Revert "JBR-5600 Sign macOS binaries using jet-sign"

This reverts commit ae867dd13d.

jb/project/tools/mac/scripts/codesign.sh

@@ -1,47 +0,0 @@
-#!/bin/bash
-SCRIPT_DIR="$(cd "$(dirname "$0")" >/dev/null && pwd)"
-
-source "$SCRIPT_DIR/jetsign-common.sh" || exit 1
-
-function isMacOsBinary() {
-  file "$1" | grep -q 'Mach-O'
-}
-
-function isSigned() {
-  codesign --verify "$1" >/dev/null 2>&1 && ! grep -q Signature=adhoc < <(codesign --display --verbose "$1" 2>&1)
-}
-
-# last argument is a path to be signed
-pathToBeSigned="$(pwd)/${*: -1}"
-jetSignArgs=("${@:1:$#-1}")
-if [[ ! -f "$pathToBeSigned" ]]; then
-  echo "$pathToBeSigned is missing or not a file"
-  exit 1
-elif isSigned "$pathToBeSigned" && ! isForced "${jetSignArgs[@]}" ; then
-  echo "Already signed: $pathToBeSigned"
-elif [[ "$JETSIGN_CLIENT" == "null" ]]; then
-  echo "JetSign client is missing, cannot proceed with signing"
-  exit 1
-elif ! isMacOsBinary "$pathToBeSigned" && [[ "$pathToBeSigned" != *.sit ]] && [[ "$pathToBeSigned" != *.tar.gz ]]; then
-  echo "$pathToBeSigned won't be signed, assumed not to be a macOS executable"
-else
-  if isMacOsBinary "$pathToBeSigned" && ! isSigned "$pathToBeSigned" ; then
-    echo "Unsigned macOS binary: $pathToBeSigned"
-  fi
-  workDir=$(dirname "$pathToBeSigned")
-  pathSigned="$workDir/signed/${pathToBeSigned##*/}"
-  jetSignExtensions=$(jetSignExtensions "${jetSignArgs[@]}")
-  contentType=$(jetSignContentType "$pathToBeSigned")
-  (
-    cd "$workDir" || exit 1
-    "$JETSIGN_CLIENT" -log-format text -denoted-content-type "$contentType" -extensions "$jetSignExtensions" "$pathToBeSigned"
-    # SRE-1223 (Codesign removes execute bits in executable files) workaround
-    chmod "$(stat -f %A "$pathToBeSigned")" "$pathSigned"
-    if isMacOsBinary "$pathSigned"; then
-      isSigned "$pathSigned"
-    fi
-    rm "$pathToBeSigned"
-    mv "$pathSigned" "$pathToBeSigned"
-    rm -rf "$workDir/signed"
-  )
-fi

jb/project/tools/mac/scripts/jetsign-common.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-function isForced() {
-  for arg in "$@"; do
-    if [[ "$arg" == --force ]]; then
-      return 0
-    fi
-  done
-  return 1
-}
-
-function jetSignExtensions() {
-  args=("$@")
-  ((lastElementIndex=${#args[@]}-1))
-  for index in "${!args[@]}"; do
-    arg=${args[$index]}
-    case "$arg" in
-    --sign | -s)
-      echo -n 'mac_codesign_identity='
-      continue
-      ;;
-    --entitlements)
-      echo -n 'mac_codesign_entitlements='
-      continue
-      ;;
-    --options=runtime)
-      echo -n 'mac_codesign_options=runtime'
-      ;;
-    --force)
-      echo -n 'mac_codesign_force=true'
-      ;;
-    --timestamp | --verbose | -v)
-      continue
-      ;;
-    *)
-      echo -n "$arg"
-      ;;
-    esac
-    if [[ $index != "$lastElementIndex" ]]; then
-      echo -n ","
-    fi
-  done
-}
-
-# See jetbrains.sign.util.FileUtil.contentType
-function jetSignContentType() {
-  case "${1##*/}" in
-  *.sit)
-    echo -n 'application/x-mac-app-zip'
-    ;;
-  *.tar.gz)
-    echo -n 'application/x-mac-app-targz'
-    ;;
-  *.pkg)
-    echo -n 'application/x-mac-pkg'
-    ;;
-  *)
-    echo -n 'application/x-mac-app-bin'
-    ;;
-  esac
-}
-

jb/project/tools/mac/scripts/notarize.sh

@@ -1,17 +1,21 @@
 #!/bin/bash
 
-#immediately exit script with an error if a command fails
 set -euo pipefail
-[[ "${SCRIPT_VERBOSE:-}" == "1" ]] && set -x
+set -x
 
-APP_PATH=$1
+APP_DIRECTORY=$1
+APPL_USER=$2
+APPL_PASSWORD=$3
+APP_NAME=$4
+BUNDLE_ID=$5
+FAKE_ROOT="${6:-fake-root}"
 
-if [[ -z "$APP_PATH" ]]; then
-  echo "Usage: $0 AppPath"
+if [[ -z "$APP_DIRECTORY" ]] || [[ -z "$APPL_USER" ]] || [[ -z "$APPL_PASSWORD" ]]; then
+  echo "Usage: $0 AppDirectory Username Password"
   exit 1
 fi
-if [[ ! -f "$APP_PATH" ]]; then
-  echo "AppName '$APP_PATH' does not exist or not a file"
+if [[ ! -d "$APP_DIRECTORY" ]]; then
+  echo "AppDirectory '$APP_DIRECTORY' does not exist or not a directory"
   exit 1
 fi
 
@@ -19,22 +23,99 @@ function log() {
   echo "$(date '+[%H:%M:%S]') $*"
 }
 
+function publish-log() {
+  id=$1
+  file=$2
+  curl -T "$file" "$ARTIFACTORY_URL/$id" || true
+}
 
-# check required parameters
-: "${APPLE_ISSUER_ID}"
-: "${APPLE_KEY_ID}"
-: "${APPLE_PRIVATE_KEY}"
+function altool-upload() {
+  # Since altool uses same file for upload token we have to trick it into using different folders for token file location
+  # Also it copies zip into TMPDIR so we override it too, to simplify cleanup
+  OLD_HOME="$HOME"
+  export HOME="$FAKE_ROOT/home"
+  export TMPDIR="$FAKE_ROOT/tmp"
+  mkdir -p "$HOME"
+  mkdir -p "$TMPDIR"
+  export _JAVA_OPTIONS="-Duser.home=$HOME -Djava.io.tmpdir=$TMPDIR"
+  # Reduce amount of downloads, cache transporter libraries
+  shared_itmstransporter="$OLD_HOME/shared-itmstransporter"
+  if [[ -f "$shared_itmstransporter" ]]; then
+    cp -r "$shared_itmstransporter" "$HOME/.itmstransporter"
+  fi
+  # For some reason altool prints everything to stderr, not stdout
+  set +e
+  xcrun altool --notarize-app \
+    --username "$APPL_USER" --password "$APPL_PASSWORD" \
+    --primary-bundle-id "$BUNDLE_ID" \
+    --asc-provider JetBrainssro --file "$1" 2>&1 | tee "altool.init.out"
+  unset TMPDIR
+  export HOME="$OLD_HOME"
+  set -e
+}
 
-# shellcheck disable=SC2064
-trap "rm -f \"$PWD/tmp_key\"" INT EXIT RETURN
-echo -n "${APPLE_PRIVATE_KEY}" > tmp_key
+#immediately exit script with an error if a command fails
+set -euo pipefail
 
-log "Notarizing $APP_PATH..."
-xcrun notarytool submit --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" "$APP_PATH" 2>&1 | tee "notarytool.submit.out"
-REQUEST_ID="$(grep -e " id: " "notarytool.submit.out" | grep -oE '([0-9a-f-]{36})'| head -n1)"
+#file="$APP_NAME.zip"
 
-xcrun notarytool wait "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" --timeout 6h ||:
-xcrun notarytool log  "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}" developer_log.json ||:
-xcrun notarytool info "$REQUEST_ID" --key tmp_key --key-id "${APPLE_KEY_ID}" --issuer "${APPLE_ISSUER_ID}"
+#log "Zipping $file..."
+#rm -rf "$file"
+#ditto -c -k --sequesterRsrc --keepParent "$APP_DIRECTORY" "$file"
 
-log "Notarizing finished"
+log "Notarizing $APP_NAME..."
+rm -rf "altool.init.out" "altool.check.out"
+altool-upload "$APP_NAME"
+
+notarization_info="$(grep -e "RequestUUID" "altool.init.out" | grep -oE '([0-9a-f-]{36})')"
+
+if [ -z "$notarization_info" ]; then
+  log "Faile to read RequestUUID from altool.init.out"
+  exit 10
+fi
+
+PATH="$PATH:/usr/local/bin/"
+
+log "Notarization request sent, awaiting response"
+spent=0
+
+while true; do
+  # For some reason altool prints everything to stderr, not stdout
+  xcrun altool --username "$APPL_USER" --notarization-info "$notarization_info" --password "$APPL_PASSWORD" >"altool.check.out" 2>&1 || true
+  status="$(grep -oe 'Status: .*' "altool.check.out" | cut -c 9- || true)"
+  log "Current status: $status"
+  if [ "$status" = "invalid" ]; then
+    log "Notarization failed"
+    ec=1
+  elif [ "$status" = "success" ]; then
+    log "Notarization succeeded"
+    ec=0
+  else
+    if [ "$status" != "in progress" ]; then
+      log "Unknown notarization status, waiting more, altool output:"
+      cat "altool.check.out"
+    fi
+    if [[ $spent -gt 60 ]]; then
+      log "Waiting time out (apx 60 minutes)"
+      ec=2
+      break
+    fi
+    sleep 60
+    ((spent += 1))
+    continue
+  fi
+  developer_log="developer_log.json"
+  log "Fetching $developer_log"
+  # TODO: Replace cut with trim or something better
+  url="$(grep -oe 'LogFileURL: .*' "altool.check.out" | cut -c 13-)"
+  wget "$url" -O "$developer_log" && cat "$developer_log" || true
+  if [ $ec != 0 ]; then
+    log "Publishing $developer_log"
+    publish-log "$notarization_info" "$developer_log"
+  fi
+  break
+done
+cat "altool.check.out"
+
+rm -rf "altool.init.out" "altool.check.out"
+exit $ec

jb/project/tools/mac/scripts/productsign.sh

@@ -1,41 +0,0 @@
-#!/bin/bash
-SCRIPT_DIR="$(cd "$(dirname "$0")" >/dev/null && pwd)"
-
-source "$SCRIPT_DIR/jetsign-common.sh" || exit 1
-
-function isSigned() {
-  pkgutil --check-signature "$1" >/dev/null 2>&1 && grep -q "signed by a developer certificate" < <(pkgutil --check-signature "$1" 2>&1)
-}
-
-# second last argument is a path to be signed
-pathToBeSigned="$(pwd)/${*:(-2):1}"
-# last argument is a path to signed file
-pathOut="$(pwd)/${*:(-1)}"
-jetSignArgs=("${@:1:$#-2}")
-if [[ ! -f "$pathToBeSigned" ]]; then
-  echo "$pathToBeSigned is missing or not a file"
-  exit 1
-elif isSigned "$pathToBeSigned" && ! isForced "${jetSignArgs[@]}" ; then
-  echo "Already signed: $pathToBeSigned"
-elif [[ "$JETSIGN_CLIENT" == "null" ]]; then
-  echo "JetSign client is missing, cannot proceed with signing"
-  exit 1
-elif [[ "$pathToBeSigned" != *.pkg ]]; then
-  echo "$pathToBeSigned won't be signed, assumed not to be a macOS package"
-else
-  if ! isSigned "$pathToBeSigned" ; then
-    echo "Unsigned macOS package: $pathToBeSigned"
-  fi
-  workDir=$(dirname "$pathToBeSigned")
-  pathSigned="$workDir/signed/${pathToBeSigned##*/}"
-  jetSignExtensions=$(jetSignExtensions "${jetSignArgs[@]}")
-  contentType=$(jetSignContentType "$pathToBeSigned")
-  (
-    cd "$workDir" || exit 1
-    "$JETSIGN_CLIENT" -log-format text -denoted-content-type "$contentType" -extensions "$jetSignExtensions" "$pathToBeSigned"
-    isSigned "$pathSigned"
-    rm -f "$pathOut"
-    mv "$pathSigned" "$pathOut"
-    rm -rf "$workDir/signed"
-  )
-fi

jb/project/tools/mac/scripts/sign.sh

@@ -1,33 +1,18 @@
 #!/bin/bash
 
-#immediately exit script with an error if a command fails
 set -euo pipefail
-[[ "${SCRIPT_VERBOSE:-}" == "1" ]] && set -x
-
-if [[ $# -lt 5  ]]; then
-  echo "Usage: $0 AppDirectory AppName BundleId CertificateID InstallerCertificateID"
-  exit 1
-fi
+set -x
 
 APPLICATION_PATH=$1
-PKG_NAME=$2
+APP_NAME=$2
 BUNDLE_ID=$3
 JB_DEVELOPER_CERT=$4
 JB_INSTALLER_CERT=$5
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" >/dev/null && pwd)"
-
-# Use JetBrains sign utility if it's available
-if [[ "${JETSIGN_CLIENT:=}" == "null" ]] || [[ "$JETSIGN_CLIENT" == "" ]]; then
-  JB_SIGN=false
-  SIGN_UTILITY="codesign"
-  PRODUCTSIGN_UTILITY="productsign"
-else
-  JB_SIGN=true
-  SIGN_UTILITY="$SCRIPT_DIR/codesign.sh"
-  PRODUCTSIGN_UTILITY="$SCRIPT_DIR/productsign.sh"
+if [[ -z "$APPLICATION_PATH" ]] || [[ -z "$JB_DEVELOPER_CERT" ]]; then
+  echo "Usage: $0 AppDirectory CertificateID"
+  exit 1
 fi
-
 if [[ ! -d "$APPLICATION_PATH" ]]; then
   echo "AppDirectory '$APPLICATION_PATH' does not exist or not a directory"
   exit 1
@@ -37,6 +22,9 @@ function log() {
   echo "$(date '+[%H:%M:%S]') $*"
 }
 
+#immediately exit script with an error if a command fails
+set -euo pipefail
+
 # Cleanup files left from previous sign attempt (if any)
 find "$APPLICATION_PATH" -name '*.cstemp' -exec rm '{}' \;
 
@@ -49,13 +37,13 @@ for f in \
   if [ -d "$APPLICATION_PATH/$f" ]; then
     find "$APPLICATION_PATH/$f" \
       -type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -name "*.tbd" -o -name "*.node" -o -perm +111 \) \
-      -exec "$SIGN_UTILITY" --timestamp \
+      -exec codesign --timestamp \
       -v -s "$JB_DEVELOPER_CERT" --options=runtime --force \
-      --entitlements "$SCRIPT_DIR/entitlements.xml" {} \;
+      --entitlements entitlements.xml {} \;
   fi
 done
 
-log "Signing libraries in jars in $APPLICATION_PATH"
+log "Signing libraries in jars in $PWD"
 
 # todo: add set -euo pipefail; into the inner sh -c
 # `-e` prevents `grep -q && printf` loginc
@@ -73,10 +61,10 @@ find "$APPLICATION_PATH" -name '*.jar' \
 
     find jarfolder \
       -type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -name "*.tbd" -o -name "jattach" \) \
-      -exec "$SIGN_UTILITY" --timestamp \
+      -exec codesign --timestamp \
       --force \
       -v -s "$JB_DEVELOPER_CERT" --options=runtime \
-      --entitlements "$SCRIPT_DIR/entitlements.xml" {} \;
+      --entitlements entitlements.xml {} \;
 
     (cd jarfolder; zip -q -r -o -0 ../jar.jar .)
     mv jar.jar "$file"
@@ -85,77 +73,44 @@ find "$APPLICATION_PATH" -name '*.jar' \
 rm -rf jarfolder jar.jar
 
 log "Signing other files..."
-# shellcheck disable=SC2043
 for f in \
   "Contents/Home/bin"; do
   if [ -d "$APPLICATION_PATH/$f" ]; then
     find "$APPLICATION_PATH/$f" \
       -type f \( -name "*.jnilib" -o -name "*.dylib" -o -name "*.so" -o -name "*.tbd" -o -perm +111 \) \
-      -exec "$SIGN_UTILITY" --timestamp \
+      -exec codesign --timestamp \
       -v -s "$JB_DEVELOPER_CERT" --options=runtime --force \
-      --entitlements "$SCRIPT_DIR/entitlements.xml" {} \;
+      --entitlements entitlements.xml {} \;
   fi
 done
 
-log "Signing whole frameworks..."
-# shellcheck disable=SC2043
-if [ "$JB_SIGN" = true ]; then for f in \
-  "Contents/Home/Frameworks" "Contents/Frameworks"; do
-  if [ -d "$APPLICATION_PATH/$f" ]; then
-    find "$APPLICATION_PATH/$f" \( -name '*.framework' -o -name '*.app' \) -maxdepth 1 | while read -r line
-      do
-        log "Signing '$line':"
-        tar -pczf tmp-to-sign.tar.gz -C "$(dirname "$line")" "$(basename "$line")"
-        "$SIGN_UTILITY" --timestamp \
-            -v -s "$JB_DEVELOPER_CERT" --options=runtime \
-            --force \
-            --entitlements "$SCRIPT_DIR/entitlements.xml" tmp-to-sign.tar.gz
-        rm -rf "$line"
-        tar -xzf tmp-to-sign.tar.gz --directory "$(dirname "$line")"
-        rm -f tmp-to-sign.tar.gz
-      done
-  fi
-done; fi
-
-log "Checking framework signatures..."
-for f in \
-  "Contents/Home/Frameworks" "Contents/Frameworks"; do
-  if [ -d "$APPLICATION_PATH/$f" ]; then
-    find "$APPLICATION_PATH/$f" -name '*.framework'  -maxdepth 1 | while read -r line
-      do
-        log "Checking '$line':"
-        codesign --verify --deep --strict --verbose=4 "$line"
-      done
-  fi
-done
+#log "Signing executable..."
+#codesign --timestamp \
+#    -v -s "$JB_DEVELOPER_CERT" --options=runtime \
+#    --force \
+#    --entitlements entitlements.xml "$APPLICATION_PATH/Contents/MacOS/idea"
 
 log "Signing whole app..."
-if [ "$JB_SIGN" = true ]; then
-  tar -pczf tmp-to-sign.tar.gz --exclude='man' -C "$(dirname "$APPLICATION_PATH")" "$(basename "$APPLICATION_PATH")"
-  "$SIGN_UTILITY" --timestamp \
-    -v -s "$JB_DEVELOPER_CERT" --options=runtime \
-    --force \
-    --entitlements "$SCRIPT_DIR/entitlements.xml" tmp-to-sign.tar.gz
-  rm -rf "$APPLICATION_PATH"
-  tar -xzf tmp-to-sign.tar.gz --directory "$(dirname "$APPLICATION_PATH")"
-  rm -f tmp-to-sign.tar.gz
-else
-  "$SIGN_UTILITY" --timestamp \
-    -v -s "$JB_DEVELOPER_CERT" --options=runtime \
-    --force \
-    --entitlements "$SCRIPT_DIR/entitlements.xml" "$APPLICATION_PATH"
-fi
+codesign --timestamp \
+  -v -s "$JB_DEVELOPER_CERT" --options=runtime \
+  --force \
+  --entitlements entitlements.xml "$APPLICATION_PATH"
 
-BUILD_NAME="$(basename "$APPLICATION_PATH")"
+BUILD_NAME=$(echo $APPLICATION_PATH | awk -F"/" '{ print $2 }')
 
-log "Creating $PKG_NAME..."
-rm -rf "$PKG_NAME"
+log "Creating $APP_NAME.pkg..."
+rm -rf "$APP_NAME.pkg"
 
 mkdir -p unsigned
 pkgbuild --identifier $BUNDLE_ID --root $APPLICATION_PATH \
-    --install-location /Library/Java/JavaVirtualMachines/${BUILD_NAME} unsigned/${PKG_NAME}
-log "Signing $PKG_NAME..."
-"$PRODUCTSIGN_UTILITY" --timestamp --sign "$JB_INSTALLER_CERT" unsigned/${PKG_NAME} ${PKG_NAME}
+    --install-location /Library/Java/JavaVirtualMachines/${BUILD_NAME} unsigned/${APP_NAME}.pkg
+productsign --timestamp --sign "$JB_INSTALLER_CERT" unsigned/${APP_NAME}.pkg ${APP_NAME}.pkg
+
+#log "Signing whole app..."
+#codesign --timestamp \
+#  -v -s "$JB_DEVELOPER_CERT" --options=runtime \
+#  --force \
+#  --entitlements entitlements.xml $APP_NAME.pkg
 
 log "Verifying java is not broken"
 find "$APPLICATION_PATH" \

jb/project/tools/mac/scripts/signapp.sh

@@ -2,7 +2,7 @@
 
 #immediately exit script with an error if a command fails
 set -euo pipefail
-[[ "${SCRIPT_VERBOSE:-}" == "1" ]] && set -x
+set -x
 
 export COPY_EXTENDED_ATTRIBUTES_DISABLE=true
 export COPYFILE_DISABLE=true
@@ -17,7 +17,7 @@ JB_INSTALLER_CERT=$6
 NOTARIZE=$7
 BUNDLE_ID=$8
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" >/dev/null && pwd)"
+cd "$(dirname "$0")"
 
 function log() {
   echo "$(date '+[%H:%M:%S]') $*"
@@ -44,8 +44,7 @@ fi
 
 log "$INPUT_FILE extracted and removed"
 
-APP_NAME=$(basename "$INPUT_FILE" | awk -F".tar" '{ print $1 }')
-PKG_NAME="$APP_NAME.pkg"
+APP_NAME=$(echo ${INPUT_FILE} | awk -F".tar" '{ print $1 }')
 APPLICATION_PATH=$EXPLODED/$(ls $EXPLODED)
 
 find "$APPLICATION_PATH/Contents/Home/bin" \
@@ -74,18 +73,16 @@ if [[ $non_plist -gt 0 ]]; then
   exit 1
 fi
 
-if [[ "${JETSIGN_CLIENT:=}" == "null" ]] || [[ "$JETSIGN_CLIENT" == "" ]]; then
-  log "Unlocking keychain..."
-  # Make sure *.p12 is imported into local KeyChain
-  security unlock-keychain -p "$PASSWORD" "/Users/$USERNAME/Library/Keychains/login.keychain"
-fi
+log "Unlocking keychain..."
+# Make sure *.p12 is imported into local KeyChain
+security unlock-keychain -p "$PASSWORD" "/Users/$USERNAME/Library/Keychains/login.keychain"
 
 attempt=1
 limit=3
 set +e
 while [[ $attempt -le $limit ]]; do
   log "Signing (attempt $attempt) $APPLICATION_PATH ..."
-  "$SCRIPT_DIR/sign.sh" "$APPLICATION_PATH" "$PKG_NAME" "$BUNDLE_ID" "$CODESIGN_STRING" "$JB_INSTALLER_CERT"
+  ./sign.sh "$APPLICATION_PATH" "$APP_NAME" "$BUNDLE_ID" "$CODESIGN_STRING" "$JB_INSTALLER_CERT"
   ec=$?
   if [[ $ec -ne 0 ]]; then
     ((attempt += 1))
@@ -107,10 +104,19 @@ set -e
 
 if [ "$NOTARIZE" = "yes" ]; then
   log "Notarizing..."
-  "$SCRIPT_DIR/notarize.sh" "$PKG_NAME"
+  # shellcheck disable=SC1090
+  source "$HOME/.notarize_token"
+  # Since notarization tool uses same file for upload token we have to trick it into using different folders, hence fake root
+  # Also it leaves copy of zip file in TMPDIR, so notarize.sh overrides it and uses FAKE_ROOT as location for temp TMPDIR
+  FAKE_ROOT="$(pwd)/fake-root"
+  mkdir -p "$FAKE_ROOT"
+  echo "Notarization will use fake root: $FAKE_ROOT"
+  ./notarize.sh "$APPLICATION_PATH" "$APPLE_USERNAME" "$APPLE_PASSWORD" "$APP_NAME.pkg" "$BUNDLE_ID" "$FAKE_ROOT"
+  rm -rf "$FAKE_ROOT"
+
+  set +e
   log "Stapling..."
-  xcrun stapler staple "$APPLICATION_PATH" ||:
-  xcrun stapler staple "$PKG_NAME" ||:
+  xcrun stapler staple "$APPLICATION_PATH"
 else
   log "Notarization disabled"
   log "Stapling disabled"
@@ -123,11 +129,7 @@ log "Zipping $BUILD_NAME to $INPUT_FILE ..."
   if test -d $BACKUP_JMODS/jmods; then
     mv $BACKUP_JMODS/jmods $APPLICATION_PATH/Contents/Home
   fi
-  if [[ "$APPLICATION_PATH" != "$EXPLODED/$BUILD_NAME" ]]; then
-    mv $APPLICATION_PATH $EXPLODED/$BUILD_NAME
-  else
-    echo "No move, source == destination: $APPLICATION_PATH"
-  fi
+  mv $APPLICATION_PATH $EXPLODED/$BUILD_NAME
 
   tar -pczvf $INPUT_FILE --exclude='man' -C $EXPLODED $BUILD_NAME
   log "Finished zipping"