macOS Release Signing (permanent identity)
- Every official macOS release artifact - both
darwin/arm64anddarwin/amd64- is Developer ID Application signed on a macOS runner with a fixed identifier, hardened runtime, secure timestamp, and no entitlements, then strictly verified before it is archived or checksummed; the Linux and Windows release paths are unchanged. - The executable identifier
com.kunchenguid.no-mistakesand Team ID9T2J7MNUP9are the permanent Developer ID identity and MUST NEVER change: they are the invariant of the identity-based designated requirement that lets macOS permission grants surviveno-mistakes update, so changing either resets every grant once. - Signing runs only in the darwin build job gated behind the
release-signingGitHub environment; the certificate is the base64CSC_LINKsecret unlocked withCSC_KEY_PASSWORD, imported into an ephemeral keychain with a runtime-generated password that is deleted on success and failure, and no other job may reference those secrets. - Signing happens before tarball creation and checksum generation, and the verify gate fails the release closed on any missing or ambiguous signature, wrong Team ID, non-permanent identifier, content-based (
cdhash) requirement, missing hardened runtime or timestamp, or wrong architecture. - Mechanics live in
.github/workflows/release.yml; the contract is pinned by the rootTestReleaseWorkflow*static tests inworkflow_release_signing_test.go, and secret values are never recorded here or in any test fixture. - Notarization, stapling, a PKG, Homebrew, and universal binaries are intentionally out of scope for this phase.