feat: Developer-ID sign + notarize macOS builds #13

2026-09-04T01:22:10Z

adrianbonpin commented

2026-09-04 01:22:10 +00:00

Stops the Gatekeeper / xattr / 'Open Anyway' dance on macOS by properly signing and notarizing the app.

What changed

desktop/src-tauri/tauri.conf.json: hardenedRuntime: true + entitlements (keeps signingIdentity: "-" as the dev default; the release script overrides it via APPLE_SIGNING_IDENTITY)
desktop/src-tauri/entitlements.plist (new): JIT / unsigned-executable-memory / dyld-env-vars — required for the WebView under the hardened runtime
scripts/release-mac.sh: auto-detects the Developer ID Application identity from the login keychain, loads notarization creds from ~/.config/gridline/notarize.env (App Store Connect API key), re-signs the bundled pg tools after install_name_tool (their invalidated signatures would fail notarization), and verifies codesign + stapled notarization before uploading
README.md / AGENTS.md: replaced the unsigned/xattr instructions with a 'macOS signing & notarization' setup guide

Note: macOS is built manually via scripts/release-mac.sh (not in CI), so no Gitea secrets are needed — the cert lives in the login keychain and the API key in a local env file. The .github/workflows/release.yml is dead code (Gitea uses .gitea/workflows/); only its comment was updated.

To finish: create the Developer ID Application cert + App Store Connect API key (steps in the README), then run TAG=vX.Y.Z ./scripts/release-mac.sh.

Stops the Gatekeeper / xattr / 'Open Anyway' dance on macOS by properly signing and notarizing the app. **What changed** - `desktop/src-tauri/tauri.conf.json`: `hardenedRuntime: true` + `entitlements` (keeps `signingIdentity: "-"` as the dev default; the release script overrides it via `APPLE_SIGNING_IDENTITY`) - `desktop/src-tauri/entitlements.plist` (new): JIT / unsigned-executable-memory / dyld-env-vars — required for the WebView under the hardened runtime - `scripts/release-mac.sh`: auto-detects the Developer ID Application identity from the login keychain, loads notarization creds from `~/.config/gridline/notarize.env` (App Store Connect API key), re-signs the bundled pg tools after `install_name_tool` (their invalidated signatures would fail notarization), and verifies `codesign` + stapled notarization before uploading - `README.md` / `AGENTS.md`: replaced the unsigned/xattr instructions with a 'macOS signing & notarization' setup guide **Note:** macOS is built manually via `scripts/release-mac.sh` (not in CI), so no Gitea secrets are needed — the cert lives in the login keychain and the API key in a local env file. The `.github/workflows/release.yml` is dead code (Gitea uses `.gitea/workflows/`); only its comment was updated. **To finish:** create the Developer ID Application cert + App Store Connect API key (steps in the README), then run `TAG=vX.Y.Z ./scripts/release-mac.sh`.

adrianbonpin added 1 commit 2026-09-04 01:22:11 +00:00

feat: Developer-ID sign + notarize macOS builds b2a0a42ca4

- tauri.conf.json: enable hardenedRuntime + entitlements (keep ad-hoc
  signingIdentity as the dev default; release script overrides it)
- add desktop/src-tauri/entitlements.plist (JIT / unsigned-exec-mem /
  dyld-env-vars for the hardened runtime)
- scripts/release-mac.sh: auto-detect Developer ID identity from the
  keychain, load notarization creds from ~/.config/gridline/notarize.env
  (App Store Connect API key), re-sign bundled pg tools after
  install_name_tool (invalidated signatures would fail notarization),
  and verify codesign + stapled notarization before upload
- README/AGENTS.md: replace the unsigned/xattr instructions with the
  macOS signing & notarization setup guide

adrianbonpin merged commit 84a6f8d41c into prod

2026-09-04 01:40:48 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adrianbonpin/gridline#13