ci: release notarized Meetingnotes updates through Gitea

scripts/package_release.sh

@@ -14,11 +14,13 @@ APP_PATH="$DERIVED_DATA/Build/Products/Release/$APP_NAME.app"
 required_variables=(
   VERSION
   SIGNING_IDENTITY
+  SIGNING_KEYCHAIN
   APPLE_ID
   APPLE_TEAM_ID
   APPLE_APP_PASSWORD
   SPARKLE_PRIVATE_KEY
   GITHUB_REPOSITORY
+  RELEASE_BASE_URL
 )
 
 for variable in "${required_variables[@]}"; do
@@ -57,12 +59,12 @@ SPARKLE_FRAMEWORK="$APP_PATH/Contents/Frameworks/Sparkle.framework"
 SPARKLE_CONTENTS="$SPARKLE_FRAMEWORK/Versions/B"
 
 sign_component() {
-  codesign --force --timestamp --options runtime --sign "$SIGNING_IDENTITY" "$1"
+  codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" --sign "$SIGNING_IDENTITY" "$1"
 }
 
 sign_component "$SPARKLE_CONTENTS/XPCServices/Installer.xpc"
 if [[ -d "$SPARKLE_CONTENTS/XPCServices/Downloader.xpc" ]]; then
-  codesign --force --timestamp --options runtime \
+  codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" \
     --preserve-metadata=entitlements \
     --sign "$SIGNING_IDENTITY" \
     "$SPARKLE_CONTENTS/XPCServices/Downloader.xpc"
@@ -71,7 +73,7 @@ sign_component "$SPARKLE_CONTENTS/Autoupdate"
 sign_component "$SPARKLE_CONTENTS/Updater.app"
 sign_component "$SPARKLE_FRAMEWORK"
 
-codesign --force --timestamp --options runtime \
+codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" \
   --entitlements meetingnotes/meetingnotes.entitlements \
   --sign "$SIGNING_IDENTITY" \
   "$APP_PATH"
@@ -116,7 +118,7 @@ if [[ -z "$GENERATE_APPCAST" ]]; then
   exit 1
 fi
 
-DOWNLOAD_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/v$VERSION/"
+DOWNLOAD_URL="$RELEASE_BASE_URL/releases/download/v$VERSION/"
 printf '%s' "$SPARKLE_PRIVATE_KEY" | "$GENERATE_APPCAST" "$RELEASE_DIR" \
   --ed-key-file - \
   --download-url-prefix "$DOWNLOAD_URL" \
@@ -127,7 +129,7 @@ grep -q "$DOWNLOAD_URL$ARCHIVE_NAME" "$RELEASE_DIR/appcast.xml"
 grep -q 'sparkle:edSignature=' "$RELEASE_DIR/appcast.xml"
 
 if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
-  printf 'Built, Developer ID-signed, notarized, and stapled Meetingnotes %s. The GitHub release is ready to publish.\n' \
+  printf 'Built, Developer ID-signed, notarized, and stapled Meetingnotes %s. The Gitea release is ready to publish.\n' \
     "$VERSION" >> "$GITHUB_STEP_SUMMARY"
 fi