[6C7-66] Package signed/notarized macOS Intel + Apple Silicon desktop builds

[luinbytes]

Linear migration

Original Linear issue: 6C7-66
Original status: In Progress
Priority: Urgent
Milestone: M6 · Packaging, Hardening & v1 Parity Gate
Parent: 6C7-65

Goal

Produce reproducible macOS x86_64 and arm64 application bundles, plus a universal distribution option if practical. Bundle/supervise the Rust server, declare permissions correctly, handle app-data paths, sign/notarize release artifacts, and verify first-run/provider discovery on clean Intel and Apple Silicon machines.

Acceptance criteria

• Developer ID signing succeeds with the real release identity.
• Apple notarization is accepted.
• Notarization ticket is stapled and validated.
• Gatekeeper accepts the final artifact.
• Checksummed release artifacts and manifest are produced.
• Clean Intel Mac first-run/install validation passes.
• Clean Apple Silicon Mac first-run/install validation passes.
• Bundled server lifecycle and provider discovery work on both architectures.

Important boundary

Automated packaging/notarization tooling is implemented and can be CI-verified, but this issue must remain open until genuine Developer ID/notary credentials and clean physical Intel/Apple Silicon acceptance evidence exist. Do not substitute ad-hoc signing or fixture evidence.

Source: https://linear.app/6c75/issue/6C7-66/package-signednotarized-macos-intel-apple-silicon-desktop-builds

[luinbytes]

23 August 2026 release-host inventory

This environment cannot close macOS release acceptance. Verified facts:

• host: macOS 15.7.7, Intel x86_64
• security find-identity -v -p codesigning: 0 valid identities
• no Developer ID Application identity or stored notary profile is available
• no clean Apple Silicon Mac is available
• this Intel host is a development machine, not the required clean-install/first-run host

CI has verified both architecture bundles, manifests, checksums, and the fail-closed notarization pipeline, but its ad-hoc signing is not release evidence. No checkbox is changed.

Required release-host commands

On each clean Intel/Apple Silicon release host, from an exact clean main candidate:

export HOMEBOT_VERSION=1.0.0
export HOMEBOT_CANDIDATE_SHA="$(git rev-parse HEAD)"
test -z "$(git status --porcelain)"
test "$(git branch --show-current)" = main
xcrun notarytool store-credentials homebot-v1-notary
export HOMEBOT_SIGN_IDENTITY="Developer ID Application: ORGANISATION (TEAMID)"
export HOMEBOT_NOTARY_PROFILE=homebot-v1-notary
export HOMEBOT_REQUIRE_RELEASE_SIGNING=1
export HOMEBOT_TARGET="$(case "$(uname -m)" in x86_64) echo x86_64-apple-darwin;; arm64) echo aarch64-apple-darwin;; *) exit 2;; esac)"
export HOMEBOT_OUTPUT_DIR="$PWD/dist"
cargo build --release --target "$HOMEBOT_TARGET" -p homebot-server -p homebot-desktop
./scripts/package-macos.sh

Then independently run checksum verification, codesign --verify --deep --strict --verbose=2, xcrun stapler validate, spctl --assess --type execute --verbose=2, JSON validation, and the clean first-run/bundled-server/provider-discovery checklist in docs/release-acceptance.md. Record artifact hashes, notary request/status, authority/team/identifier, Gatekeeper outcome, OS/architecture, and UTC timestamps without credentials.

[luinbytes]

PR #76 merged the source and packaging plumbing at e869841. The exact PR head passed every CI lane: https://github.com/luinbytes/HomeBot/actions/runs/33106395232\n\nNo acceptance checkbox changed. This issue still requires a real release candidate signed with Developer ID, Apple notarization and stapling, Gatekeeper verification, checksummed artifacts, and clean first-run/install validation on both Intel and Apple Silicon Macs, including bundled server and provider discovery.