From e4de489f53d0e2e679ce42b044f6c80c94e7f193 Mon Sep 17 00:00:00 2001
From: "Adrian Alfred C. Bonpin" <adrianbonpin@gmail.com>
Date: Sun, 20 Sep 2026 16:55:27 +0800
Subject: [PATCH] fix(release): notarize and staple the DMGs, not just the .app
 (#34)

tauri-action notarizes and staples the .app but never the .dmg wrapping it, so
Gatekeeper rejected the downloaded DMG as "Unnotarized Developer ID" even
though the app inside was fine:

  spctl --assess --type open --context context:primary-signature -v \
    Gridline_0.8.0_aarch64.dmg
  -> rejected, source=Unnotarized Developer ID

Gatekeeper assesses the DMG itself when a user opens the download, so the app
being notarized does not save the mount. Submit each DMG to the same notary
service and staple the ticket into it.

- release.yml: new macOS-only step after tauri-action replaces each uploaded
  DMG with its stapled copy. Assets are replaced via the release ID because the
  GitHub releases/tags endpoint 404s for drafts, so uploading by tag cannot
  work while the release is still a draft.
- release-mac.sh: same notarize + staple pass for the local/Gitea path before
  upload, respecting GRIDLINE_SKIP_NOTARIZE.
- README: state that both the .app and the .dmg carry a stapled ticket.
---
 .github/workflows/release.yml | 53 +++++++++++++++++++++++++++++++++++
 README.md                     |  2 +-
 scripts/release-mac.sh        | 31 ++++++++++++++++++++
 3 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d1c835..d0b8837 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -439,6 +439,59 @@ jobs:
           # README download tables link to them statically per release —
           # remember to update both README tables when cutting a new version.
 
+      # tauri-action notarizes + staples the .app but NOT the .dmg wrapping it,
+      # so Gatekeeper rejects the downloaded DMG as "Unnotarized Developer ID"
+      # even though the app inside is fine. Submit the DMG to the same notary
+      # service, staple the ticket, and replace the uploaded asset.
+      #
+      # Assets are replaced via the release ID rather than `gh release upload`:
+      # the GitHub releases/tags endpoint returns 404 for drafts, so uploading
+      # by tag cannot work while the release is still a draft.
+      - name: Notarize and staple the DMGs
+        if: startsWith(matrix.platform, 'macos') && steps.apple.outputs.enabled == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          dmgs=(desktop/src-tauri/target/*/release/bundle/dmg/*.dmg)
+          if [ ${#dmgs[@]} -eq 0 ]; then
+            echo "no DMG produced" >&2
+            exit 1
+          fi
+          REL_ID=$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
+            --jq ".[] | select(.tag_name == \"${RELEASE_TAG}\") | .id" | head -1)
+          if [ -z "$REL_ID" ]; then
+            echo "could not resolve a release id for ${RELEASE_TAG}" >&2
+            exit 1
+          fi
+          for dmg in "${dmgs[@]}"; do
+            name=$(basename "$dmg")
+            echo ">> notarizing $name (this can take a few minutes)"
+            xcrun notarytool submit "$dmg" \
+              --key "$APPLE_API_KEY_PATH" \
+              --key-id "$APPLE_API_KEY" \
+              --issuer "$APPLE_API_ISSUER" \
+              --wait
+            xcrun stapler staple "$dmg"
+            xcrun stapler validate "$dmg"
+            # Replace the copy tauri-action uploaded, which carries no DMG ticket.
+            old=$(gh api "repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets" \
+              --jq ".[] | select(.name == \"${name}\") | .id" | head -1)
+            if [ -n "$old" ]; then
+              gh api -X DELETE "repos/${GITHUB_REPOSITORY}/releases/assets/${old}"
+            fi
+            echo ">> re-uploading stapled $name"
+            curl -fsS -X POST \
+              -H "Authorization: token ${GH_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${dmg}" \
+              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=${name}"
+            echo
+          done
+          echo "all DMGs notarized and stapled"
+
   # After the installers are uploaded, refresh the Homebrew cask in the
   # AdrianBonpin/homebrew-gridline tap: hash the freshly-published DMGs,
   # render Casks/gridline.rb from the template, and push it. Users then get
diff --git a/README.md b/README.md
index a7d56a0..97d0b3f 100644
--- a/README.md
+++ b/README.md
@@ -318,7 +318,7 @@ Pre-built installers for macOS, Windows, and Linux are published on the [Release
 
 #### macOS signing & notarization
 
-Gridline's macOS builds are **Developer-ID signed and notarized by GitHub Actions**, so macOS opens them without a Gatekeeper prompt.
+Gridline's macOS builds are **Developer-ID signed and notarized by GitHub Actions**, so macOS opens them without a Gatekeeper prompt. Both the `.app` and the `.dmg` it ships inside are notarized and carry a stapled ticket — notarizing only the `.app` is not enough, because Gatekeeper assesses the downloaded DMG itself and rejects it as "Unnotarized Developer ID" even when the app within is fine.
 
 **One-time setup** (only the repo owner needs to do this):
 
diff --git a/scripts/release-mac.sh b/scripts/release-mac.sh
index 85ce836..c7aba78 100755
--- a/scripts/release-mac.sh
+++ b/scripts/release-mac.sh
@@ -197,6 +197,37 @@ for APP in \
     || echo "  (spctl assessment pending — normal right after notarization; stapler validate passed)"
 done
 
+# ---- notarize + staple the DMGs --------------------------------------------
+# Notarizing the .app is not enough. When a user opens the downloaded DMG,
+# Gatekeeper assesses the DMG itself — and an unnotarized DMG is rejected as
+# "Unnotarized Developer ID" even though the app inside it is fine. Submit each
+# DMG to the same notary service and staple the ticket into the DMG.
+if [ "${GRIDLINE_SKIP_NOTARIZE:-0}" = "1" ]; then
+  echo ">> Skipping DMG notarization (GRIDLINE_SKIP_NOTARIZE=1)."
+else
+  API_KEY_PATH="${APPLE_API_KEY_PATH:-${HOME}/.appstoreconnect/private_keys/AuthKey_${APPLE_API_KEY}.p8}"
+  [ -f "$API_KEY_PATH" ] || {
+    echo "ERROR: notarization API key not found at $API_KEY_PATH" >&2
+    echo "  Set APPLE_API_KEY_PATH in ${NOTARIZE_ENV} or place the .p8 at the default location." >&2
+    exit 1
+  }
+  for DMG in \
+    "${BUNDLE_ARM}/dmg/Gridline_${VERSION}_aarch64.dmg" \
+    "${BUNDLE_INTEL}/dmg/Gridline_${VERSION}_x64.dmg"; do
+    [ -f "$DMG" ] || { echo "missing $DMG" >&2; exit 1; }
+    echo ">> Notarizing $(basename "$DMG") (this can take a few minutes)"
+    xcrun notarytool submit "$DMG" \
+      --key "$API_KEY_PATH" \
+      --key-id "$APPLE_API_KEY" \
+      --issuer "$APPLE_API_ISSUER" \
+      --wait
+    xcrun stapler staple "$DMG" \
+      || { echo "failed to staple $(basename "$DMG")" >&2; exit 1; }
+    xcrun stapler validate "$DMG" \
+      || { echo "notarization ticket not stapled to $(basename "$DMG")" >&2; exit 1; }
+  done
+fi
+
 # ---- create/ensure release + upload DMGs -----------------------------------
 # Use `tea` for release management — it handles OAuth token refresh, unlike a
 # raw curl with a token from the git credential store (which can 401).