feat(build): Developer ID codesigning, Apple notarization, package target

Adopts the org-wide convention defined in nlink-jp/.github
CONVENTIONS.md §Code Signing and Notarization. Adds:
- scripts/codesign-darwin.sh + scripts/notarize-darwin.sh
  (verbatim from nlink-jp/.github/templates/)
- codesign call in `build` and after the darwin lines in
  `build-all` (incl. the darwin-universal binary produced by lipo)
- new `package` target that zips all 5 platforms + darwin-universal
  with versioned naming (splunk-cli-vX.Y.Z-<os>-<arch>.zip),
  includes README.md alongside each binary, and notarizes the 3
  darwin zips (amd64, arm64, universal)

Defaults (CODESIGN_IDENTITY="Developer ID Application",
NOTARY_PROFILE=nlink-jp-notary) match generic keychain entries —
no personal identifiers, certificates, or credentials land in the
repo. Builds on machines without a matching cert/profile fall
back gracefully to ad-hoc + un-notarized with a warning.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: magifd2

Makefile

@@ -3,11 +3,20 @@ LDFLAGS := -ldflags "-X main.version=$(VERSION)"
 BINARY  := splunk-cli
 CMD     := .
 
-.PHONY: build test vet lint check build-all clean \
+# macOS Developer ID signing / notarization (see nlink-jp/.github
+# CONVENTIONS.md §Code Signing). Defaults match any Developer ID
+# Application cert in the keychain and the org-standard notary
+# profile. Builds without these fall back to ad-hoc / un-notarized
+# with a one-line warning — see scripts/codesign-darwin.sh.
+CODESIGN_IDENTITY ?= Developer ID Application
+NOTARY_PROFILE    ?= nlink-jp-notary
+
+.PHONY: build test vet lint check build-all package clean \
         splunk-up splunk-down integration-test
 
 build: _dist
 	go build $(LDFLAGS) -o dist/$(BINARY) $(CMD)
+	@scripts/codesign-darwin.sh dist/$(BINARY) "$(CODESIGN_IDENTITY)"
 
 test:
 	go test ./...
@@ -31,6 +40,27 @@ build-all: _dist
 			dist/$(BINARY)-darwin-amd64 dist/$(BINARY)-darwin-arm64; \
 		echo "Universal macOS binary: dist/$(BINARY)-darwin-universal"; \
 	fi
+	@scripts/codesign-darwin.sh dist/$(BINARY)-darwin-amd64 "$(CODESIGN_IDENTITY)"
+	@scripts/codesign-darwin.sh dist/$(BINARY)-darwin-arm64 "$(CODESIGN_IDENTITY)"
+	@if [ -f dist/$(BINARY)-darwin-universal ]; then \
+		scripts/codesign-darwin.sh dist/$(BINARY)-darwin-universal "$(CODESIGN_IDENTITY)"; \
+	fi
+
+## package: Build all platforms, zip with version suffix + README, notarize darwin → dist/
+package: build-all
+	@cd dist && for f in $(BINARY)-linux-amd64 $(BINARY)-linux-arm64 $(BINARY)-darwin-amd64 $(BINARY)-darwin-arm64 $(BINARY)-darwin-universal $(BINARY)-windows-amd64.exe; do \
+		[ -f "$$f" ] || continue; \
+		suffix=$${f#$(BINARY)-}; \
+		suffix=$${suffix%%.exe}; \
+		cp ../README.md .; \
+		zip -j "$(BINARY)-$(VERSION)-$${suffix}.zip" "$$f" README.md; \
+		rm -f README.md; \
+	done
+	@scripts/notarize-darwin.sh dist/$(BINARY)-$(VERSION)-darwin-amd64.zip "$(NOTARY_PROFILE)"
+	@scripts/notarize-darwin.sh dist/$(BINARY)-$(VERSION)-darwin-arm64.zip "$(NOTARY_PROFILE)"
+	@if [ -f dist/$(BINARY)-$(VERSION)-darwin-universal.zip ]; then \
+		scripts/notarize-darwin.sh dist/$(BINARY)-$(VERSION)-darwin-universal.zip "$(NOTARY_PROFILE)"; \
+	fi
 
 _dist:
 	mkdir -p dist

scripts/codesign-darwin.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+# codesign-darwin.sh — sign a darwin Mach-O binary with a Developer ID
+# Application identity (Hardened Runtime + Apple timestamp), or skip
+# gracefully if codesigning is not possible.
+#
+# Usage:
+#   codesign-darwin.sh <binary> [identity]
+#
+# Identity defaults to "Developer ID Application" — matches any Developer
+# ID Application certificate in the user's keychain. Override via env or
+# 2nd argument when more than one Developer ID identity is present.
+#
+# Behaviour:
+#   - Skips silently on non-macOS hosts (cross-compile from Linux/etc.)
+#   - Skips with a one-line warning if no matching identity exists
+#     (contributors without an Apple Developer Program account can still
+#     build; the binary keeps its Go-linker ad-hoc signature)
+#   - Skips silently if the target file is not Mach-O (Linux/Windows
+#     binaries fall through untouched)
+#
+# Why --options runtime + --timestamp:
+#   Apple's notary service rejects binaries that lack Hardened Runtime
+#   or an Apple-issued secure timestamp. Setting both at sign time keeps
+#   `make package` notarize-ready without a second resign pass.
+
+set -e
+
+BINARY="${1:?Usage: $0 <binary> [identity]}"
+IDENTITY="${2:-${CODESIGN_IDENTITY:-Developer ID Application}}"
+
+# Cross-compile from non-Darwin: nothing to do
+if [ "$(uname)" != "Darwin" ]; then
+  exit 0
+fi
+
+if [ ! -f "$BINARY" ]; then
+  echo "[codesign] $BINARY not found, skipping" >&2
+  exit 0
+fi
+
+# Non-Mach-O target (e.g. Linux/Windows binary produced by cross-compile)
+if ! file "$BINARY" | grep -q 'Mach-O'; then
+  exit 0
+fi
+
+# No Developer ID identity in keychain — keep the linker ad-hoc signature
+if ! security find-identity -v -p codesigning 2>/dev/null | grep -q "$IDENTITY"; then
+  echo "[codesign] No '$IDENTITY' identity in keychain; $BINARY keeps the Go-linker ad-hoc signature" >&2
+  exit 0
+fi
+
+codesign --force --options runtime --timestamp --sign "$IDENTITY" "$BINARY"
+echo "[codesign] Signed $BINARY with '$IDENTITY'"

scripts/notarize-darwin.sh

@@ -0,0 +1,72 @@
+#!/bin/sh
+# notarize-darwin.sh — submit a zip-packaged darwin binary to Apple's
+# notary service and wait for the verdict.
+#
+# Usage:
+#   notarize-darwin.sh <zip-path> [profile-name]
+#
+# Profile name defaults to the value of NOTARY_PROFILE env, then to
+# `nlink-jp-notary`. Credentials are stored once per machine via:
+#
+#   xcrun notarytool store-credentials nlink-jp-notary \
+#       --key <p8>  --key-id <id>  --issuer <uuid>
+#
+# Behaviour:
+#   - Skips on non-Darwin hosts (cross-compile from Linux/etc.)
+#   - Skips when the keychain profile isn't present (other
+#     contributors / CI without credentials still produce the zip,
+#     just un-notarised). A one-line warning is printed.
+#   - On failure, prints the Apple-returned log and exits non-zero
+#     so a release pipeline can stop.
+#
+# Why we don't staple: notarisation of bare CLI binaries inside a
+# zip cannot be stapled — `stapler staple` only works on app
+# bundles, dmgs, and pkgs. The notarisation ticket lives on Apple's
+# servers and macOS checks it online the first time the binary is
+# launched on a given machine. This is the standard pattern for
+# non-bundle distributables (cf. the official notarytool docs).
+
+set -e
+
+ZIP="${1:?Usage: $0 <zip-path> [profile]}"
+PROFILE="${2:-${NOTARY_PROFILE:-nlink-jp-notary}}"
+
+if [ "$(uname)" != "Darwin" ]; then
+  exit 0
+fi
+
+if [ ! -f "$ZIP" ]; then
+  echo "[notarize] $ZIP not found, skipping" >&2
+  exit 0
+fi
+
+# Probe the keychain profile cheaply (notarytool has no dedicated
+# "is profile present" command). `history` returns quickly without
+# uploading anything, so we use it as a liveness check.
+if ! xcrun notarytool history --keychain-profile "$PROFILE" >/dev/null 2>&1; then
+  echo "[notarize] Keychain profile '$PROFILE' not found; $ZIP will ship un-notarised" >&2
+  echo "[notarize] To enable, run once per machine:" >&2
+  echo "[notarize]   xcrun notarytool store-credentials $PROFILE --key <p8> --key-id <id> --issuer <uuid>" >&2
+  exit 0
+fi
+
+echo "[notarize] Submitting $ZIP to Apple notary service (this typically takes 30s-2m)..."
+SUBMISSION_OUT=$(xcrun notarytool submit "$ZIP" --keychain-profile "$PROFILE" --wait 2>&1) || {
+  echo "[notarize] $ZIP: submission failed" >&2
+  echo "$SUBMISSION_OUT" >&2
+  exit 1
+}
+
+echo "$SUBMISSION_OUT"
+
+# notarytool exits 0 on Accepted, non-zero otherwise. As an extra
+# guard, parse the status line in the output and fail explicitly
+# on anything other than "Accepted" so a release pipeline halts
+# even if Apple shifts exit-code semantics in a future release.
+if printf '%s\n' "$SUBMISSION_OUT" | grep -q 'status: Accepted'; then
+  echo "[notarize] $ZIP: Accepted"
+  exit 0
+fi
+
+echo "[notarize] $ZIP: notarisation did not succeed (see status above)" >&2
+exit 1