REQUEST_ID&#34;)

    STATUS=$(echo &#34;$STATUS_RESPONSE&#34; | sed -n &#39;s/.*&#34;status&#34;:&#34;\([^&#34;]*\)&#34;.*/\1/p&#39;)

    echo &#34;Status: $STATUS&#34;

    case &#34;$STATUS&#34; in
        &#34;Accepted&#34;)
            echo &#34;Notarization succeeded.&#34;
            break
            ;;
        &#34;Invalid&#34;|&#34;Rejected&#34;|&#34;Failed&#34;)
            echo &#34;Notarization failed.&#34;
            echo &#34;$STATUS_RESPONSE&#34;
            exit 1
            ;;
        *)
            ;;
    esac
done

echo &#34;=== Downloading notarization log ===&#34;
JWT=$(create_jwt)

curl -s -X GET \
    -H &#34;Authorization: Bearer $JWT&#34; \
    &#34;https://appstoreconnect.apple.com/notary/v2/submissions/$REQUEST_ID/log&#34; \
    -o notarization-log.json

echo &#34;Log saved to notarization-log.json&#34;

echo &#34;=== Stapling DMG ===&#34;
xcrun stapler staple &#34;$DMG&#34;

echo &#34;=== Verifying stapled DMG ===&#34;
spctl --assess --type open --verbose &#34;$DMG&#34;

echo &#34;=== notarize_dmg.sh complete ===&#34;