Repository navigation
Sign and notarize the macOS release build - #20
Open
DominikPalo wants to merge 1 commit into
Open
DominikPalo wants to merge 1 commit into
DominikPalo wants to merge 1 commit into
Conversation
The release workflow now signs the macOS app with a Developer ID certificate and has Apple notarize and staple it, instead of ad hoc signing. - electron-builder.yml: drop the ad hoc identity, enable the hardened runtime. - release.yml: fail up front if a signing or notarization secret/variable is missing (electron-builder would only warn and skip), pass the credentials to the macOS build step only, and verify each app with codesign, stapler and spctl. The certificate and passwords are secrets; APPLE_ID and APPLE_TEAM_ID are plain repository variables. - package.json: `npm run pack` never signs, so local unpacked builds do not pick up an unrelated keychain identity. - README/CHANGELOG: document the required secrets and variables. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The release workflow now signs the macOS app with a Developer ID certificate and has Apple notarize and staple it. Until now the app was only ad hoc signed, so macOS blocked it on first launch.
electron-builder.yml: removed the ad hoc identity and turned the hardened runtime on (required for notarization). electron-builder signs with the Developer ID certificate and notarizes and staples each app whenAPPLE_ID,APPLE_APP_SPECIFIC_PASSWORDandAPPLE_TEAM_IDare set..github/workflows/release.ymlCSC_LINKwould otherwise also be used to sign the Windows build.codesign,stapler validateandspctl --assess, so a missing ticket fails the release.package.json:npm run packnow passes-c.mac.identity=nulland never signs. Without a Developer ID certificate, electron-builder signs with any other certificate it finds in the keychain, including an "Apple Development" one. That made a local pack take 8+ minutes and could not be notarized.README.md/CHANGELOG.md: replaced the outdated build note and added an Unreleased entry.Required repository settings (Settings → Secrets and variables → Actions)
CSC_LINK.p12, base64-encodedCSC_KEY_PASSWORD.p12was exported withAPPLE_APP_SPECIFIC_PASSWORDAPPLE_IDAPPLE_TEAM_IDThe macOS build fails until all five exist. Notarization needs a Developer ID Application certificate; an "Apple Development" certificate will not work.
Notes for reviewers
e2e/smoke.mjs.npm run distsigns with whichever code-signing identity it finds in the keychain; setCSC_IDENTITY_AUTO_DISCOVERY=falsefor an unsigned build.🤖 Generated with Claude Code