krz/octosentry

macOS menu bar app to monitor GitHub security alerts

clone: git clone https://gitbay.org/krz/octosentry.git

6b2f2717b0a34b34ed7a8f82efb7574580803ad5

signed_unknown_key

author: Christian Cleberg <hello@cleberg.net> · 2026-08-22T22:34:31Z
committer: <noreply@github.com>

Staple the notarization ticket to the app, not just the DMG (#37)

Notarizes and staples the app before packaging, then notarizes and
staples the DMG as before. Stapling only the DMG left the app without a
ticket of its own, so once it was dragged out of the disk image an
offline machine had nothing local to verify against.

Costs a second notarization submission.

 scripts/build-dmg.sh | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/scripts/build-dmg.sh b/scripts/build-dmg.sh
index 14bd608..388435d 100755
--- a/scripts/build-dmg.sh
+++ b/scripts/build-dmg.sh
@@ -60,7 +60,21 @@ xcodebuild -exportArchive \
 
 APP_PATH="$EXPORT_PATH/octosentry.app"
 
-echo "==> Notarizing"
+# The app is notarized and stapled before it goes into the DMG, then the DMG
+# is notarized and stapled in turn. Stapling only the DMG leaves the app
+# itself without a ticket: once a user drags it to /Applications the disk
+# image is gone, and a machine that is offline has nothing local to check the
+# notarization against. Two submissions, but each artifact carries its own
+# ticket.
+echo "==> Notarizing app"
+APP_ZIP="$BUILD_DIR/octosentry.zip"
+ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"
+xcrun notarytool submit "$APP_ZIP" --keychain-profile "$NOTARY_PROFILE" --wait
+
+echo "==> Stapling ticket to app"
+xcrun stapler staple "$APP_PATH"
+
+echo "==> Building DMG"
 DMG_STAGING="$BUILD_DIR/staging"
 mkdir -p "$DMG_STAGING"
 cp -R "$APP_PATH" "$DMG_STAGING/"
@@ -68,9 +82,10 @@ ln -s /Applications "$DMG_STAGING/Applications"
 
 hdiutil create -volname "octosentry" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH"
 
+echo "==> Notarizing DMG"
 xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
 
-echo "==> Stapling notarization ticket"
+echo "==> Stapling ticket to DMG"
 xcrun stapler staple "$DMG_PATH"
 
 echo "==> Done: $DMG_PATH"