// electron-builder afterSign hook (mac only - see electron-builder.config.js).
//
// Without a real Apple Developer ID, electron-builder's mac target ships
// with only the auto ad-hoc signature the linker applies to the main
// executable - the rest of the bundle (Resources, Helper.app children,
// frameworks) is left unsigned. That inconsistency is what makes macOS
// report a flat "VNCmail+ is damaged and can't be opened" once the .dmg
// picks up a quarantine attribute (from a browser download, AirDrop, or
// any other trust-boundary crossing) - not the more recoverable
// "unidentified developer, right-click to open anyway" prompt a properly
// (even if only ad-hoc) signed bundle gets. `codesign --deep` here
// produces one consistent signature covering everything, verified against
// the exact failure mode (`codesign --verify --deep --strict` on the
// unsigned-except-linker bundle failed before this was added).
//
// Still not a real Developer ID signature - Gatekeeper will still warn on
// first launch (`spctl` rejects any non-notarized app outright), but as
// the recoverable kind, not the "move to Trash" kind.
const { execFileSync } = require("node:child_process");

module.exports = async function afterSign(context) {
  if (context.electronPlatformName !== "darwin") return;

  const appPath = `${context.appOutDir}/${context.packager.appInfo.productFilename}.app`;
  execFileSync("codesign", ["--force", "--deep", "--sign", "-", appPath], {
    stdio: "inherit",
  });
};