#!/bin/bash
#
# build_dmg.sh — PUBLIC‑SAFE VERSION
#
# Purpose:
#   Packages the application into a DMG, signs it, and prepares it for notarization.
#
# Notes for public sharing:
#   - Replace all placeholders (YOUR NAME, TEAMID, plugin name, etc.).
#   - Do NOT insert your real Developer ID certificate name into public posts.
#   - This script contains no private keys or credentials.
#

set -euo pipefail
source &#34;$(dirname &#34;$0&#34;)/build_config.sh&#34;

echo &#34;=== Starting DMG build ===&#34;

mkdir -p &#34;$RELEASES&#34;
rm -f &#34;$DMG_NAME&#34;

echo &#34;=== Preparing wrapper folder ===&#34;
WRAPPER=&#34;$APP_ROOT/DMGWrapper&#34;
APP_FOLDER=&#34;$WRAPPER/MyApp&#34;

rm -rf &#34;$WRAPPER&#34;
mkdir -p &#34;$APP_FOLDER&#34;

echo &#34;=== Copying full runtime into wrapper ===&#34;
cp -R &#34;$APP_ROOT&#34;/* &#34;$APP_FOLDER/&#34;

WRAPPED_APP=&#34;$APP_FOLDER/MyApp.app&#34;

echo &#34;=== Injecting plugin into sibling Extensions folder ===&#34;
PLUGIN_SRC=&#34;$APP_ROOT/Extensions/MyPlugin.fmplugin&#34;
PLUGIN_DEST=&#34;$APP_FOLDER/Extensions&#34;

mkdir -p &#34;$PLUGIN_DEST&#34;
cp -R &#34;$PLUGIN_SRC&#34; &#34;$PLUGIN_DEST/&#34;

echo &#34;=== Deep signing app bundle ===&#34;
codesign --force --deep --options runtime \
  --sign &#34;Developer ID Application: YOUR NAME (TEAMID)&#34; \
  &#34;$WRAPPED_APP&#34;

echo &#34;=== Verifying signature ===&#34;
codesign --verify --deep --strict --verbose=4 &#34;$WRAPPED_APP&#34;

echo &#34;=== Creating DMG ===&#34;
hdiutil create \
  -volname &#34;$VOL_NAME&#34; \
  -srcfolder &#34;$WRAPPER&#34; \
  -ov \
  -format UDZO \
  &#34;$DMG_NAME&#34;

rm -rf &#34;$WRAPPER&#34;

echo &#34;=== Signing DMG ===&#34;
codesign --force --sign &#34;Developer ID Application: YOUR NAME (TEAMID)&#34; &#34;$DMG_NAME&#34;

echo &#34;=== DMG build complete ===&#34;