From e7c0e39fe227b9d5dcba9f204bb5df1fe72ba2b2 Mon Sep 17 00:00:00 2001
From: onevcat <onevcat@gmail.com>
Date: Sun, 5 Apr 2026 20:42:08 +0900
Subject: [PATCH] fix(release): codesign bundled prowl CLI with hardened
 runtime

The prowl binary at Resources/prowl-cli/prowl was missing hardened
runtime, causing Apple notarization to reject the DMG.
---
 doc-onevcat/scripts/release.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/doc-onevcat/scripts/release.sh b/doc-onevcat/scripts/release.sh
index fb2855f7..12218e9f 100755
--- a/doc-onevcat/scripts/release.sh
+++ b/doc-onevcat/scripts/release.sh
@@ -198,6 +198,14 @@ if [[ -d "$SENTRY_FRAMEWORK" ]]; then
   codesign -f -s "$IDENTITY_SHA" -o runtime --timestamp -v "$SENTRY_FRAMEWORK"
 fi
 
+# ── Re-sign bundled CLI ─────────────────────────────────────────────────────
+
+PROWL_CLI="$APP_PATH/Contents/Resources/prowl-cli/prowl"
+if [[ -f "$PROWL_CLI" ]]; then
+  log "re-signing bundled prowl CLI with hardened runtime..."
+  codesign -f -s "$IDENTITY_SHA" -o runtime --timestamp -v "$PROWL_CLI"
+fi
+
 # ── Re-sign app ─────────────────────────────────────────────────────────────
 
 log "re-signing app..."
-- 
2.51.2