Signed, notarizable .dmg release tooling - #12
Open
okaris wants to merge 3 commits into
Open
Conversation
Package quill as a menu-bar quill.app shipped inside a .dmg, signed with a Developer ID Application certificate. Everything signs with a single cert — no Developer ID Installer cert required. - scripts/build-release.sh: build → wrap in quill.app (LSUIElement) → codesign (hardened runtime + entitlements) → notarize + staple app → package .dmg → sign → notarize + staple. Config via env; SKIP_NOTARIZE=1 for signed-only local/test builds. - packaging/Info.plist: app bundle plist (@Version@ templated). - packaging/quill.entitlements: audio-input entitlement. - .github/workflows/release.yml: on v* tag, build/sign/notarize and attach the .dmg to the GitHub release. - README: Download (.dmg, drag to Applications, first-launch note) and Releasing sections. The .app is a thin distribution wrapper; the core stays a single binary and the CLI subcommands work via the bundled executable. Claude-Session: https://claude.ai/code/session_01Mq7wGXgaovgYzcYe5snUUJ
Reuse the exact feather from MenuBarController.featherSVG as the app/Finder icon so the bundle and the menu bar match. packaging/icon.svg renders to packaging/quill.icns; build-release.sh installs it into Contents/Resources and Info.plist points CFBundleIconFile at it. Claude-Session: https://claude.ai/code/session_01Mq7wGXgaovgYzcYe5snUUJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds tooling to ship quill as a downloadable, Developer ID-signed and Apple-notarized macOS release — a menu-bar
quill.appinside a.dmg.Everything signs with a single Developer ID Application certificate — no Developer ID Installer cert required (that's why this uses an
.app/.dmgrather than a.pkg).Changes
scripts/build-release.sh— one command: build → wrap inquill.app→ codesign (hardened runtime + entitlements) → notarize + staple → package.dmg→ sign → notarize + staple. Config via env vars;SKIP_NOTARIZE=1for signed-only local builds.packaging/Info.plist— app bundle plist,LSUIElement(menu-bar agent, no dock icon), version templated via@VERSION@.packaging/quill.entitlements—com.apple.security.device.audio-input..github/workflows/release.yml— on av*tag, builds/signs/notarizes and attaches the.dmgto the GitHub release. Secrets documented at the top of the file.quill.appto Applications) and Releasing sections.Design note
The README describes quill as "a single Swift binary, no app bundle." This PR keeps that intact — the
.appis a thin distribution wrapper around the same executable; the CLI subcommands (quill doctor,quill run,quill install) still work via the bundled binary, and source builds are unchanged. The.appexists purely so distribution can be signed + notarized + stapled with the Developer ID Application cert (a bare binary can't be stapled).Notarization
Fully wired up. A signed and notarized v0.1.0
.dmgbuilt with this tooling is available for reference: https://github.com/okaris/quill/releases/tag/v0.1.0 (spctlreportssource=Notarized Developer ID).For CI, add the certificate + App Store Connect notary secrets (documented atop
release.yml) and push av*tag.