updated release script

2026-11-03 15:08:34 +00:00
parent 6d4a68d219
commit 008e9bc175
6 changed files with 234 additions and 3 deletions
@@ -0,0 +1,57 @@
+# Create a signed, notarized KJMix Pro DMG
+
+Run these commands from the project folder in Terminal. Do not paste account passwords, private keys or app-specific passwords into chat or source files.
+
+## One-time setup
+
+Install a **Developer ID Application** certificate and its private key in your login Keychain. Apple Development certificates are for development, not this distribution workflow. View available signing identities with:
+
+```sh
+security find-identity -v -p codesigning
+```
+
+Save notarization credentials interactively:
+
+```sh
+./scripts/setup-notarization.sh
+```
+
+The helper runs `xcrun notarytool store-credentials KJMixPro`. Apple prompts for the developer Apple ID, team ID and an app-specific password, then validates and saves the credentials in Keychain. `notarytool` alone may not be on PATH: use `xcrun notarytool`, or the helper.
+
+If you already have a profile with a different name, use that name through `KJMIX_NOTARY_PROFILE`. The profile name is a label you chose when saving the credentials; “Keychain” is not automatically a profile name.
+
+## Verified release
+
+```sh
+./scripts/release.sh
+```
+
+The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.
+
+Outputs are versioned, for example:
+
+- `dist/KJMixPro-0.6.4-macOS.dmg`
+- `dist/KJMixPro-0.6.4-macOS.zip` (stapled app)
+- SHA-256 sidecars and `dist/KJMixPro-0.6.4-macOS-verification/` reports
+
+The script publishes these files only after the checks succeed. A failed run returns nonzero and never labels that attempt Gatekeeper verified. Existing files from earlier builds can remain in dist; check the current report and successful script completion.
+
+You can configure another saved profile or signing identity without editing the script:
+
+```sh
+KJMIX_NOTARY_PROFILE='your-profile' ./scripts/release.sh
+KJMIX_SIGNING_IDENTITY='certificate SHA-1' ./scripts/release.sh
+```
+
+The script auto-selects a Developer ID identity if all available matching certificates share the same name; otherwise it asks for an explicit identity. It forwards remaining arguments to xcodebuild. Signing/notarization require network access and may take several minutes; reports retain the submission IDs if Apple processing times out.
+
+## Explicit local previews
+
+```sh
+./scripts/release.sh --signed-only
+./scripts/release.sh --unsigned
+```
+
+These modes have clearly marked filenames and status reports. **They are not notarized or Gatekeeper verified.** Signed-only does not need notarization credentials. Unsigned creates the compatibility ZIP as well. Neither mode changes Gatekeeper settings or bypasses macOS security.
+
+References: [Apple notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution), [packaging for distribution](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution).
@@ -19,3 +19,9 @@ Configurable background fade times persist; tests inspect the real mixer output
 Fade-out handoff regression checks inspect actual mixer gain while it decreases, assert the singer audio node has not started during the fade and starts after silence, and verify Pause/unload cancel the pending singer start. Manual background fade-out also has an intermediate gain check.

 Batch waveform checks verify cache reuse versus forced regeneration, deduplication of tracks sharing audio, missing-file reporting, ShowScreen skipping, cancellation retaining completed caches, selected-track versus whole-library scope, and unchanged playback/history/library metadata. The release contains no Spotify support.
+
+## DMG release pipeline
+
+The release script now creates a compressed DMG with the approved app icon as both its volume icon and Finder file icon, plus an Applications shortcut. A real `--signed-only` run succeeded with the installed Developer ID Application identity and hardened runtime. DMG checksum, mounted contents, custom icon flag, app/volume artwork matching, app signature and disk-image signature were verified. Gatekeeper assessments of both app and DMG explicitly returned `Unnotarized Developer ID`; this output is **not** a Gatekeeper-verified release.
+
+The normal release mode is fail-closed: it requires a valid notarytool Keychain profile, notarizes/staples the app and DMG, and requires Gatekeeper success for both the image and mounted app before publishing verified filenames. Neither `keychain` nor the default `KJMixPro` profile was configured during these checks, so the positive notarization/Gatekeeper path remains unverified pending the user’s one-time credential setup. The missing-profile failure was verified. See RELEASING.md.