app/packaging/local-package.sh [--sign] [--notarize] packages a normal build on a
developer machine and signs it with a certificate found locally:
- macOS: VJ_SIGN_IDENTITY, else the newest-expiring valid "Developer ID Application"
identity (chosen by SHA-1 so renewed duplicates are unambiguous), else "Apple
Development", else ad hoc. --notarize uses VJ_NOTARY_PROFILE (notarytool keychain
profile) or APPLE_NOTARY_KEY_ID/ISSUER_ID/KEY_PATH, then staples and runs spctl.
- Windows (Git Bash): VJ_SIGN_PFX(+_PASSWORD), else VJ_SIGN_CERT_SHA1, else signtool
/a, else unsigned; signs exe, dlls and the installer when Inno Setup is present.
- Settings come from the environment, then a gitignored repo-root .env (only VJ_*/
APPLE_* keys, nothing evaluated, op:// references resolved with `op` if installed).
- -DVJ_APP_SIGN_DEV_BUILD=ON signs the dev executable after each macOS build.
codesign.sh's notarize step also accepts a keychain profile or a .p8 path; CI's
base64 secret path is unchanged. package.sh gets an env-guarded signing hook.
Refs #839
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
