Skip to content

build(release): one-command signed, notarized, stapled dmg - #7

Closed
lmanchu wants to merge 2 commits into
readme-publicfrom
release-tooling
Closed

lmanchu wants to merge 2 commits into
readme-publicfrom
release-tooling

Conversation

@lmanchu

@lmanchu lmanchu commented Sep 13, 2026

Copy link
Copy Markdown
Owner

What

Stacked on #6. tools/release/build-release.sh turns the tree into a signed, notarized, stapled Bopomix-<version>.dmg in one command:

  1. Release build of Bopomix and BopomixInstaller.
  2. Developer ID signature with the hardened runtime on the input method (nested bundles first), notarized and stapled.
  3. The installer gets the notarized Bopomix-r<CFBundleVersion>.zip under Resources/NotarizedArchives/ and loses the dev-mode embedded bundle, exactly what ArchiveUtil checks for; then it is signed, notarized and stapled itself.
  4. A dmg containing Install Bopomix 安裝混打注音.app, signed, notarized, stapled.

--skip-notarize runs the same path without the Apple round-trips. The signing identity and the notarytool keychain profile are overridable through BOPOMIX_SIGN_IDENTITY and BOPOMIX_NOTARY_PROFILE. Output goes to dist/ and build-release/ (both ignored).

Verification

First full run on 2026-09-13: all three notarization submissions accepted, stapling succeeded, spctl --assess on the dmg reports accepted, source=Notarized Developer ID. The build is arm64 only for now; a universal build is a one-line change once the x86_64 side is checked.

🤖 Generated with Claude Code

lmanchu and others added 2 commits September 13, 2026 20:44
tools/release/build-release.sh does the whole release path: Release build
of both targets, Developer ID signing with the hardened runtime (nested
code first), notarize and staple the input method, embed it in the
installer the way ArchiveUtil expects (Resources/NotarizedArchives/
Bopomix-r<CFBundleVersion>.zip, dev-mode bundle removed), sign, notarize
and staple the installer, then a dmg holding the installer, notarized and
stapled in turn. `--skip-notarize` runs the same path without the Apple
round-trips. Needs a Developer ID Application identity and a notarytool
keychain profile (BOPOMIX_SIGN_IDENTITY / BOPOMIX_NOTARY_PROFILE override
the defaults). First full run: three submissions accepted, `spctl` on the
dmg reports Notarized Developer ID.

🤖 Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
First public version. The build number starts above the 2510 inherited
from upstream so that every McBopomofo-derived dev build on a machine is
seen as older by the installer's upgrade check and by the update feed.
updates/Info.plist carries the same numbers plus the release description
the in-app update check shows.

🤖 Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
@lmanchu
lmanchu deleted the branch readme-public September 13, 2026 22:34
@lmanchu lmanchu closed this Sep 13, 2026
@lmanchu
lmanchu deleted the release-tooling branch September 13, 2026 22:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant