From 962352d6aebf70626732987bb3583b495638ff1a Mon Sep 17 00:00:00 2001
From: Randy McDermott <randy.mcdermott@gmail.com>
Date: Mon, 17 Aug 2026 10:50:34 -0400
Subject: [PATCH] Bundle: fix keychain issue with macOS bundle

---
 Build/bundle/build_macos_bundle.sh | 16 +++++++++++++++-
 Build/bundle/run_macos_bundle.sh   |  8 +++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/Build/bundle/build_macos_bundle.sh b/Build/bundle/build_macos_bundle.sh
index 5d014fcf1..5580ee20c 100755
--- a/Build/bundle/build_macos_bundle.sh
+++ b/Build/bundle/build_macos_bundle.sh
@@ -48,6 +48,7 @@ STRICT_REVISION=0
 UPLOAD=0
 SIGN_IDENTITY="${CODESIGN_ID:-}"
 NOTARY_PROFILE="${CFAST_MACOS_NOTARY_PROFILE:-}"
+NOTARY_KEYCHAIN="${CFAST_MACOS_NOTARY_KEYCHAIN:-}"
 SIGN_BUNDLE=0
 NOTARIZE=0
 if [[ "$SIGN_IDENTITY" != "" ]]; then
@@ -116,6 +117,7 @@ usage()
   echo "  --sign-identity identity Developer ID Application certificate used to sign CEditQt, CFAST, Smokeview, and the DMG"
   echo "  --notarize              Submit the signed DMG with notarytool and staple the result (requires --notary-profile)"
   echo "  --notary-profile name   Keychain profile for xcrun notarytool (or CFAST_MACOS_NOTARY_PROFILE)"
+  echo "  --notary-keychain path  Keychain containing the notary profile (or CFAST_MACOS_NOTARY_KEYCHAIN)"
   echo "  --no-dmg                 Stage files only"
   echo "  --no-layout              Do not use a DMG background image"
   echo "  -h, --help               Display this message"
@@ -1033,6 +1035,8 @@ sign_staged_macos_bundle()
 
 notarize_macos_dmg()
 {
+  local -a notary_credentials
+
   if [[ "$NOTARIZE" != "1" ]]; then
     return 0
   fi
@@ -1046,8 +1050,14 @@ notarize_macos_dmg()
   fi
   require_command xcrun
 
+  notary_credentials=(--keychain-profile "$NOTARY_PROFILE")
+  if [[ "$NOTARY_KEYCHAIN" != "" ]]; then
+    require_file "$NOTARY_KEYCHAIN" "notarization keychain"
+    notary_credentials+=(--keychain "$NOTARY_KEYCHAIN")
+  fi
+
   echo "*** Submitting DMG for Apple notarization"
-  xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
+  xcrun notarytool submit "$DMG_PATH" "${notary_credentials[@]}" --wait
   echo "*** Stapling notarization ticket to DMG"
   xcrun stapler staple "$DMG_PATH"
   xcrun stapler validate "$DMG_PATH"
@@ -1644,6 +1654,10 @@ while [[ $# -gt 0 ]]; do
       NOTARY_PROFILE="$2"
       shift 2
       ;;
+    --notary-keychain)
+      NOTARY_KEYCHAIN="$2"
+      shift 2
+      ;;
     --no-dmg)
       CREATE_DMG=0
       shift
diff --git a/Build/bundle/run_macos_bundle.sh b/Build/bundle/run_macos_bundle.sh
index 93d26ec8e..149dc6f01 100755
--- a/Build/bundle/run_macos_bundle.sh
+++ b/Build/bundle/run_macos_bundle.sh
@@ -4,4 +4,10 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 cd "$SCRIPT_DIR"
-./build_macos_bundle.sh --manuals-from-release --upload --notarize --notary-profile CFAST_NOTARY "$@"
+./build_macos_bundle.sh \
+  --manuals-from-release \
+  --upload \
+  --notarize \
+  --notary-profile CFAST_NOTARY \
+  --notary-keychain "$HOME/Library/Keychains/login.keychain-db" \
+  "$@"