Redo macOS build-app.py and add --codesign-only opt

Redoes the build-app.py script to add an option to sign only an already-
produced app bundle.

install/macos/build-app.py

@@ -19,6 +19,28 @@ def run(cmd):
     subprocess.run(cmd, cwd=root, check=True)
 
 
+def build_app_bundle():
+    """
+    Builds the Dangerzone.app bundle and saves it in dist/Dangerzone.app
+    """
+    print("○ Deleting old build and dist")
+    if os.path.exists(build_path):
+        shutil.rmtree(build_path)
+    if os.path.exists(dist_path):
+        shutil.rmtree(dist_path)
+
+    print("○ Building app bundle")
+    run(["pyinstaller", "install/pyinstaller/pyinstaller.spec", "--clean"])
+    shutil.rmtree(os.path.join(dist_path, "dangerzone"))
+
+    os.symlink(
+        "dangerzone",
+        os.path.join(app_path, "Contents/MacOS/dangerzone-cli"),
+    )
+
+    print(f"○ Finished build app: {app_path}")
+
+
 def codesign(path, entitlements, identity):
     run(
         [
@@ -37,41 +59,21 @@ def codesign(path, entitlements, identity):
     )
 
 
-def main():
+def sign_app_bundle(build_path, dist_path, app_path):
-    # Parse arguments
+    """
-    parser = argparse.ArgumentParser()
+    Signs the app bundle stored in dist/Dangerzone.app,
-    parser.add_argument(
+    producing a Dangerzone.dmg file
-        "--with-codesign",
+    """
-        action="store_true",
+    print(f"○ Signing app bundle in {app_path}")
-        dest="with_codesign",
+
-        help="Codesign the app bundle",
+    # Detect if create-dmg is installed
-    )
+    if not os.path.exists(app_path):
-    args = parser.parse_args()
+        print(f"ERROR: Dangerzone.app not found in {app_path}.")
+        exit(1)
 
-    build_path = os.path.join(root, "build")
-    dist_path = os.path.join(root, "dist")
-    app_path = os.path.join(dist_path, "Dangerzone.app")
     dmg_path = os.path.join(dist_path, "Dangerzone.dmg")
     icon_path = os.path.join(root, "install", "macos", "dangerzone.icns")
 
-    print("○ Deleting old build and dist")
-    if os.path.exists(build_path):
-        shutil.rmtree(build_path)
-    if os.path.exists(dist_path):
-        shutil.rmtree(dist_path)
-
-    print("○ Building app bundle")
-    run(["pyinstaller", "install/pyinstaller/pyinstaller.spec", "--clean"])
-    shutil.rmtree(os.path.join(dist_path, "dangerzone"))
-
-    os.symlink(
-        "dangerzone",
-        os.path.join(app_path, "Contents/MacOS/dangerzone-cli"),
-    )
-
-    print(f"○ Finished build app: {app_path}")
-
-    if args.with_codesign:
     print("○ Code signing app bundle")
     identity_name_application = (
         # FIXME: Update this line with the proper developer ID, once we know what
@@ -122,9 +124,37 @@ def main():
             identity_name_application,
         ]
     )
-
     print(f"○ Finished building DMG: {dmg_path}")
 
+
+def main():
+    # Parse arguments
+    parser = argparse.ArgumentParser()
+    codesign_opts = parser.add_mutually_exclusive_group()
+    codesign_opts.add_argument(
+        "--with-codesign",
+        action="store_true",
+        dest="with_codesign",
+        help="Codesign the app bundle",
+    )
+    codesign_opts.add_argument(
+        "--only-codesign",
+        action="store_true",
+        dest="only_codesign",
+        help="Exclusively codesign the app bundle in dist/Dangerzone.app",
+    )
+    args = parser.parse_args()
+
+    build_path = os.path.join(root, "build")
+    dist_path = os.path.join(root, "dist")
+    app_path = os.path.join(dist_path, "Dangerzone.app")
+
+    if args.only_codesign:
+        sign_app_bundle(build_path, dist_path, app_path)
+    else:
+        build_app_bundle(build_path, dist_path, app_path)
+        if args.with_codesign:
+            sign_app_bundle(build_path, dist_path, app_path)
         else:
             print("○ Skipping code signing")