Release 0.13.1: retry the macOS stapler steps

The 0.13.0 macOS job was notarized (Accepted) and stapled, then failed in
`stapler validate` when the connection to Apple's CloudKit ticket service
dropped (NSURLErrorDomain -1005, exit 68). Retry staple and validate up to
five times, as FigCraft does.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packaging/env.sh

@@ -40,6 +40,16 @@ export VECTORCRAFT_BUILD_DATE="${VECTORCRAFT_BUILD_DATE:-$(date -u +%Y-%m-%d)}"
 export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
+# Retry a flaky network step (Apple stapler/CloudKit) up to five times, 15 s apart.
+retry() {
+  local attempt
+  for attempt in 1 2 3 4 5; do
+    "$@" && return 0
+    [ "$attempt" = 5 ] || { echo "retrying ($attempt/5): $*" >&2; sleep 15; }
+  done
+  return 1
+}
+
 warn() {
   if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
 }

packaging/macos/package.sh

@@ -97,21 +97,6 @@ notarize() {
   fi
 }
 
-# `stapler validate` looks the ticket up in Apple's CloudKit, and a dropped connection there
-# (NSURLErrorDomain -1005, "Error 68") fails it although the staple worked. Retry with a pause; a
-# missing or bad ticket still fails every try.
-validate_stapled() {
-  local try
-  for try in 1 2 3 4; do
-    xcrun stapler validate "$1" && return 0
-    [ "$try" = 4 ] && break
-    echo "stapler validate failed (try $try of 4); retrying in $((try * 20)) s" >&2
-    sleep $((try * 20))
-  done
-  echo "error: stapler validate $(basename "$1") failed 4 times" >&2
-  exit 1
-}
-
 # ---- VectorCraft.app ----------------------------------------------------------------------------
 echo "==> assembling $APP"
 mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
@@ -135,8 +120,8 @@ codesign --verify --strict --deep --verbose=2 "$APP"
 if [ "$NOTARIZE" = 1 ]; then
   ditto -c -k --keepParent "$APP" "$WORK/VectorCraft-notarize.zip"
   notarize "$WORK/VectorCraft-notarize.zip"
-  xcrun stapler staple "$APP"
-  validate_stapled "$APP"
+  retry xcrun stapler staple "$APP"
+  retry xcrun stapler validate "$APP"
   spctl --assess --type execute -vvv "$APP"
 fi
 
@@ -185,8 +170,8 @@ fi
 hdiutil_retry detach detach "$MOUNT" >/dev/null
 if [ "$NOTARIZE" = 1 ]; then
   notarize "$DMG"
-  xcrun stapler staple "$DMG"
-  validate_stapled "$DMG"
+  retry xcrun stapler staple "$DMG"
+  retry xcrun stapler validate "$DMG"
   spctl --assess --type open --context context:primary-signature -vvv "$DMG"
 fi