optional notarization step

utils/package-osx-bundles.sh

@@ -158,5 +158,12 @@ productbuild \
   "${PKG_SIGN_ARGS[@]}" \
   ${MACOS_PKG_SNAME}-macOS.pkg
 
-# xcrun notarytool submit build/*-macOS.pkg --keychain-profile "build-notary" --wait
-# xcrun notarytool log --keychain-profile "build-notary" 00000000-0000-0000-0000-000000000000
+if [ -n "${MACOS_NOTARIZATION_USER}" ] && [ -n "${MACOS_NOTARIZATION_PASS}" ] && [ -n "${MACOS_NOTARIZATION_TEAM}" ]; then
+  xcrun notarytool submit ${MACOS_PKG_NAME}-macOS.pkg \
+    --apple-id ${MACOS_NOTARIZATION_USER} \
+    --password ${MACOS_NOTARIZATION_PASS} \
+    --team-id ${MACOS_NOTARIZATION_TEAM} \
+    --wait
+
+  xcrun stapler staple ${MACOS_PKG_NAME}-macOS.pkg
+fi