diff --git a/.github/actions/cask-audit/action.yml b/.github/actions/cask-audit/action.yml index f6a5b3c7e..ed8394007 100644 --- a/.github/actions/cask-audit/action.yml +++ b/.github/actions/cask-audit/action.yml @@ -1,20 +1,12 @@ name: Generate and audit the Homebrew cask description: > Generates the cask for a tag, styles it and audits it inside a throwaway tap. - Used both by the release job that publishes to VoltiusApp/homebrew-voltius and - by the packaging check that runs the stricter new-cask audit homebrew-cask - core applies to a submission. + Used by the release job that publishes to VoltiusApp/homebrew-voltius. inputs: tag: description: Release tag to generate the cask for required: true - core: - description: > - Generate the homebrew-cask core variant (drops the command-line - quarantine workaround) instead of the tap variant. - required: false - default: 'false' audit-args: description: Extra flags for `brew audit`, e.g. --new for a first submission required: false @@ -43,15 +35,12 @@ runs: env: GH_TOKEN: ${{ inputs.github-token }} TAG: ${{ inputs.tag }} - CORE: ${{ inputs.core }} run: | # The path matters: `brew style` only applies the cask cops when the # file sits under a Casks/ directory. On a bare .rb it falls back to # generic Ruby cops and fails on Sorbet sigils and frozen_string_literal. mkdir -p out/Casks - variant="" - [ "$CORE" = "true" ] && variant="--core" - bash scripts/gen-homebrew-cask.sh "$TAG" $variant > out/Casks/voltius.rb + bash scripts/gen-homebrew-cask.sh "$TAG" > out/Casks/voltius.rb if grep -q -- '--no-quarantine' out/Casks/voltius.rb; then echo "::error::Generated cask uses Homebrew's removed --no-quarantine option" exit 1 diff --git a/.github/workflows/verify-packaging.yml b/.github/workflows/verify-packaging.yml index ada292cb0..1f87560a9 100644 --- a/.github/workflows/verify-packaging.yml +++ b/.github/workflows/verify-packaging.yml @@ -96,18 +96,10 @@ jobs: } Write-Host "uninstalled cleanly" - # There is deliberately no homebrew-cask core job. `brew audit --cask --new` - # runs a signature scan that Voltius cannot pass while it is ad-hoc signed - # rather than notarized: - # - # Signature verification failed: Scan completed, but failed because the - # software is not signed by a distributor that meets the system Gatekeeper - # requirements. - # - # That is a hard gate, not a style nit, so a core submission is blocked until - # there is an Apple Developer account to notarize with. `brew style` and the - # rest of the audit do pass — see gen-homebrew-cask.sh --core, kept for the - # day that changes. The tap keeps being audited by publish-installers.yml. + # There is no homebrew-cask core job yet. Its `brew audit --cask --new` + # signature scan used to fail on the ad-hoc signed app; releases are notarized + # since 0.63.0, so a core submission is no longer blocked by it. The tap keeps + # being audited by publish-installers.yml. # Proves the MSIX packs at all: it needs Windows plus the Windows SDK, so # nothing else in this repo can. This is a check, never a submission: it builds diff --git a/README.md b/README.md index d91873511..89452b670 100644 --- a/README.md +++ b/README.md @@ -109,18 +109,8 @@ Community-maintained by [jing2uo](https://github.com/jing2uo) on [FlatPark](http brew install --cask voltiusapp/voltius/voltius ``` -Voltius is signed with its own certificate but not notarized (no Apple Developer account yet). -If macOS Gatekeeper blocks the first launch, right-click the app and choose -**Open**. To clear the quarantine flag from an existing installation instead, -run: - -```sh -xattr -dr com.apple.quarantine /Applications/Voltius.app -``` - -If you download the `.dmg` directly and macOS says **"Voltius.app is damaged and -cannot be opened"**, the same command clears the quarantine flag after you copy -Voltius to Applications. +Voltius is signed and notarized by Apple. After updating from an older version, +macOS asks once for access to the keychain: choose **Always Allow**. ### Windows — winget diff --git a/packaging/README.md b/packaging/README.md index 728548738..9487f17e7 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -164,24 +164,15 @@ release assets — a user who downloaded one could not install it. nothing until the user has tapped it. A submission to homebrew-cask core is what would make it discoverable, and the notability bar (75 stars) is cleared. -**Core is blocked on notarization.** `brew audit --cask --new`, the gate a -submission has to pass, runs a signature scan and fails: - -``` -Signature verification failed: Scan completed, but failed because the software -is not signed by a distributor that meets the system Gatekeeper requirements. -``` - -Voltius is ad-hoc signed, not notarized, so this cannot pass without an Apple -Developer account. `brew style` and the rest of the audit are clean, so this is -the only thing standing in the way. - -`scripts/gen-homebrew-cask.sh --core` emits the variant for that PR, kept -ready for the day notarization exists: core is hostile to caveats that talk the -user out of Gatekeeper, so the quarantine-clearing `xattr` command the tap -caveat carries is dropped there, leaving the right-click-Open instructions. - -Never put `brew install --no-quarantine` in either variant. Homebrew 6 removed +**Core was blocked on notarization.** `brew audit --cask --new`, the gate a +submission has to pass, runs a signature scan that failed on the ad-hoc signed +app ("not signed by a distributor that meets the system Gatekeeper +requirements"). Releases are signed with Developer ID and notarized since +0.63.0, so that gate should now pass; `brew style` and the rest of the audit were +already clean. The cask carries no Gatekeeper caveat any more, so the file +`scripts/gen-homebrew-cask.sh ` emits suits both the tap and a core PR. + +Never put `brew install --no-quarantine` in the cask. Homebrew 6 removed the flag, so the hint fails with `Error: invalid option: --no-quarantine` for tap users, and core rejected it before that. `brew audit` does not catch it, so the `cask-audit` action greps the generated cask and fails the run (#176). diff --git a/scripts/gen-homebrew-cask.sh b/scripts/gen-homebrew-cask.sh index 617731f33..2313a2f00 100755 --- a/scripts/gen-homebrew-cask.sh +++ b/scripts/gen-homebrew-cask.sh @@ -1,19 +1,16 @@ #!/usr/bin/env bash # Emits a complete Homebrew Cask for Voltius to stdout. # -# Usage: gen-homebrew-cask.sh [--core] +# Usage: gen-homebrew-cask.sh # e.g. gen-homebrew-cask.sh v0.4.0 # -# --core emit the variant intended for a homebrew-cask *core* submission -# rather than for the VoltiusApp/homebrew-voltius tap. The tap gives -# an optional command for clearing the quarantine flag; core keeps -# only the accepted right-click Open instructions. +# The app is signed with Developer ID and notarized, so the cask needs no +# Gatekeeper caveat. The same file suits the tap and a homebrew-cask core PR. # # Requires: gh (authenticated), awk. Reads the .dmg.sha256 release assets. set -euo pipefail -TAG="${1:?usage: gen-homebrew-cask.sh [--core]}" -VARIANT="${2:-}" +TAG="${1:?usage: gen-homebrew-cask.sh }" source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/release-assets.sh" release_assets_init "$TAG" @@ -21,15 +18,6 @@ release_assets_init "$TAG" SHA_ARM="$(release_sha "$(release_asset aarch64.dmg)")" SHA_INTEL="$(release_sha "$(release_asset x64.dmg)")" -if [ "$VARIANT" = "--core" ]; then - QUARANTINE_HINT="" -else - QUARANTINE_HINT=" - To clear the quarantine flag from an existing installation instead, run: - xattr -dr com.apple.quarantine /Applications/Voltius.app -" -fi - cat <