mag/KMix_Pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated release script with zsh guard and ony dmg in dist directory

Browse Source
This commit is contained in:
Mark Gregory
2026-11-03 15:30:17 +00:00
parent f23278eaa6
commit c35dd4b20e
4 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RELEASING.md
+5 -7
View File
@@ -28,13 +28,9 @@ If you already have a profile with a different name, use that name through `KJMI
The script builds Release, stages a copy, signs the app with Developer ID and hardened runtime, submits it to Apple, checks Accepted status, staples/validates its ticket, and checks app Gatekeeper assessment. It then creates the compressed DMG with the colourful app/volume/file icon and Applications shortcut, signs and notarizes the DMG, staples/validates its ticket, checks its Gatekeeper assessment and mounts the finished image to recheck the enclosed app. A fresh-Mac launch/install check is still recommended before public distribution.
Outputs are versioned, for example:
The only file in dist is the current versioned DMG, for example `dist/KJMixPro-0.6.4-macOS.dmg`. After all checks pass, old DMGs, ZIPs, checksum sidecars and other output entries are removed. Reports and SHA-256 are kept outside dist under `build-release/release-verification/KJMixPro-0.6.4-macOS/`. The temporary ZIP required for app notarization stays in the private staging folder and is removed automatically.
- `dist/KJMixPro-0.6.4-macOS.dmg`
- `dist/KJMixPro-0.6.4-macOS.zip` (stapled app)
- SHA-256 sidecars and `dist/KJMixPro-0.6.4-macOS-verification/` reports
The script publishes these files only after the checks succeed. A failed run returns nonzero and never labels that attempt Gatekeeper verified. Existing files from earlier builds can remain in dist; check the current report and successful script completion.
The script publishes the DMG and cleans old output only after the checks succeed. A failed run retains the existing distribution, returns nonzero and never labels that attempt Gatekeeper verified.
You can configure another saved profile or signing identity without editing the script:
@@ -52,6 +48,8 @@ The script auto-selects a Developer ID identity if all available matching certif
./scripts/release.sh --unsigned
```
These modes have clearly marked filenames and status reports. **They are not notarized or Gatekeeper verified.** Signed-only does not need notarization credentials. Unsigned creates the compatibility ZIP as well. Neither mode changes Gatekeeper settings or bypasses macOS security.
These modes have clearly marked filenames and status reports. **They are not notarized or Gatekeeper verified.** Signed-only does not need notarization credentials. Both modes also keep only their current DMG in dist. Neither mode changes Gatekeeper settings or bypasses macOS security.
References: [Apple notarization](https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution), [packaging for distribution](https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution).
Run `./scripts/release.sh` or `bash ./scripts/release.sh`; do not source it into your interactive shell. Notarization uses `notary_status`, avoiding zsh’s read-only `status` variable.