Release: embed + sign + notarize the extension (per-app CI template) - #6
Merged
Merged
Conversation
Add scripts/package-signed.sh: builds LP-100A-App.app, builds the LP100A .appex, embeds it under Contents/Extensions/, signs inside-out with the repo's Developer ID cert (imported from a .p12 secret into a throwaway keychain), builds the DMG, and notarizes + staples it. This is what makes an installed app register its extension for the suite to host. Signing/notarization are GATED on secrets — without them it ad-hoc signs and skips notarization (build still succeeds; extension won't register on other Macs). release.yml now calls it in place of the separate build-app/make-dmg steps, passing the signing/notary secrets. docs/SIGNING-SECRETS.md lists what to set. This is the per-app template. NOT yet exercised in CI (needs the secrets); VU2CPL adds them, cuts a release, and verifies it hosts on another Mac — then we replicate to LP-700/BPF/Antenna and the suite host. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the released LP-100A DMG host-ready: the app bundle embeds its signed ExtensionKit extension, so installing it registers the extension for the Amateur Radio Suite to load. This is the template for the per-app notarized-release CI (we'll replicate to LP-700/BPF/Antenna + the suite after it's verified).
What changed
scripts/package-signed.sh— build app → build.appex→ embed underContents/Extensions/→ sign inside-out with this repo's Developer ID cert (imported from a.p12secret into a throwaway keychain) → DMG → notarize + staple.release.yml— calls it in place of the separate build-app/make-dmg steps, passing signing/notary secrets.docs/SIGNING-SECRETS.md— the secrets to set.Gating / fallback
All signing is gated on secrets. With none set, it ad-hoc signs and skips notarization — the build still succeeds, but the released app's extension won't register on another Mac. So merging this is safe even before secrets are added.
I can't run signing/notarization in CI. To verify: add the secrets (see
docs/SIGNING-SECRETS.md), cut a release, then on another Mac install the Suite (host build) + this DMG, launch the app, and Enable Extensions → LP-100A should host. Once confirmed, I replicate this to the other repos.🤖 Generated with Claude Code