From 06dc5d0499120165594675a6411764e65a5dcb29 Mon Sep 17 00:00:00 2001
From: David Helkowski <github@codechild.com>
Date: Thu, 22 Jan 2026 19:29:59 +0900
Subject: [PATCH] Refactor PDF generation in make_pdf.sh to streamline the
 process by removing reliance on textutil. The script now directly converts
 plain text to PDF using cupsfilter, enhancing compatibility and reducing
 complexity.

---
 build_tools/macos/export_compliance/README.md | 32 +++++++++++++++++++
 .../macos/export_compliance/make_pdf.sh       | 17 +++-------
 2 files changed, 37 insertions(+), 12 deletions(-)
 create mode 100644 build_tools/macos/export_compliance/README.md

diff --git a/build_tools/macos/export_compliance/README.md b/build_tools/macos/export_compliance/README.md
new file mode 100644
index 000000000..561abde4c
--- /dev/null
+++ b/build_tools/macos/export_compliance/README.md
@@ -0,0 +1,32 @@
+# Export compliance (encryption)
+
+Apple may require an "Export Compliance" statement upload when submitting to the Mac App Store.
+
+This folder contains:
+
+- `EXPORT_COMPLIANCE.txt`: a template statement (fill-in placeholders)
+- `make_pdf.sh`: a helper to fill the template and generate a PDF you can upload
+
+## Generate the PDF
+
+From the repo root:
+
+```bash
+./build_tools/macos/export_compliance/make_pdf.sh \
+  --bundle-id com.dryark.strawberry \
+  --version 1.2.3 \
+  --developer "Dry Ark LLC" \
+  --contact "support@example.com"
+```
+
+Outputs:
+
+- `build_tools/macos/export_compliance/EXPORT_COMPLIANCE.filled.txt`
+- `build_tools/macos/export_compliance/EXPORT_COMPLIANCE.pdf`
+
+## Important
+
+This template assumes the app uses **only standard OS-provided encryption** (e.g. TLS/HTTPS via system frameworks) and does **not** ship proprietary or standalone crypto libraries.
+
+If you bundle your own crypto library (e.g. OpenSSL) or implement custom encryption, you likely need different answers/documentation.
+
diff --git a/build_tools/macos/export_compliance/make_pdf.sh b/build_tools/macos/export_compliance/make_pdf.sh
index ec562d717..61a1460af 100755
--- a/build_tools/macos/export_compliance/make_pdf.sh
+++ b/build_tools/macos/export_compliance/make_pdf.sh
@@ -15,7 +15,7 @@ Outputs (in the same folder as this script):
   - EXPORT_COMPLIANCE.pdf
 
 Notes:
-  - Uses macOS built-in /usr/bin/textutil + /usr/sbin/cupsfilter to generate the PDF.
+  - Uses macOS built-in /usr/sbin/cupsfilter to generate the PDF from plain text.
 EOF
 }
 
@@ -23,6 +23,7 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 template="${script_dir}/EXPORT_COMPLIANCE.txt"
 filled="${script_dir}/EXPORT_COMPLIANCE.filled.txt"
 pdf="${script_dir}/EXPORT_COMPLIANCE.pdf"
+tmp_html="${script_dir}/EXPORT_COMPLIANCE.tmp.html"
 
 bundle_id=""
 version=""
@@ -57,10 +58,6 @@ if [[ ! -f "$template" ]]; then
   exit 1
 fi
 
-if [[ ! -x /usr/bin/textutil ]]; then
-  echo "Error: /usr/bin/textutil not found. This should exist on macOS." >&2
-  exit 1
-fi
 if [[ ! -x /usr/sbin/cupsfilter ]]; then
   echo "Error: /usr/sbin/cupsfilter not found. This should exist on macOS." >&2
   exit 1
@@ -87,15 +84,11 @@ sed \
   "$template" > "$filled"
 
 rm -f "$pdf" >/dev/null 2>&1 || true
-
-# textutil does not support direct PDF output on modern macOS; convert to HTML first, then print-to-PDF via cupsfilter.
-tmp_html="${script_dir}/EXPORT_COMPLIANCE.tmp.html"
 rm -f "$tmp_html" >/dev/null 2>&1 || true
-/usr/bin/textutil -convert html "$filled" -output "$tmp_html" >/dev/null
 
-# Convert HTML to PDF. cupsfilter writes to stdout by default.
-/usr/sbin/cupsfilter -i text/html -m application/pdf "$tmp_html" > "$pdf"
-rm -f "$tmp_html" >/dev/null 2>&1 || true
+# Convert plain text to PDF. cupsfilter writes PDF to stdout.
+# Suppress noisy DEBUG output from cupsfilter on stderr.
+/usr/sbin/cupsfilter -i text/plain -m application/pdf "$filled" > "$pdf" 2>/dev/null
 
 echo "Wrote:"
 echo "  $filled"