Commit `41eb2578b5`

41eb2578b5cc37435e611e6552a9fec110273fbe

parent: 3ad76bed90

Unsigned

cmc <hello@cleberg.net> · 2026-08-22 22:34 UTC
committer: <noreply@github.com>

Staple the notarization ticket to the app, not just the DMG (#37)

Notarizes and staples the app before packaging, then notarizes and
staples the DMG as before. Stapling only the DMG left the app without a
ticket of its own, so once it was dragged out of the disk image an
offline machine had nothing local to verify against.

Costs a second notarization submission.

Layout: unified · split

scripts/build-dmg.sh +17 −2

 APP_PATH="$EXPORT_PATH/octosentry.app"
-echo "==> Notarizing"
+# The app is notarized and stapled before it goes into the DMG, then the DMG
+# is notarized and stapled in turn. Stapling only the DMG leaves the app
+# itself without a ticket: once a user drags it to /Applications the disk
+# image is gone, and a machine that is offline has nothing local to check the
+# notarization against. Two submissions, but each artifact carries its own
+# ticket.
+echo "==> Notarizing app"
+APP_ZIP="$BUILD_DIR/octosentry.zip"
+ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"
+xcrun notarytool submit "$APP_ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
+echo "==> Stapling ticket to app"
+xcrun stapler staple "$APP_PATH"
+echo "==> Building DMG"
 DMG_STAGING="$BUILD_DIR/staging"
 mkdir -p "$DMG_STAGING"
 cp -R "$APP_PATH" "$DMG_STAGING/"
 hdiutil create -volname "octosentry" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH"
+echo "==> Notarizing DMG"
 xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
-echo "==> Stapling notarization ticket"
+echo "==> Stapling ticket to DMG"
 xcrun stapler staple "$DMG_PATH"
 echo "==> Done: $DMG_PATH"

Commit 41eb2578b5

Commit `41eb2578b5`