From 5130adb00f08df9539e5eacb09e6234b0b7eafe1 Mon Sep 17 00:00:00 2001
From: sck_0 <188885273+sck000@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:32:17 +0200
Subject: [PATCH 1/2] Preserve release build failures

---
 scripts/build-release.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index fd7e2c3..b87ef61 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -4,7 +4,7 @@
 # Usage: ./build-release.sh <version>
 # Example: ./build-release.sh 1.0.3
 
-set -e
+set -euo pipefail
 
 # Colors for output
 RED='\033[0;31m'
@@ -13,7 +13,7 @@ YELLOW='\033[1;33m'
 NC='\033[0m' # No Color
 
 # Check version argument
-if [ -z "$1" ]; then
+if [ -z "${1:-}" ]; then
     echo -e "${RED}Error: Version number required${NC}"
     echo "Usage: ./build-release.sh <version>"
     echo "Example: ./build-release.sh 1.0.3"
@@ -27,6 +27,7 @@ XCODE_PROJECT="$PROJECT_ROOT/DropKit/DropKit.xcodeproj"
 BUILD_DIR="$PROJECT_ROOT/build"
 RELEASES_DIR="$PROJECT_ROOT/releases"
 APP_NAME="DropKit"
+BUILD_LOG="$BUILD_DIR/xcodebuild-release.log"
 
 echo -e "${GREEN}========================================${NC}"
 echo -e "${GREEN}  DropKit Release Build v${VERSION}${NC}"
@@ -46,6 +47,7 @@ xattr -cr "$PROJECT_ROOT/DropKit" 2>/dev/null || true
 
 # Step 2: Build Release version (using build instead of archive)
 echo -e "\n${YELLOW}[2/5] Building Release version...${NC}"
+set +e
 xcodebuild -project "$XCODE_PROJECT" \
     -scheme "$APP_NAME" \
     -configuration Release \
@@ -55,7 +57,17 @@ xcodebuild -project "$XCODE_PROJECT" \
     CODE_SIGN_IDENTITY="-" \
     CODE_SIGNING_REQUIRED=NO \
     CODE_SIGNING_ALLOWED=NO \
-    build 2>&1 | grep -E "(Compiling|Linking|Build|error:|warning:)" || true
+    build >"$BUILD_LOG" 2>&1
+BUILD_STATUS=$?
+set -e
+
+grep -E "(Compiling|Linking|Build|error:|warning:)" "$BUILD_LOG" || true
+
+if [ "$BUILD_STATUS" -ne 0 ]; then
+    echo -e "${RED}Error: xcodebuild failed with status $BUILD_STATUS${NC}"
+    echo "Full build log: $BUILD_LOG"
+    exit "$BUILD_STATUS"
+fi
 
 # Find the built app
 APP_PATH="$BUILD_DIR/DerivedData/Build/Products/Release/$APP_NAME.app"

From c534852dadfc5ed09e56ae3b63a05c462abf3466 Mon Sep 17 00:00:00 2001
From: sck_0 <188885273+sck000@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:45:14 +0200
Subject: [PATCH 2/2] Require signed release builds by default

---
 scripts/build-release.sh | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index b87ef61..9ced610 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -24,14 +24,36 @@ VERSION="$1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
 XCODE_PROJECT="$PROJECT_ROOT/DropKit/DropKit.xcodeproj"
+ENTITLEMENTS="$PROJECT_ROOT/DropKit/Sources/DropKit.entitlements"
 BUILD_DIR="$PROJECT_ROOT/build"
 RELEASES_DIR="$PROJECT_ROOT/releases"
 APP_NAME="DropKit"
 BUILD_LOG="$BUILD_DIR/xcodebuild-release.log"
+SIGNING_IDENTITY="${DROPKIT_SIGNING_IDENTITY:-}"
+ALLOW_AD_HOC="${DROPKIT_ALLOW_AD_HOC:-0}"
+
+if [ -z "$SIGNING_IDENTITY" ]; then
+    if [ "$ALLOW_AD_HOC" = "1" ]; then
+        SIGNING_IDENTITY="-"
+        CODE_SIGNING_REQUIRED_VALUE=NO
+        CODE_SIGNING_ALLOWED_VALUE=NO
+        SIGNING_DESCRIPTION="ad-hoc (DROPKIT_ALLOW_AD_HOC=1)"
+    else
+        echo -e "${RED}Error: DROPKIT_SIGNING_IDENTITY is required for release builds${NC}"
+        echo "Example: DROPKIT_SIGNING_IDENTITY=\"Developer ID Application: Example (TEAMID)\" ./build-release.sh $VERSION"
+        echo "For local unsigned testing only, set DROPKIT_ALLOW_AD_HOC=1."
+        exit 1
+    fi
+else
+    CODE_SIGNING_REQUIRED_VALUE=YES
+    CODE_SIGNING_ALLOWED_VALUE=YES
+    SIGNING_DESCRIPTION="$SIGNING_IDENTITY"
+fi
 
 echo -e "${GREEN}========================================${NC}"
 echo -e "${GREEN}  DropKit Release Build v${VERSION}${NC}"
 echo -e "${GREEN}========================================${NC}"
+echo -e "Signing identity: ${YELLOW}$SIGNING_DESCRIPTION${NC}"
 
 # Step 1: Clean previous build and remove extended attributes
 echo -e "\n${YELLOW}[1/5] Cleaning previous build...${NC}"
@@ -54,9 +76,9 @@ xcodebuild -project "$XCODE_PROJECT" \
     -derivedDataPath "$BUILD_DIR/DerivedData" \
     MARKETING_VERSION="$VERSION" \
     CURRENT_PROJECT_VERSION="$VERSION" \
-    CODE_SIGN_IDENTITY="-" \
-    CODE_SIGNING_REQUIRED=NO \
-    CODE_SIGNING_ALLOWED=NO \
+    CODE_SIGN_IDENTITY="$SIGNING_IDENTITY" \
+    CODE_SIGNING_REQUIRED="$CODE_SIGNING_REQUIRED_VALUE" \
+    CODE_SIGNING_ALLOWED="$CODE_SIGNING_ALLOWED_VALUE" \
     build >"$BUILD_LOG" 2>&1
 BUILD_STATUS=$?
 set -e
@@ -82,7 +104,12 @@ echo -e "${GREEN}Build completed successfully${NC}"
 # Step 3: Clean extended attributes from built app and re-sign
 echo -e "\n${YELLOW}[3/5] Preparing app for distribution...${NC}"
 xattr -cr "$APP_PATH"
-codesign --force --deep --sign - "$APP_PATH"
+codesign_args=(--force --deep --sign "$SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS")
+if [ "$SIGNING_IDENTITY" != "-" ]; then
+    codesign_args+=(--options runtime)
+fi
+codesign "${codesign_args[@]}" "$APP_PATH"
+codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 echo -e "${GREEN}App prepared and signed${NC}"
 
 # Step 4: Create ZIP