krz/octosentry

macOS menu bar app to monitor GitHub security alerts

clone: git clone https://gitbay.org/krz/octosentry.git

0b5cc04f3ce71875a930c9a7c4b6cb82350718d9

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-07-18T05:25:24Z

Drop App Store from distribution docs

Not pursuing App Store submission — DMG + Homebrew only. Removed the
submission walkthrough and reframed the doc around the single channel;
also updated the Homebrew section since the tap is actually published
now, not just a template.

 DISTRIBUTION.md | 52 ++++++++++++++++++++++++----------------------------
 1 file changed, 24 insertions(+), 28 deletions(-)

diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md
index f81fb21..e442704 100644
--- a/DISTRIBUTION.md
+++ b/DISTRIBUTION.md
@@ -1,26 +1,9 @@
 # Distribution
 
-octosentry ships on two channels with a single codebase and identical
-entitlements (spec §9) — the only divergence is signing method at export
-time and whether the update checker runs.
+octosentry ships as a notarized DMG and via Homebrew — no App Store
+distribution. Same entitlements either way; there's only one channel.
 
-## App Store
-
-1. Requires an active Apple Developer Program membership and an **Apple
-   Distribution** certificate (Xcode > Settings > Accounts > Manage
-   Certificates).
-2. Create the app record in [App Store Connect](https://appstoreconnect.apple.com)
-   with bundle ID `net.cleberg.octosentry`.
-3. Archive: Product > Archive in Xcode (Release configuration).
-4. In the Organizer, Distribute App > App Store Connect > Upload.
-5. Complete the app listing (screenshots, description, privacy nutrition
-   label — [PrivacyInfo.xcprivacy](octosentry/PrivacyInfo.xcprivacy) already
-   declares no tracking and no collected data) and submit for review.
-
-The update checker (`UpdateStore`) detects the App Store receipt at
-runtime and never runs on this build — no code changes needed per release.
-
-## DMG (direct distribution)
+## DMG
 
 Requires a **Developer ID Application** certificate and notarization
 credentials stored once locally:
@@ -43,18 +26,31 @@ scripts/build-dmg.sh 1.0.0
 
 This archives, exports with Developer ID signing, notarizes, staples the
 ticket, and produces `build/octosentry-1.0.0.dmg`. Attach that file to
-the corresponding GitHub Release (`gh release create 1.0.0 build/octosentry-1.0.0.dmg`)
-— the update checker links there.
+the corresponding GitHub Release:
+
+```bash
+gh release upload 1.0.0 build/octosentry-1.0.0.dmg
+```
+
+The update checker (`UpdateStore`) links there.
 
 ## Homebrew
 
-Not published yet. [Casks/octosentry.rb](Casks/octosentry.rb) is a
-template — to actually publish it:
+Published at [zerolabsco/homebrew-tap](https://github.com/zerolabsco/homebrew-tap).
+Users install via:
+
+```bash
+brew tap zerolabsco/tap
+brew install --cask octosentry
+```
+
+Per release, after uploading the new DMG to its GitHub Release:
 
-1. Create a `zerolabsco/homebrew-tap` repo.
-2. Copy the cask there, filling in the real `sha256` of the released DMG
-   (`shasum -a 256 octosentry-1.0.0.dmg`).
-3. Users install via `brew tap zerolabsco/tap && brew install --cask octosentry`.
+1. `shasum -a 256 build/octosentry-<version>.dmg`
+2. Update `version` and `sha256` in [Casks/octosentry.rb](Casks/octosentry.rb)
+   (kept here for reference — the canonical copy lives in the tap repo).
+3. Copy the updated file into a local clone of `zerolabsco/homebrew-tap`,
+   commit, and push.
 
 ## Version bumps