한 번 빌드하고, 검증한 사본을 모든 Mac에 보내

#!/bin/bash
# Office builds once; peers receive copies. This script never builds.
set -euo pipefail
app=Spark quit_policy=signal
installed="/Applications/$app.app"
peers=(${PEERS:-air mini})

# Preflight, before any peer is touched: a stale build must never reach Mac number one.
stale=$(find Sources Resources Package.swift -newer "$installed" -print -quit 2>/dev/null || true)
[[ -z "$stale" ]] || { echo "HARD_FAIL $stale is newer than $installed: build and install here first"; exit 1; }
codesign --verify --deep --strict "$installed"
codesign -d -r- "$installed" 2>&1 | grep -q 'certificate leaf' \
  || { echo "HARD_FAIL $installed is not signed with the shared identity; its grants would not survive a copy"; exit 1; }

for peer in "${peers[@]}"; do
  staged="/Applications/.spark-deploy.$$"                     # no spaces: peer rsync splits on them
  if ! rsync -aH --delete -e "ssh -o BatchMode=yes" "$installed/" "$peer:$staged/"; then
    echo "$app@$peer FAILED (rsync)"; continue
  fi
  result=$(ssh -o BatchMode=yes "$peer" "bash -s -- '$app' '$staged' '$quit_policy'" < peer-install.sh) \
    || true
  echo "$app@$peer $result"
done

#!/bin/bash
# Runs ON the peer:  ssh peer 'bash -s -- Spark /Applications/.spark-deploy.123 polite' < peer-install.sh
# Verify what arrived, stop the running copy the right way, swap, verify again, roll back on failure.
set -euo pipefail
app=$1 staged=$2 quit_policy=$3            # quit_policy: polite (document app) | signal (utility)
root=${APPLICATIONS:-/Applications}
dest="$root/$app.app" previous="$root/.$app.previous.$$"
info="$staged/Contents/Info.plist"
exe=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$info")
bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$info")

xattr -cr "$staged"                                          # copied metadata breaks signatures
codesign --verify --deep --strict "$staged" || { echo "FAILED app=$app reason=staged-signature"; exit 1; }

if pgrep -x "$exe" >/dev/null; then
  if [[ $quit_policy == polite ]]; then
    # A signal never reaches applicationShouldTerminate, so unsaved work would be skipped.
    # A direct Apple Event works from ssh; it can block on a dialog, so it gets a deadline.
    osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1 &
    for _ in $(seq 1 100); do pgrep -x "$exe" >/dev/null || break; sleep 0.1; done
    if pgrep -x "$exe" >/dev/null; then echo "SKIP app=$app reason=quit-refused (unsaved work?)"; exit 0; fi
  else
    pkill -x "$exe" || true
  fi
fi

[[ -d "$dest" ]] && mv "$dest" "$previous"
if mv "$staged" "$dest" && codesign --verify --deep --strict "$dest" 2>/dev/null; then
  rm -rf "$previous"
  echo "OK app=$app build=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$dest/Contents/Info.plist" 2>/dev/null || echo unknown)"
else
  rm -rf "$dest"
  [[ -d "$previous" ]] && mv "$previous" "$dest"
  echo "ROLLED_BACK app=$app reason=installed-signature"
  exit 1
fi