kayg/hermternal-apple
Watch
1
0
Fork
You've already forked hermternal-apple
 0
Code Issues 44 Pull requests Projects Releases 4 Packages Wiki Activity Actions

Add a release-artifact verification gate #48

New issue
Open
opened 2026-08-23 09:33:13 +00:00 by kayg · 0 comments
kayg commented 2026-08-23 09:33:13 +00:00
Owner
Copy link

Ask

Add a release-artifact verification gate that prevents an invalid app archive from being published. The published v0.0.2 zip was ad-hoc signed and Gatekeeper rejects it.

Files and APIs

  • Scripts/build-app.sh: app build and signing fallback.
  • Scripts/release.sh: release orchestration and artifact verification.
  • Scripts/publish.sh: archive selection and publication.
  • Resources/Info.plist: CFBundleShortVersionString declared by the app bundle.

Acceptance

  • A release cannot publish unless the artifact is produced by a completed release.sh run; a pre-existing zip is never accepted as proof of a fresh release.
  • The gate rejects ad-hoc-signed or otherwise Gatekeeper-invalid app archives and records the verification failure.
  • The cause is covered: build-app.sh falls back to ad-hoc signing and publish.sh previously accepted any pre-existing zip, allowing a local build to reach a release without release.sh completing.
  • Release metadata checks that the tag version matches CFBundleShortVersionString; the current tag declares CFBundleShortVersionString 0.0.1.
## Ask Add a release-artifact verification gate that prevents an invalid app archive from being published. The published v0.0.2 zip was ad-hoc signed and Gatekeeper rejects it. ## Files and APIs - `Scripts/build-app.sh`: app build and signing fallback. - `Scripts/release.sh`: release orchestration and artifact verification. - `Scripts/publish.sh`: archive selection and publication. - `Resources/Info.plist`: `CFBundleShortVersionString` declared by the app bundle. ## Acceptance - A release cannot publish unless the artifact is produced by a completed `release.sh` run; a pre-existing zip is never accepted as proof of a fresh release. - The gate rejects ad-hoc-signed or otherwise Gatekeeper-invalid app archives and records the verification failure. - The cause is covered: `build-app.sh` falls back to ad-hoc signing and `publish.sh` previously accepted any pre-existing zip, allowing a local build to reach a release without `release.sh` completing. - Release metadata checks that the tag version matches `CFBundleShortVersionString`; the current tag declares `CFBundleShortVersionString` 0.0.1.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
dev
feat/sidebar-selection-archive-purge
v0.0.4
v0.0.3
v0.0.2
v0.0.1
Labels
Clear labels   
delivered
Shipped and recorded in project history

  
outstanding
Not yet delivered or blocked

No labels
delivered
outstanding
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/hermternal-apple#48
No description provided.