Commit `41eb2578b5`

41eb2578b5cc37435e611e6552a9fec110273fbe

parent: 3ad76bed90

Unsigned

cmc <hello@cleberg.net> · 2026-08-22 22:34 UTC
committer: <noreply@github.com>

Staple the notarization ticket to the app, not just the DMG (#37)

Notarizes and staples the app before packaging, then notarizes and
staples the DMG as before. Stapling only the DMG left the app without a
ticket of its own, so once it was dragged out of the disk image an
offline machine had nothing local to verify against.

Costs a second notarization submission.

Layout: unified · split

scripts/build-dmg.sh +17 −2

		@@ -60,7 +60,21 @@ xcodebuild -exportArchive \
60	60
61	61	APP_PATH="$EXPORT_PATH/octosentry.app"
62	62
63		echo "==> Notarizing"
	63	# The app is notarized and stapled before it goes into the DMG, then the DMG
	64	# is notarized and stapled in turn. Stapling only the DMG leaves the app
	65	# itself without a ticket: once a user drags it to /Applications the disk
	66	# image is gone, and a machine that is offline has nothing local to check the
	67	# notarization against. Two submissions, but each artifact carries its own
	68	# ticket.
	69	echo "==> Notarizing app"
	70	APP_ZIP="$BUILD_DIR/octosentry.zip"
	71	ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"
	72	xcrun notarytool submit "$APP_ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
	73
	74	echo "==> Stapling ticket to app"
	75	xcrun stapler staple "$APP_PATH"
	76
	77	echo "==> Building DMG"
64	78	DMG_STAGING="$BUILD_DIR/staging"
65	79	mkdir -p "$DMG_STAGING"
66	80	cp -R "$APP_PATH" "$DMG_STAGING/"
		@@ -68,9 +82,10 @@ ln -s /Applications "$DMG_STAGING/Applications"
68	82
69	83	hdiutil create -volname "octosentry" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH"
70	84
	85	echo "==> Notarizing DMG"
71	86	xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
72	87
73		echo "==> Stapling notarization ticket"
	88	echo "==> Stapling ticket to DMG"
74	89	xcrun stapler staple "$DMG_PATH"
75	90
76	91	echo "==> Done: $DMG_PATH"

Commit 41eb2578b5

Commit `41eb2578b5`