PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

KAN-56: Sign and notarize macOS releases #152

Merged
Twyco merged 1 commits from feature/KAN-56-signed-macos-release into main 2026-09-27 08:08:48 +00:00
Conversation 0 Commits 1 Files Changed 3
+999
Twyco commented 2026-09-26 22:16:55 +00:00
Owner
Copy Link
Copy Source

Adds a macOS release command that signs KanbanGit with Apple Developer team ZZX2KZGTHU, notarizes it through a keychain profile, staples and verifies the result, and produces a versioned ZIP with its SHA-256 checksum. The app keeps de.kanbangit.desktop; the existing debug command remains available.

The command rejects missing credentials, old teams, ad-hoc/development identities, mismatched app metadata and unaccepted notarization. Apple submission IDs are preserved, and --resume <submission-id> completes long-running submissions without rebuilding or uploading again. Apple’s log must match the signed app hash and architecture before publication. S3 publishing and automatic updates are tracked separately in KAN-58 and KAN-65.

Validation: 54 native JavaScript tests (50 for the release workflow), 8 existing Rust tests, ESLint with no warnings, and an actual Apple-Silicon release signed and accepted by Apple. Stapling, strict signature verification, SHA-256 verification and Gatekeeper acceptance also pass after extracting the final ZIP. Manual installation and launch were confirmed by the user.

Ticket: https://kanbangit.de/projects/1/tickets/56
Base branch: main (ticket branch created after a successful fast-forward pull at 7001776).

Adds a macOS release command that signs KanbanGit with Apple Developer team `ZZX2KZGTHU`, notarizes it through a keychain profile, staples and verifies the result, and produces a versioned ZIP with its SHA-256 checksum. The app keeps `de.kanbangit.desktop`; the existing debug command remains available. The command rejects missing credentials, old teams, ad-hoc/development identities, mismatched app metadata and unaccepted notarization. Apple submission IDs are preserved, and `--resume <submission-id>` completes long-running submissions without rebuilding or uploading again. Apple’s log must match the signed app hash and architecture before publication. S3 publishing and automatic updates are tracked separately in KAN-58 and KAN-65. Validation: 54 native JavaScript tests (50 for the release workflow), 8 existing Rust tests, ESLint with no warnings, and an actual Apple-Silicon release signed and accepted by Apple. Stapling, strict signature verification, SHA-256 verification and Gatekeeper acceptance also pass after extracting the final ZIP. Manual installation and launch were confirmed by the user. Ticket: https://kanbangit.de/projects/1/tickets/56 Base branch: `main` (ticket branch created after a successful fast-forward pull at `7001776`).
Twyco added 1 commit 2026-09-26 22:16:55 +00:00
feat(KAN-56): sign and notarize macOS releases
CI/CD / preconditions (pull_request) Successful in 1s
Details
CI/CD / test_and_check_app (pull_request) Successful in 6m43s
Details
CI/CD / Publish immutable image (pull_request) Skipped
Details
2b85517965
Twyco merged commit 2f99b8e65c into main 2026-09-27 08:08:48 +00:00
Twyco deleted branch feature/KAN-56-signed-macos-release 2026-09-27 08:08:48 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Eric Twyco flux-image-automation (Flux Image Automation)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: PetschStudios/KanbanGit#152