Release: retry stapling and its validation on macOS (#164)

Apple's notarization ticket service dropped the connection in two release runs in a row
(once while validating the stapled DMG, once while stapling), failing the macOS job after a
successful build, signing and notarization. Stapling and its validation now try up to five
times, 15 s apart.

packaging/env.sh

@@ -62,6 +62,17 @@ smoke_bin() {
 }
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
+# Run a command up to five times, 15 s apart: for steps that ask a remote service (Apple's
+# notarization ticket service drops connections now and then).
+retry() {
+  local attempt
+  for attempt in 1 2 3 4 5; do
+    "$@" && return 0
+    [ "$attempt" = 5 ] || { echo "retrying ($attempt/5): $*" >&2; sleep 15; }
+  done
+  return 1
+}
+
 warn() {
   if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
 }

packaging/macos/package.sh

@@ -135,8 +135,8 @@ codesign --verify --strict --deep --verbose=2 "$APP"
 if [ "$NOTARIZE" = 1 ]; then
   ditto -c -k --keepParent "$APP" "$WORK/FigCraft-notarize.zip"
   notarize "$WORK/FigCraft-notarize.zip"
-  xcrun stapler staple "$APP"
+  retry xcrun stapler staple "$APP"
-  xcrun stapler validate "$APP"
+  retry xcrun stapler validate "$APP"
   spctl --assess --type execute -vvv "$APP"
 fi
 
@@ -156,8 +156,8 @@ sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
 if [ "$NOTARIZE" = 1 ]; then
   notarize "$DMG"
-  xcrun stapler staple "$DMG"
+  retry xcrun stapler staple "$DMG"
-  xcrun stapler validate "$DMG"
+  retry xcrun stapler validate "$DMG"
   spctl --assess --type open --context context:primary-signature -vvv "$DMG"
 fi
 

packaging/macos/verify.sh

@@ -130,7 +130,7 @@ fi
 echo "==> $(basename "$DMG")"
 codesign --verify --strict --verbose=2 "$DMG"
 if [ "$STRICT" = 1 ]; then
-  xcrun stapler validate "$DMG" || fail "no notarization ticket stapled to the DMG"
+  retry xcrun stapler validate "$DMG" || fail "no notarization ticket stapled to the DMG"
   assess --assess --type open --context context:primary-signature -vv "$DMG" \
     || fail "Gatekeeper rejects the DMG"
 fi