From 44ae94039c41de102e795771e8bb5178e6d3732c Mon Sep 17 00:00:00 2001
From: Marcos Paulo <marcos.paulodasilva.mp@gmail.com>
Date: Fri, 16 Oct 2026 17:46:26 -0300
Subject: [PATCH] fix(packaging): DMG keeps the app signature valid when
 mounted (hdiutil create, makehybrid fallback)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packaging/macos/package.sh | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index bdd644a..663d841 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -127,13 +127,17 @@ fi
 echo "==> building $DMG"
 STAGE="$WORK/dmg"
 mkdir -p "$STAGE"
-ditto "$APP" "$STAGE/NotesCraft.app"
+ditto --norsrc --noextattr --noacl "$APP" "$STAGE/NotesCraft.app"
 ln -s /Applications "$STAGE/Applications"
 rm -f "$DMG" "$WORK/raw.dmg"
-# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
-# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
-hdiutil makehybrid -hfs -hfs-volume-name "NotesCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
-hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
+# `create -srcfolder` keeps the app bundle byte-identical (its signature still verifies from the mounted
+# image). It can fail on busy CI runners ("Resource busy"); then fall back to makehybrid, which builds the
+# image without attaching a device but stamps FinderInfo on files (the bundle then needs a re-sign after copy).
+if ! hdiutil create -srcfolder "$STAGE" -volname NotesCraft -fs HFS+ -format UDZO -imagekey zlib-level=9 -ov "$DMG"; then
+  warn "hdiutil create failed; falling back to makehybrid"
+  hdiutil makehybrid -hfs -hfs-volume-name "NotesCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
+  hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
+fi
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"