fix: sign final macOS disk images

.github/workflows/release.yml

@@ -394,9 +394,16 @@ jobs:
             "release/${version}/GoAgent-${version}-mac-x64.dmg"
             "release/${version}/GoAgent-${version}-mac-arm64.dmg"
           )
+          identity="$(security find-identity -v -p codesigning | awk -F'"' '/Developer ID Application:/ { print $2; exit }')"
+          if [[ -z "$identity" ]]; then
+            echo "Developer ID Application identity is unavailable after packaging." >&2
+            exit 1
+          fi
 
           for dmg in "${dmgs[@]}"; do
             test -f "$dmg" || { echo "Missing packaged DMG: $dmg" >&2; exit 1; }
+            codesign --force --timestamp --sign "$identity" "$dmg"
+            codesign --verify --verbose=2 "$dmg"
             result_file="${dmg}.notary-result.json"
             xcrun notarytool submit "$dmg" \
               --apple-id "$APPLE_ID" \
@@ -438,6 +445,7 @@ jobs:
 
           for dmg in "${dmgs[@]}"; do
             test -f "$dmg" || { echo "Missing packaged DMG: $dmg" >&2; exit 1; }
+            codesign --verify --verbose=2 "$dmg"
             xcrun stapler validate "$dmg"
             spctl --assess --type open --context context:primary-signature --verbose=4 "$dmg"
             hdiutil verify "$dmg"

docs/MACOS_SIGNING_NOTARIZATION.md

@@ -46,23 +46,28 @@ xcrun stapler validate "release/$version/mac-arm64/GoAgent.app"
 xcrun stapler validate "release/$version/mac/GoAgent.app"
 xcrun stapler validate "release/$version/GoAgent-$version-mac-arm64.dmg"
 xcrun stapler validate "release/$version/GoAgent-$version-mac-x64.dmg"
+codesign --verify --verbose=2 "release/$version/GoAgent-$version-mac-arm64.dmg"
+codesign --verify --verbose=2 "release/$version/GoAgent-$version-mac-x64.dmg"
 spctl --assess --type open --context context:primary-signature --verbose=4 "release/$version/GoAgent-$version-mac-arm64.dmg"
 spctl --assess --type open --context context:primary-signature --verbose=4 "release/$version/GoAgent-$version-mac-x64.dmg"
 hdiutil verify "release/$version/GoAgent-$version-mac-arm64.dmg"
 hdiutil verify "release/$version/GoAgent-$version-mac-x64.dmg"
 ```
 
 electron-builder signs and notarizes each application bundle first. The public
-release workflow then submits each final DMG to Apple's notary service, requires
-an `Accepted` result, staples the DMG ticket, and runs all checks above before
-upload. A missing Developer ID signature, a rejected Gatekeeper assessment, a
-missing application or DMG ticket, or a damaged DMG blocks publication.
+release workflow then signs each final DMG with the same Developer ID identity,
+submits it to Apple's notary service, requires an `Accepted` result, staples the
+DMG ticket, and runs all checks above before upload. A missing Developer ID
+signature, a rejected Gatekeeper assessment, a missing application or DMG
+ticket, or a damaged DMG blocks publication.
 
 If notarization is not handled automatically by electron-builder, submit and staple manually:
 
 ```bash
+codesign --force --timestamp --sign "Developer ID Application: YOUR NAME (TEAMID)" "release/$version/GoAgent-$version-mac-arm64.dmg"
 xcrun notarytool submit "release/$version/GoAgent-$version-mac-arm64.dmg" --keychain-profile "$APPLE_KEYCHAIN_PROFILE" --wait
 xcrun stapler staple "release/$version/GoAgent-$version-mac-arm64.dmg"
+codesign --verify --verbose=2 "release/$version/GoAgent-$version-mac-arm64.dmg"
 xcrun stapler validate "release/$version/GoAgent-$version-mac-arm64.dmg"
 spctl --assess --type open --context context:primary-signature --verbose=4 "release/$version/GoAgent-$version-mac-arm64.dmg"
 ```

tests/macos-notarization-release-contract.test.mjs

@@ -14,6 +14,8 @@ test('macOS release notarizes and verifies apps and final DMGs before upload', a
   assert.ok(notarizeStep >= 0)
   assert.ok(verifyStep > notarizeStep)
   assert.ok(uploadStep > verifyStep)
+  assert.match(workflow, /security find-identity -v -p codesigning/)
+  assert.match(workflow, /codesign --force --timestamp --sign "\$identity" "\$dmg"/)
   assert.match(workflow, /xcrun notarytool submit/)
   assert.match(workflow, /report\.status !== "Accepted"/)
   assert.match(workflow, /xcrun stapler staple "\$dmg"/)