Files
solvecraft/packaging
Mikalai Kukhta 4e2270517a Release: sign and notarize the macOS app (#5749) (#6016)
* Release: sign and notarize the macOS app with a Developer ID (#5749)

package.sh --sign signs the app, the CLI and the DMG with the hardened runtime and a secure
timestamp, notarizes the DMG and the CLI zip, staples the DMG and checks it with stapler and
spctl. The app carries entitlements.plist: com.apple.security.cs.disable-library-validation
lets the hardened runtime load 3Dconnexion's client framework (crates/threedx-client).

signing.sh --setup imports the certificate into a temporary keychain and writes the API key;
--cleanup removes both. The release workflow builds both architectures first (macos-build, no
secrets), then signs and packages in the join job. Without the APPLE_* secrets (forks, dry runs)
the app keeps its ad-hoc signature and the job summary says so.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* macOS release: staple the app before the DMG, retry stapler, document renewal (#5749)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-25 11:15:35 +00:00
..