build(hololake): bind mac candidates to exact source

product-source/hololake-platform/scripts/build-macos-internal.sh

@@ -7,6 +7,8 @@ cd "$repo_root"
 [[ "$(uname -s)" == "Darwin" ]] || { echo "macOS internal packages must be built on macOS." >&2; exit 2; }
 
 target="${HOLOLAKE_MAC_TARGET:-aarch64-apple-darwin}"
+development_id="${HOLOLAKE_DEVELOPMENT_ID:?HOLOLAKE_DEVELOPMENT_ID is required for source-bound packaging}"
+distribution="${HOLOLAKE_DISTRIBUTION:-internal}"
 version="$(node scripts/internal-release-version.mjs src-tauri/tauri.conf.json "${HOLOLAKE_VERSION:-}")"
 product_name="$(node -e "const fs=require('node:fs'); const value=JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json','utf8')).productName; if(!value) process.exit(1); process.stdout.write(value)")"
 output_dir="${HOLOLAKE_OUTPUT_DIR:-$repo_root/artifacts/internal/$version}"
@@ -14,6 +16,7 @@ target_root="${CARGO_TARGET_DIR:-$repo_root/src-tauri/target}"
 bundle_dir="$target_root/$target/release/bundle/macos"
 app="$bundle_dir/${HOLOLAKE_APP_NAME:-$product_name}.app"
 installer="$output_dir/HoloLake-Era-$version-Mac-internal-aarch64.dmg"
+provenance_source="$repo_root/src-tauri/resources/public-architecture/build-provenance.json"
 tauri_config="${HOLOLAKE_TAURI_CONFIG:-}"
 if [[ -n "${HOLOLAKE_INSTALLER_BASENAME:-}" ]]; then
   installer_basename="${HOLOLAKE_INSTALLER_BASENAME//\{version\}/$version}"
@@ -30,6 +33,15 @@ else
 fi
 command -v hdiutil >/dev/null || { echo "hdiutil is required." >&2; exit 2; }
 mkdir -p "$output_dir"
+[[ ! -e "$provenance_source" ]] || { echo "Stale generated build provenance exists: $provenance_source" >&2; exit 1; }
+cleanup_provenance() { rm -f "$provenance_source"; }
+trap cleanup_provenance EXIT
+
+node scripts/internal-release-provenance.mjs generate \
+  --output "$provenance_source" \
+  --development-id "$development_id" \
+  --distribution "$distribution" \
+  --target-triple "$target"
 
 if [[ "${HOLOLAKE_SKIP_INSTALL:-0}" != "1" ]]; then
   "${pnpm_cmd[@]}" install --frozen-lockfile
@@ -41,6 +53,11 @@ if [[ -n "$tauri_config" ]]; then tauri_args+=(--config "$tauri_config"); fi
 [[ -d "$app" ]] || { echo "No macOS application bundle was produced: $app" >&2; exit 1; }
 
 node scripts/verify-internal-package-content.mjs "$app"
+node scripts/internal-release-provenance.mjs verify \
+  --bundle "$app" \
+  --development-id "$development_id" \
+  --distribution "$distribution" \
+  --target-triple "$target"
 codesign --force --deep --sign - "$app"
 codesign --verify --deep --strict "$app"
 hdiutil create -volname "HoloLake Era $version Internal" -srcfolder "$app" -ov -format UDZO "$installer"