Add Developer ID signing + notarized DMG release pipeline - #3
Merged
Conversation
Adds a signed/notarized distribution path so builds can be handed to other people via GitHub Releases without Gatekeeper warnings, and with a stable cdhash that keeps TCC (Accessibility/Input Monitoring) grants across updates. - scripts/build-app.sh: build a universal (arm64+x86_64) release binary and assemble an unsigned Nib.app, stamping version/build from git. - scripts/release.sh: Developer ID sign (Hardened Runtime), notarize, staple, and package Nib-<version>.dmg. Works locally (notarytool profile) or in CI (App Store Connect API key). - packaging/entitlements.plist: empty Hardened Runtime entitlements — HID + CGEvent access is TCC-gated, and the app must not be sandboxed. - .github/workflows/release.yml: on a v* tag, sign/notarize/publish the DMG. Dormant by default (if: vars.RELEASE_ENABLED == 'true') so it never runs until explicitly opted in. - RELEASING.md: full walkthrough (cert, API key, secrets, tagging). - INSTALL.md/.gitignore: point at RELEASING.md; ignore driver/build/. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up a signed + notarized distribution path so
Nib.appcan be handed to other people via GitHub Releases — no Gatekeeper warnings, and a stable cdhash that keeps the Accessibility / Input Monitoring (TCC) grants from resetting across updates (the problem flagged inINSTALL.md).What's here
driver/scripts/build-app.sh— builds a universal (arm64 + x86_64) release binary and assembles an unsignedNib.app, stamping version/build from git.driver/scripts/release.sh— Developer ID sign (Hardened Runtime) → notarize → staple → packageNib-<version>.dmg. Works locally (notarytool keychain profile) or in CI (App Store Connect API key).driver/packaging/entitlements.plist— empty Hardened Runtime entitlements. Nib needs none (HID + CGEvent are TCC-gated, not entitlement-gated) and must not be sandboxed, which would block raw HID access..github/workflows/release.yml— on av*tag: import cert → build → sign → notarize → publish DMG to a Release.driver/RELEASING.md— full walkthrough (cert, API key, repo secrets, tagging).INSTALL.md/.gitignore— point atRELEASING.md; ignoredriver/build/.Safe to merge as-is — nothing runs yet
The release workflow is dormant by default: the job is gated on
if: vars.RELEASE_ENABLED == 'true', so av*tag push is a no-op until that repo variable is set. No credentials or personal identity are in any committed file — the Developer ID cert and secrets are added later, only when you actually opt in.To go live (later)
RELEASING.md.RELEASE_ENABLED=true.git tag v0.2.0 && git push origin v0.2.0.🤖 Generated with Claude Code