ci(desktop): notarize and staple the macOS DMG - #194
Merged
Conversation
electron-builder notarizes and staples the .app but not the disk image around it. A quarantined, unnotarized DMG is what Gatekeeper reports as "Pythinker.app is damaged and can't be opened" for browser downloads. Submit the DMG to notarytool, staple it, and gate the release on "spctl --assess --type open" accepting the image itself.
elkaix
enabled auto-merge (squash)
August 25, 2026 19:46
commit: |
elkaix
added a commit
that referenced
this pull request
Aug 25, 2026
## Problem Desktop 0.3.1 shipped an unnotarized DMG that macOS reports as "Pythinker.app is damaged". #194 fixed the release pipeline; a new version is needed to ship it. ## What changed `apps/desktop/package.json` 0.3.1 → 0.3.2. After merge, tag `desktop-v0.3.2` on the merge commit to cut the release. [skip changeset] — desktop app versions are not managed by changesets. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the desktop application to version 0.3.2. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
elkaix
added a commit
that referenced
this pull request
Aug 25, 2026
## Problem `desktop-v0.3.2` failed at **Verify macOS update artifacts**: `Pythinker-0.3.2-arm64.dmg size does not match latest-mac.yml`. The notarize step from #194 stapled the DMG after electron-builder had written the manifest, so size/sha512 (and the `.dmg.blockmap`) went stale. Notarization itself succeeded. ## What changed - The workflow now runs `apps/desktop/scripts/finalize-mac-artifacts.ts` (already used by `dist:mac`, covered by `tests/finalize-mac-artifacts.spec.ts`): notarytool submit → staple → rewrite the DMG entry in `latest-mac.yml` → drop the stale blockmap (full download instead of differential; the zip still has its blockmap). - Added a CLI entry to that script (`finalize-mac-artifacts.ts <dist-dir>`), same pattern as the other release scripts. - Removed the hand-written shell step it replaces. The DMG-level `stapler validate` + `spctl --type open` gate stays. After merge, `desktop-v0.3.2` will be re-tagged on the merge commit (0.3.2 was never published). [skip changeset] — CI-only. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved macOS release artifact finalization, including notarization and stapling. - Updated release manifests automatically and removed stale blockmap files. - Improved error handling so release failures are reported clearly and return a failure status. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users downloading
Pythinker-0.3.1-arm64.dmgfrom the site see "Pythinker.app is damaged and can't be opened". The app bundle inside is signed, notarized and stapled, but the DMG itself only carries a Developer ID signature:spctl --assess --type openreportsrejected, Unnotarized Developer ID. Gatekeeper on recent macOS surfaces that for quarantined browser downloads as "damaged".What changed
Notarize and staple macOS DMGstep:xcrun notarytool submit --wait(API key preferred, Apple ID fallback — the same credentials electron-builder already uses) thenstapler staplethe image.stapler validateandspctl --assess --type open --context context:primary-signatureon the DMG, so a release can no longer ship an unnotarized image. Checked locally: this gate fails on the current 0.3.1 DMG.[skip changeset] — CI-only, no user-visible package change.