mag/KMix_Pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated release script with zsh guard and ony dmg in dist directory

Browse Source
This commit is contained in:
Mark Gregory
2026-11-03 15:30:17 +00:00
parent f23278eaa6
commit c35dd4b20e
4 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/VERIFICATION.md
+3 -1
View File
@@ -8,7 +8,7 @@ Verified on 3 November 2026.
- Release builds both arm64 and x86_64. Source ZIP includes canonical KJMix Pro.xcodeproj/project.pbxproj and shared scheme, source, tests, executable scripts, icon assets and original test media only.
- ZIP CRC checks, extracted file hashes and extracted Xcode project listing are checked during packaging. Personal media, library databases, invitations, bookmarks and user settings are excluded.
The production DMG and app ZIP are Developer ID signed, notarized and stapled; explicit local preview modes remain unnotarized. Intel/older macOS runtime, broad commercial media, hardware/display latency, large-library show stress and every native drag/keyboard interaction are not exhaustively validated. Music-store profiles/catalogue imports are not provider purchase or subscription integrations. See README.md for feature limits.
The production DMG and its enclosed app are Developer ID signed, notarized and stapled; explicit local preview modes remain unnotarized. Intel/older macOS runtime, broad commercial media, hardware/display latency, large-library show stress and every native drag/keyboard interaction are not exhaustively validated. Music-store profiles/catalogue imports are not provider purchase or subscription integrations. See README.md for feature limits.
The complete operating-system drag gesture is not automated end to end. Drop payload delivery and ordering are tested with real NSItemProviders, and visible reorder arrows provide an independently mouse-tested alternative.
@@ -25,3 +25,5 @@ Batch waveform checks verify cache reuse versus forced regeneration, deduplicati
The release script now creates a compressed DMG with the approved app icon as both its volume icon and Finder file icon, plus an Applications shortcut. A real `--signed-only` run succeeded with the installed Developer ID Application identity and hardened runtime. DMG checksum, mounted contents, custom icon flag, app/volume artwork matching, app signature and disk-image signature were verified. Gatekeeper assessments of both app and DMG explicitly returned `Unnotarized Developer ID`; this output is **not** a Gatekeeper-verified release.
The normal release mode is fail-closed: it requires a valid notarytool Keychain profile, notarizes/staples the app and DMG, and requires Gatekeeper success for both the image and mounted app before publishing verified filenames. The missing-profile failure was verified before credential setup. After the `KJMixPro` profile was configured, Apple accepted both the app and DMG, both tickets were stapled and validated, and Gatekeeper accepted the final DMG and mounted app as `Notarized Developer ID`. The app also passed `syspolicy_check distribution`. An independent final check confirmed the downloadable DMG/app tickets, extracted ZIP app signature, ZIP integrity and download SHA-256 hashes. See RELEASING.md.
The release script now keeps only the current DMG in dist. Reports/checksums are written under build-release/release-verification, and old outputs are removed only after the new image passes its checks. The notarization result variable is notary_status; Bash/zsh function regressions verified Accepted and Invalid responses without the zsh read-only status error.