storytold/photocraft
2
0
Fork 0
mirror of https://github.com/storytold/photocraft.git synced 2026-11-02 18:13:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

macOS CLI: verify the shipped CLI is Developer ID signed and notarized in the release workflow (#308) (#320) (#320)

Browse Source
This commit is contained in:
Brandon Thomas
2026-10-06 10:48:05 -04:00
committed by GitHub
parent ae9e1896cf
commit dd2f566daa
5 changed files with 186 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/releasing.md
+14 -2
View File
@@ -77,8 +77,20 @@ Every binary reports its version, the commit and the build date: `photocraft --v
ticket is stapled to the app. The app goes on a DMG (`hdiutil`, with an `Applications` link
to drag onto). The DMG is signed, notarized and stapled too. The script checks the results
with `codesign --verify --strict`, `stapler validate` and `spctl -a -vvv`.
- **CLI:** the universal `photocraft-cli` is signed with the hardened runtime, zipped and
notarized. A bare binary can't hold a stapled ticket, so Gatekeeper looks it up online.
- **CLI:** the universal `photocraft-cli` is signed with the same Developer ID, the hardened
runtime and a secure timestamp (identifier `ai.storyteller.photocraft-cli`), zipped, and the zip
is sent to `notarytool`. Only `.app`, `.dmg` and `.pkg` can hold a stapled ticket, not a bare
Mach-O, so Gatekeeper looks the CLI's ticket up online the first time a downloaded
(quarantined) copy runs. Offline, that first run can be refused until the Mac is online again.
- **Verification:** `packaging/macos/verify.sh` checks the artifacts as users download them. It
unpacks the CLI zip and requires, for the binary inside, `codesign --verify --strict`, both
architectures, the hardened runtime flag, a `Developer ID Application` authority from
`APPLE_TEAM_ID`, a timestamp, and `spctl --assess --type install` reporting
`source=Notarized Developer ID` (the same online lookup Gatekeeper does). For the DMG it runs
`codesign --verify`, `stapler validate` and `spctl --type open`. The release workflow runs it
as its own step after packaging. With signing secrets it fails the job on any miss; without
them it only checks signature integrity and warns, like `package.sh`. Run it locally after a
build: `packaging/macos/verify.sh --arch aarch64`.
Locally, without certificates, the script signs ad-hoc (`codesign -s -`) and skips notarization.
That's enough to check the bundle and the DMG on your own Mac: