# Local signing settings for app/packaging/local-package.sh.
#
#   cp app/packaging/env.example .env      # repo root; .env is gitignored. Edit, keep it private.
#
# Format: KEY=value, one per line. Only VJ_* and APPLE_* keys are read; values are literal (no
# $VAR or `command` expansion; one pair of surrounding quotes is stripped; no inline comments).
# A variable already set in your shell wins over this file.
#
# A value of the form op://vault/item/field is resolved with the 1Password CLI (`op read`) when
# `op` is installed, so no secret needs to sit in this file.
#
# Every key below is optional. With none set, macOS auto-detects the identity in your login
# keychain and Windows lets signtool pick one.

# ---- macOS ----------------------------------------------------------------------------------
# Signing identity: a name, or a SHA-1 hash (unambiguous when a renewed cert has the same name),
# or "-" for ad hoc. See yours with: security find-identity -v -p codesigning
# Default: the newest-expiring "Developer ID Application", else "Apple Development", else ad hoc.
# VJ_SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID1234)"

# Notarization (--notarize). Preferred: a keychain profile created once with
#   xcrun notarytool store-credentials vj-notary --key AuthKey_XXXX.p8 --key-id KEYID --issuer ISSUER-UUID
# (or with --apple-id/--team-id/--password for an app-specific password). Secrets stay in the keychain.
# VJ_NOTARY_PROFILE=vj-notary

# Alternative: an App Store Connect API key on disk (path to the .p8, or an op:// file reference).
# APPLE_NOTARY_KEY_ID=ABC123DEFG
# APPLE_NOTARY_ISSUER_ID=00000000-0000-0000-0000-000000000000
# APPLE_NOTARY_KEY_PATH=/path/to/AuthKey_ABC123DEFG.p8

# ---- Windows (Git Bash / MSYS2) -------------------------------------------------------------
# A code-signing certificate file ...
# VJ_SIGN_PFX=C:/path/to/codesign.pfx
# VJ_SIGN_PFX_PASSWORD=
# ... or the thumbprint of one in your CurrentUser\My certificate store (certmgr.msc).
# VJ_SIGN_CERT_SHA1=0123456789ABCDEF0123456789ABCDEF01234567
# Default if neither is set: signtool's automatic selection (unsigned if no certificate matches).

# RFC 3161 timestamp server (default http://timestamp.digicert.com).
# VJ_SIGN_TIMESTAMP_URL=http://timestamp.digicert.com
# Path to signtool.exe if it is not in the Windows SDK's default location.
# VJ_SIGNTOOL=C:/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe