Merge remote-tracking branch 'origin/develop' into develop

fix(packaging): skip notarization entirely for ad-hoc builds
Notarization requires a Developer ID signature. When CODESIGN_IDENTITY is unset/"-" or any NOTARIZE_* secret is missing, exit the script without printing a misleading "skipping" line — the DMG is already usable. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-10 09:27:44 +01:00 · 2026-09-10 09:24:39 +01:00 · 2026-09-10 08:57:35 +01:00 · 2026-09-10 08:57:28 +01:00 · 2026-09-10 08:57:23 +01:00 · 2026-09-10 08:57:20 +01:00
1 changed files with 5 additions and 4 deletions
@@ -132,8 +132,11 @@ dmgbuild -s scripts/dmgbuild-settings.py "$VOLUME_NAME" "$DMG"

 echo "DMG: $PWD/$DMG"

-# Optional notarization/stapling when credentials are present.
-if [ -n "${NOTARIZE_APPLE_ID:-}" ] && \
+# Notarization requires a Developer ID signature. If the app was ad-hoc
+# signed or any notarization secret is missing, skip silently — the DMG is
+# still usable for local/testing installs.
+if [ -n "${CODESIGN_IDENTITY:-}" ] && [ "$CODESIGN_IDENTITY" != "-" ] && \
+   [ -n "${NOTARIZE_APPLE_ID:-}" ] && \
   [ -n "${NOTARIZE_PASSWORD:-}" ] && \
   [ -n "${APPLE_TEAM_ID:-}" ]; then
    echo "==> Submitting $DMG for notarization"
@@ -144,6 +147,4 @@ if [ -n "${NOTARIZE_APPLE_ID:-}" ] && \
        --wait
    xcrun stapler staple "$DMG"
    echo "==> Stapled $DMG"
-else
-    echo "==> Notarization credentials not set; skipping"
 fi
Author	SHA1	Message	Date
gronod	43d35515e1	Merge remote-tracking branch 'origin/develop' into develop macOS CI / build-and-test (push) Failing after 17m16s Details macOS CI / package (push) Skipped Details	2026-09-10 09:27:44 +01:00
gronodandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	a110eb81e6	fix(packaging): skip notarization entirely for ad-hoc builds Notarization requires a Developer ID signature. When CODESIGN_IDENTITY is unset/"-" or any NOTARIZE_* secret is missing, exit the script without printing a misleading "skipping" line — the DMG is already usable. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-10 09:24:39 +01:00
gronodandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	65457b903e	ci(macos): restore workflow, fix test signing and packaging (#32 ) macOS CI / package (pull_request) Canceled after 0s Details macOS CI / build-and-test (pull_request) Canceled after 49s Details - Keep CI active on develop (push + PR) and tags v. - Generate the project with `xcodegen generate --spec project.yml`. - build-for-testing / test-without-building share one derivedDataPath, destination, universal archs, and ad-hoc signing flags. The XCTest runner is never re-signed with --options runtime. - Package job runs package-release.sh after tests pass and uploads the ICCery-.dmg the script actually writes. - README documents the env vars the pipeline reads. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-10 08:57:35 +01:00
gronodandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	62eb5730a9	fix(packaging): use fixed derived-data path, correct sign/verify flow package-release.sh previously parsed -showBuildSettings for the app path, which could disagree with the actual build. Now use a single derivedDataPath and locate Release/ICCery.app directly. Add Developer ID signing with --timestamp and a post-sign verify, while leaving sidecars ad-hoc. Re-verify sidecars after app signing and re-ad-hoc any that were stripped. Install dmgbuild in a venv and use DMG_APP env. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-10 08:57:28 +01:00
gronodandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	5379b4a94f	fix(packaging): stage the built .app into the DMG (#32 ) dmgbuild never set `files`, so the volume mounted empty. Export DMG_APP from package-release.sh and require it in dmgbuild-settings.py, copying the bundle by its source path. Keep the Applications symlink and the optional background fallback. Verified by mounting a test image and seeing ICCery.app + Applications. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-10 08:57:23 +01:00
gronodandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	a2243be298	fix(packaging): make sidecar sign/verify recursive (#32 , #165 ) The Argyll tree inside the bundle is nested (macos-universal/, mocks/), so a top-level-only scan left real binaries unverified. Scan recursively under Contents/Resources/Argyll, hard-fail on any unsigned Mach-O or a missing/empty sidecar dir, and sign fetched tools recursively too. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-10 08:57:20 +01:00