#!/bin/bash
# One-time setup: creates a self-signed code-signing certificate and trusts
# it for the "codeSign" policy, entirely via CLI (no Keychain Access GUI).
# This is what scripts/build-signed.sh needs to sign audiotee with a stable
# identity — see CONTEXT.md §6.2 for why that matters.
#
# This script modifies your login keychain's trust settings. Read it before
# running it. macOS will likely prompt for your login password during the
# `security import` / `security add-trusted-cert` steps — that's expected,
# it's the OS asking permission to change keychain ACLs/trust, not this
# script asking for your password directly.
#
# Usage:
#   scripts/create-signing-identity.sh [certificate-name]
#   (default name: audiotee-dev)

set -euo pipefail

CERT_NAME="${1:-audiotee-dev}"
DAYS=3650
KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
WORKDIR="$(mktemp -d)"
trap 'rm -rf "$WORKDIR"' EXIT

EXISTING="$(security find-identity -v -p codesigning | grep -c "\"$CERT_NAME\"" || true)"
if [[ "$EXISTING" -gt 0 ]]; then
  echo "A code-signing identity named \"$CERT_NAME\" already exists. Nothing to do."
  security find-identity -v -p codesigning
  exit 0
fi

echo "Generating a self-signed code-signing certificate: $CERT_NAME"
openssl req -x509 -newkey rsa:2048 \
  -keyout "$WORKDIR/key.pem" -out "$WORKDIR/cert.pem" \
  -days "$DAYS" -nodes -subj "/CN=$CERT_NAME" \
  -addext "extendedKeyUsage=critical,codeSigning" \
  -addext "basicConstraints=critical,CA:false" \
  -addext "keyUsage=critical,digitalSignature"

# -legacy: OpenSSL 3.x defaults to AES-256/SHA-256 for PKCS12, which macOS's
# Security framework can't read (fails with a misleading "wrong password?").
# It needs the older RC2/3DES-based encoding this flag produces.
openssl pkcs12 -export -out "$WORKDIR/cert.p12" \
  -inkey "$WORKDIR/key.pem" -in "$WORKDIR/cert.pem" -passout pass:temporary \
  -legacy

echo "Importing into your login keychain (may prompt for your login password)..."
security import "$WORKDIR/cert.p12" -k "$KEYCHAIN" -P temporary \
  -T /usr/bin/codesign -T /usr/bin/security

echo "Trusting it for code signing only, not as a general root CA" \
  "(may prompt for your login password)..."
security add-trusted-cert -r trustRoot -p codeSign -k "$KEYCHAIN" "$WORKDIR/cert.pem"

echo ""
echo "Done. Verifying the identity is now usable by codesign:"
security find-identity -v -p codesigning

echo ""
echo "Next: scripts/build-signed.sh (it auto-detects this identity)."