feat(appstore): add a Mac App Store build track

Tauri has no App Store target, so mas-package.sh covers the distance between the .app and something
App Store Connect will take. The order is load-bearing: the provisioning profile goes in before
codesign runs because the signature covers it, which is also why Tauri's own signing is switched
off for this build.

The sandbox costs three things, all Apple's rules rather than choices. The updater is gone, and
falls out for free because the plugin was already conditional on the config declaring it; only the
release overlay does. The Check for Updates menu item is gated on the same condition, since a menu
item that errors when clicked is its own rejection risk. The library moves into the container, and
the system spelling dictionary becomes unreadable.

Two things the first upload taught us. The profile is kept owner-only where it lives next to the
signing keys, and cp carried that mode into the bundle; Apple rejects a package containing anything
a non-root user cannot read. And altool exits 0 after printing UPLOAD FAILED, so its exit status
cannot be trusted and the transcript is the only reliable signal.

Claude-Session: https://claude.ai/code/session_018HwEWvoE1NkkUjJCMLSnup

scripts/mas-package.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Turn the .app that `tauri build` produced into a signed .pkg the App Store will accept, and
+# optionally hand it to App Store Connect.
+#
+# Tauri has no App Store target, so everything after the bundle is done here: the provisioning
+# profile goes in before signing (codesign hashes it), the entitlements carry the team identifier,
+# and productbuild wraps the result. Tauri's own signing is deliberately not used, because it
+# cannot embed a profile and would sign the app before the profile was in place.
+set -euo pipefail
+
+# CI builds universal; a local check against a single-arch build only needs to override this.
+app="${APP_PATH:-src-tauri/target/universal-apple-darwin/release/bundle/macos/Margin.app}"
+pkg="${PKG_PATH:-target-mas/Margin.pkg}"
+
+: "${APPLE_TEAM_ID:?set APPLE_TEAM_ID to the 10-character team identifier}"
+: "${MAS_PROVISION_PROFILE:?set MAS_PROVISION_PROFILE to the .provisionprofile path}"
+: "${MAS_APP_IDENTITY:?set MAS_APP_IDENTITY, e.g. '3rd Party Mac Developer Application: Priyanshu Jain (TEAMID)'}"
+: "${MAS_INSTALLER_IDENTITY:?set MAS_INSTALLER_IDENTITY, e.g. '3rd Party Mac Developer Installer: Priyanshu Jain (TEAMID)'}"
+
+[ -d "$app" ] || { echo "mas-package: $app does not exist; run the build first." >&2; exit 1; }
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$(dirname "$pkg")"
+
+# App Store Connect rejects an upload whose CFBundleVersion it has already seen, so a rejected
+# build has to come back with a higher one. The marketing version stays put.
+if [ -n "${MAS_BUILD_NUMBER:-}" ]; then
+  /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $MAS_BUILD_NUMBER" "$app/Contents/Info.plist"
+fi
+
+cp "$MAS_PROVISION_PROFILE" "$app/Contents/embedded.provisionprofile"
+
+# The profile is kept owner-only where it lives, because it sits next to signing keys, and cp
+# carries that mode across. Apple rejects a package containing anything a non-root user cannot
+# read, since the code signature could not then be verified at launch. Widen everything rather
+# than just the profile, and only ever add permission bits, never remove one.
+find "$app" -type d -exec chmod go+rx {} +
+find "$app" -type f -exec chmod go+r {} +
+sed "s/__TEAM_ID__/$APPLE_TEAM_ID/g" src-tauri/entitlements.mas.plist > "$work/entitlements.plist"
+plutil -lint "$work/entitlements.plist" > /dev/null
+
+# Nested code has to be signed before the bundle that contains it, and --deep is the wrong tool
+# for signing (it applies the outer entitlements to everything inside). Tauri bundles carry no
+# frameworks today, so this loop is usually empty, and it stays here so that stops being silent
+# the day one appears.
+while IFS= read -r -d '' nested; do
+  codesign --force --timestamp --options runtime --sign "$MAS_APP_IDENTITY" "$nested"
+done < <(find "$app/Contents/Frameworks" "$app/Contents/XPCServices" -maxdepth 1 -mindepth 1 -print0 2>/dev/null)
+
+codesign --force --timestamp --options runtime \
+  --sign "$MAS_APP_IDENTITY" \
+  --entitlements "$work/entitlements.plist" \
+  "$app"
+
+codesign --verify --deep --strict --verbose=2 "$app"
+echo "Entitlements on the signed bundle:"
+codesign --display --entitlements - --xml "$app" | plutil -convert xml1 -o - -
+
+productbuild --component "$app" /Applications --sign "$MAS_INSTALLER_IDENTITY" "$pkg"
+pkgutil --check-signature "$pkg"
+echo "mas-package: wrote $pkg"
+
+# The upload needs the .p8 where altool looks for it; the caller places it and sets these.
+# altool exits 0 even when it has just printed UPLOAD FAILED, so its exit status cannot be
+# trusted and the transcript is the only reliable signal.
+run_altool() {
+  local action="$1" output
+  output=$(xcrun altool "$action" -f "$pkg" -t macos \
+    --apiKey "$APPLE_API_KEY_ID" --apiIssuer "$APPLE_API_ISSUER" 2>&1) || true
+  printf '%s\n' "$output"
+  if printf '%s' "$output" | grep -qE "VERIFY FAILED|UPLOAD FAILED|ERROR:"; then
+    echo "mas-package: $action failed, see the errors above." >&2
+    return 1
+  fi
+}
+
+if [ -n "${MAS_UPLOAD:-}" ]; then
+  : "${APPLE_API_KEY_ID:?}" "${APPLE_API_ISSUER:?}"
+  run_altool --validate-app
+  run_altool --upload-app
+  echo "mas-package: uploaded to App Store Connect; the build appears once processing finishes."
+fi

scripts/mas-upload-local.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Sign, package and upload an App Store build from this machine, using the certificates in
+# ~/.margin-signing rather than the ones in CI.
+#
+# The certificates go into a keychain that exists only for the length of this run, and the login
+# keychain is never written to. That keeps a machine that has signed once from quietly being able
+# to sign forever, and it means this leaves nothing behind to go stale.
+#
+#   ./scripts/mas-upload-local.sh              # build, sign, package, upload
+#   MAS_UPLOAD= ./scripts/mas-upload-local.sh  # stop after the .pkg
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+DIR="${MARGIN_SIGNING_DIR:-$HOME/.margin-signing}"
+BUNDLE_ID="${BUNDLE_ID:-studio.margin.app}"
+KEYCHAIN="$(mktemp -d)/margin-mas.keychain-db"
+
+for f in "$BUNDLE_ID.env" "$BUNDLE_ID.provisionprofile" apple-distribution.p12 mac-installer.p12; do
+  [ -f "$DIR/$f" ] || { echo "mas-upload-local: $DIR/$f is missing; run apple-provision.rb first." >&2; exit 1; }
+done
+
+# shellcheck source=/dev/null
+set -a; . "$DIR/$BUNDLE_ID.env"; set +a
+export MAS_PROVISION_PROFILE="$DIR/$BUNDLE_ID.provisionprofile"
+
+# App Store Connect refuses an upload whose build number it has already seen, and seconds since the
+# epoch is both unique and monotonic without needing anything to be remembered between runs.
+export MAS_BUILD_NUMBER="${MAS_BUILD_NUMBER:-$(date +%s)}"
+export MAS_UPLOAD="${MAS_UPLOAD-1}"
+
+if [ -n "${MAS_UPLOAD:-}" ]; then
+  # shellcheck source=/dev/null
+  set -a; . "$DIR/AuthKey.env"; set +a
+  mkdir -p ~/private_keys
+  cp "$DIR/AuthKey.p8" ~/private_keys/"AuthKey_$APPLE_API_KEY_ID.p8"
+  chmod 600 ~/private_keys/"AuthKey_$APPLE_API_KEY_ID.p8"
+fi
+
+original_keychains=$(security list-keychains -d user | sed 's/^ *"//;s/"$//')
+restore() {
+  # shellcheck disable=SC2086
+  security list-keychains -d user -s $original_keychains
+  security delete-keychain "$KEYCHAIN" 2>/dev/null || true
+}
+trap restore EXIT
+
+security create-keychain -p margin "$KEYCHAIN"
+security unlock-keychain -p margin "$KEYCHAIN"
+for cert in apple-distribution mac-installer; do
+  security import "$DIR/$cert.p12" -k "$KEYCHAIN" -P "$(cat "$DIR/$cert.p12.pass")" \
+    -T /usr/bin/codesign -T /usr/bin/productbuild > /dev/null
+done
+# Without this, codesign stops on a keychain prompt rather than signing.
+security set-key-partition-list -S apple-tool:,apple: -k margin "$KEYCHAIN" > /dev/null
+# shellcheck disable=SC2086
+security list-keychains -d user -s "$KEYCHAIN" $original_keychains
+
+if [ -z "${SKIP_BUILD:-}" ]; then
+  pnpm tauri build --target universal-apple-darwin \
+    --config src-tauri/tauri.appstore.conf.json --bundles app
+fi
+
+./scripts/mas-package.sh