Build the Hermternal website and host direct releases #51

New issue

Open

opened 2026-08-23 17:39:00 +00:00 by kayg · 0 comments

kayg commented

2026-08-23 17:39:00 +00:00

Owner

Tomorrow scope:

design an attractive product site consistent with the polished native macOS app;
show a clear hero/product story, feature sections, security/privacy, pricing placeholder for the $50 lifetime license, and support/docs;
capture real light/dark screenshots and short videos showing search, Settings, folders/drag, schedules, swipe/actions, and deep links; media must contain no fixture data, random IDs, or expired-state artifacts;
make the site responsive and accessible, honor reduced motion, provide captions and posters, optimize media, and use no autoplay audio;
make the public download button serve the latest notarized/stapled direct build from the website/CDN/object storage, never a Forgejo URL;
keep Forgejo tags, checksums, and provenance; the release pipeline publishes verified bytes to the website after notarization and updates version, checksum, and release notes atomically;
host Sparkle appcast/assets on the same release channel later;
support rollback and versioned immutable asset URLs, cache headers, bandwidth limits, mirrors, and public SHA-256/signing identity;
do not add a web-based signing/release button in the first version: CI/release process uploads, and the website is a distribution surface, not a secret-bearing build system;
make an explicit analytics/privacy decision.

Dependencies:

Coordinate pricing, entitlement, and license-link copy with #50 Add a $50 lifetime license paywall: #50. This issue must not implement licensing or collect secrets in the website.
Coordinate the release-channel contract with #52 Add the Sparkle updater and appcast release channel: #52. The site must reserve a stable channel and asset layout without inventing a second updater or licensing state.

Non-goals:

no App Store submission or App Store receipt/licensing implementation;
no browser-based signing, notarization, release approval, credential storage, or arbitrary artifact upload;
no Forgejo-hosted download links as the public distribution path;
no forced analytics, tracking pixels, or personally identifiable telemetry without an explicit privacy decision and consent model;
no new product functionality in the macOS app merely to create marketing media.

Acceptance criteria:

The public site has a coherent hero, product story, feature sections, security/privacy section, $50-lifetime pricing placeholder, support/docs links, and a visible download CTA at desktop, tablet, and narrow mobile widths.
Screenshots and videos are real captures of supported app flows in both light and dark appearances. Search, Settings, folders/drag, schedules, swipe/actions, and deep links are each represented; captures are scrubbed of fixture/random IDs, personal data, expired sessions, and misleading error states. Videos have captions and poster images, and none autoplay with audio.
Keyboard navigation, visible focus, semantic headings/landmarks, meaningful alt text or adjacent descriptions, contrast, reduced-motion behavior, captions, and mobile layouts are verified. Media has bounded dimensions/file sizes and lazy loading or an equivalent strategy so the initial page remains fast on a representative connection.
The download CTA resolves to a website/CDN/object-storage URL for the current release, not a Forgejo URL. The served archive is the notarized and stapled build produced by CI; the page exposes version, release notes, SHA-256, and signing identity.
Release publication verifies the exact bytes after notarization before upload. Version, checksum, and release notes switch atomically; immutable versioned URLs remain valid, cache headers are explicit, and a documented rollback selects a previous verified version without mutating its bytes. Bandwidth limits and at least one mirror/fallback are defined and tested.
Forgejo tags/checksums/provenance remain linked from each release page. A failed notarization, checksum mismatch, missing staple, or partial publication cannot move the public latest pointer.
Sparkle appcast/assets have a documented same-channel path and ownership boundary for the updater dependency; the first implementation may reserve the endpoint but must not duplicate updater state. The $50 lifetime pricing/link remains a placeholder until #50 defines the licensing flow.
CI/release credentials are write-only to the publication job as needed, never exposed to browser code or page source. There is no web release/signing control. Public artifacts are immutable and served over HTTPS.
Analytics/privacy is an explicit recorded decision (for example, no analytics; or privacy-preserving, consent-gated aggregate analytics), including what data is collected, retention, opt-out/consent behavior, and whether a cookie banner is required. Default to no tracking until decided.
Deterministic checks cover URL selection (latest vs rollback), checksum/signing metadata rendering, atomic publication failure behavior, media accessibility metadata, and the absence of Forgejo URLs in the download CTA. A repeatable staging/dry-run publication demonstrates these checks without uploading secrets or an unverified artifact.

Tomorrow deliverables:

A reviewable responsive site implementation/preview with the sections, CTA, accessibility, reduced-motion, and analytics decision above.
A checked-in media manifest and optimized real light/dark screenshots, captioned videos, and posters covering every named flow.
A staging release-channel layout plus CI publication dry run showing verification, immutable versioned assets, atomic latest metadata, checksum/signing identity, cache headers, mirror/fallback, and rollback behavior.
Release/operator notes that link the Forgejo tag and provenance, explain the updater (#52, Sparkle) and licensing (#50) dependencies, and document the no-web-secrets boundary.

Tomorrow scope: - design an attractive product site consistent with the polished native macOS app; - show a clear hero/product story, feature sections, security/privacy, pricing placeholder for the $50 lifetime license, and support/docs; - capture real light/dark screenshots and short videos showing search, Settings, folders/drag, schedules, swipe/actions, and deep links; media must contain no fixture data, random IDs, or expired-state artifacts; - make the site responsive and accessible, honor reduced motion, provide captions and posters, optimize media, and use no autoplay audio; - make the public download button serve the latest notarized/stapled direct build from the website/CDN/object storage, never a Forgejo URL; - keep Forgejo tags, checksums, and provenance; the release pipeline publishes verified bytes to the website after notarization and updates version, checksum, and release notes atomically; - host Sparkle appcast/assets on the same release channel later; - support rollback and versioned immutable asset URLs, cache headers, bandwidth limits, mirrors, and public SHA-256/signing identity; - do not add a web-based signing/release button in the first version: CI/release process uploads, and the website is a distribution surface, not a secret-bearing build system; - make an explicit analytics/privacy decision. Dependencies: - Coordinate pricing, entitlement, and license-link copy with #50 Add a $50 lifetime license paywall: https://git.kayg.org/kayg/hermternal-apple/issues/50. This issue must not implement licensing or collect secrets in the website. - Coordinate the release-channel contract with #52 Add the Sparkle updater and appcast release channel: https://git.kayg.org/kayg/hermternal-apple/issues/52. The site must reserve a stable channel and asset layout without inventing a second updater or licensing state. Non-goals: - no App Store submission or App Store receipt/licensing implementation; - no browser-based signing, notarization, release approval, credential storage, or arbitrary artifact upload; - no Forgejo-hosted download links as the public distribution path; - no forced analytics, tracking pixels, or personally identifiable telemetry without an explicit privacy decision and consent model; - no new product functionality in the macOS app merely to create marketing media. Acceptance criteria: - The public site has a coherent hero, product story, feature sections, security/privacy section, $50-lifetime pricing placeholder, support/docs links, and a visible download CTA at desktop, tablet, and narrow mobile widths. - Screenshots and videos are real captures of supported app flows in both light and dark appearances. Search, Settings, folders/drag, schedules, swipe/actions, and deep links are each represented; captures are scrubbed of fixture/random IDs, personal data, expired sessions, and misleading error states. Videos have captions and poster images, and none autoplay with audio. - Keyboard navigation, visible focus, semantic headings/landmarks, meaningful alt text or adjacent descriptions, contrast, reduced-motion behavior, captions, and mobile layouts are verified. Media has bounded dimensions/file sizes and lazy loading or an equivalent strategy so the initial page remains fast on a representative connection. - The download CTA resolves to a website/CDN/object-storage URL for the current release, not a Forgejo URL. The served archive is the notarized and stapled build produced by CI; the page exposes version, release notes, SHA-256, and signing identity. - Release publication verifies the exact bytes after notarization before upload. Version, checksum, and release notes switch atomically; immutable versioned URLs remain valid, cache headers are explicit, and a documented rollback selects a previous verified version without mutating its bytes. Bandwidth limits and at least one mirror/fallback are defined and tested. - Forgejo tags/checksums/provenance remain linked from each release page. A failed notarization, checksum mismatch, missing staple, or partial publication cannot move the public latest pointer. - Sparkle appcast/assets have a documented same-channel path and ownership boundary for the updater dependency; the first implementation may reserve the endpoint but must not duplicate updater state. The $50 lifetime pricing/link remains a placeholder until #50 defines the licensing flow. - CI/release credentials are write-only to the publication job as needed, never exposed to browser code or page source. There is no web release/signing control. Public artifacts are immutable and served over HTTPS. - Analytics/privacy is an explicit recorded decision (for example, no analytics; or privacy-preserving, consent-gated aggregate analytics), including what data is collected, retention, opt-out/consent behavior, and whether a cookie banner is required. Default to no tracking until decided. - Deterministic checks cover URL selection (latest vs rollback), checksum/signing metadata rendering, atomic publication failure behavior, media accessibility metadata, and the absence of Forgejo URLs in the download CTA. A repeatable staging/dry-run publication demonstrates these checks without uploading secrets or an unverified artifact. Tomorrow deliverables: 1. A reviewable responsive site implementation/preview with the sections, CTA, accessibility, reduced-motion, and analytics decision above. 2. A checked-in media manifest and optimized real light/dark screenshots, captioned videos, and posters covering every named flow. 3. A staging release-channel layout plus CI publication dry run showing verification, immutable versioned assets, atomic latest metadata, checksum/signing identity, cache headers, mirror/fallback, and rollback behavior. 4. Release/operator notes that link the Forgejo tag and provenance, explain the updater (#52, Sparkle) and licensing (#50) dependencies, and document the no-web-secrets boundary.

kayg referenced this issue

2026-08-23 17:40:19 +00:00

Add Sparkle updates for notarized direct-distribution builds #52

No labels

delivered

outstanding

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/hermternal-apple#51

No description provided.

Rows
Columns