"""Sign an existing, prepared AFFECTOR release copy from the inside out."""
from pathlib import Path
import argparse,subprocess
p=argparse.ArgumentParser(description=__doc__);p.add_argument('--app',type=Path,required=True);p.add_argument('--identity',required=True);a=p.parse_args();app=a.app.resolve()
if not (app/'Contents/Info.plist').is_file():raise SystemExit('Expected an existing .app bundle')
framework=app/'Contents/Resources/Python.framework'
for name,target in {'Versions/Current':'3.14','Python':'Versions/Current/Python','Resources':'Versions/Current/Resources','Headers':'Versions/Current/Headers'}.items():
 link=framework/name
 if not link.exists() and not link.is_symlink():link.symlink_to(target)
magic={bytes.fromhex(s) for s in ('cffaedfe','cefaedfe','feedfacf','feedface','cafebabe','cafebabf','bebafeca','bfbafeca')}
def macho(path):
 if path.is_symlink() or not path.is_file():return False
 with path.open('rb') as f:return f.read(4) in magic

def sign(path):
 r=subprocess.run(['codesign','--force','--sign',a.identity,'--timestamp','--options','runtime',str(path)],capture_output=True,text=True)
 if r.returncode:raise RuntimeError(str(path)+'\n'+r.stderr)
binaries=sorted((x for x in app.rglob('*') if macho(x)),key=lambda x:len(x.parts),reverse=True)
print('Signing',len(binaries),'native binaries',flush=True)
for i,b in enumerate(binaries):
 sign(b)
 if (i+1)%25==0:print(i+1,'signed',flush=True)
for b in sorted((x for x in app.rglob('*') if x.is_dir() and not x.is_symlink() and x.suffix in ('.app','.framework','.xpc','.appex')),key=lambda x:len(x.parts),reverse=True):sign(b)
sign(app);subprocess.run(['codesign','--verify','--deep','--strict',str(app)],check=True)
print('Signed and verified',app,flush=True)