From 5c1eb47740af042801b8c4ea955a9f3106db58a0 Mon Sep 17 00:00:00 2001 From: amosblomqvist Date: Fri, 9 Oct 2026 07:59:32 +0300 Subject: [PATCH] packaging: signing + notarization + zip target + GitHub Releases feed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-10-08 flip, verified end-to-end (notarized build accepted, stapled, spctl clean): Developer ID auto-detect, LH_NOTARY keychain profile, zip + blockmap beside the DMG for Squirrel.Mac, publish block pointing at GitHub Releases (repo goes public before 0.3.0; builds never auto-upload — publishing is a release-time act). --- electron-builder.yml | 35 ++++++++++++++++++++++++++++------- next-env.d.ts | 4 ++-- package.json | 2 +- 3 files changed, 31 insertions(+), 10 deletions(-) diff --git a/electron-builder.yml b/electron-builder.yml index 0e3f4ef..a79c196 100644 --- a/electron-builder.yml +++ b/electron-builder.yml @@ -6,9 +6,9 @@ # because native .node/dylib can't dlopen from a read-only archive and # server.js process.chdir()s into its own dir; # - the asar holds only the shell (electron/main.cjs + package.json); -# - signing/notarization config is laid now but inert until a Developer -# ID certificate exists (identity: null = unsigned local build, which -# runs fine for personal use — Gatekeeper only gates quarantined apps). +# - signed + notarized since 2026-10-08 (Developer ID Application cert in +# the login keychain; notary credentials in the LH_NOTARY keychain +# profile; the profile + team env vars are baked into desktop:dist). appId: com.learnharness.LearnHarness productName: LearnHarness directories: @@ -55,10 +55,16 @@ extraResources: filter: - "standalone/**/*" mac: + # zip rides next to dmg (flipped 2026-10-08): Squirrel.Mac — Electron's + # macOS auto-updater — installs from ZIP and cannot read DMGs. DMG is + # for humans; ZIP + blockmap are the updater's payload. target: - target: dmg arch: - arm64 + - target: zip + arch: + - arm64 # Locale trim (payload wave, 2026-09-24): English-only app — cuts # every non-en .lproj from the frameworks (the STT/mic entitlements # don't depend on locales). Revisit only if localization ever lands. @@ -71,8 +77,23 @@ mac: NSMicrophoneUsageDescription: "LearnHarness uses the microphone only for speech-to-text input into your sessions." hardenedRuntime: true entitlements: build/entitlements.mac.plist - # Unsigned until a Developer ID certificate exists (research-confirmed: - # local builds run fine; distribution needs signing + notarization). - identity: null + # Signing + notarization (flipped 2026-10-08): identity auto-detects the + # Developer ID Application certificate from the login keychain; + # notarize: true makes electron-builder sign → submit to Apple's notary + # service → staple the ticket, all inside this one build (credentials + # via the LH_NOTARY keychain profile, env baked into desktop:dist). + # Adds minutes per build (Apple's scan queue). Verification battery: + # codesign --verify --deep / spctl --assess / stapler validate. + notarize: true dmg: - title: "${productName} ${version}" \ No newline at end of file + title: "${productName} ${version}" +publish: + # Update feed = GitHub Releases (decided 2026-10-08): latest-mac.yml + + # zip/blockmap live on releases; electron-updater reads them anonymously. + # REQUIRES THE REPO TO BE PUBLIC before 0.3.0 ships — anonymous downloads + # from a private repo are impossible, and a token baked into the app + # would be a leak. desktop:dist passes no --publish flag, so builds never + # upload; publishing happens at release time (GH_TOKEN + --publish). + - provider: github + owner: amosblomqvist + repo: learnharness \ No newline at end of file diff --git a/next-env.d.ts b/next-env.d.ts index ce4e94a..a419cbe 100644 --- a/next-env.d.ts +++ b/next-env.d.ts @@ -1,7 +1,7 @@ /// /// -import "./.next/types/routes.d.ts"; -import "./.next/types/root-params.d.ts"; +import "./.next/dev/types/routes.d.ts"; +import "./.next/dev/types/root-params.d.ts"; // NOTE: This file should not be edited // see https://nextjs.org/docs/app/api-reference/config/typescript for more information. diff --git a/package.json b/package.json index 5149919..da0c50f 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,7 @@ "typecheck": "tsc --noEmit", "desktop:dev": "concurrently -k \"next dev\" \"LH_DEV_URL=http://localhost:3000 electron .\"", "dev:fresh": "bash scripts/dev-fresh.sh", - "desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/build-server.mjs && node scripts/smoke-server.mjs && electron-builder --mac --arm64" + "desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/build-server.mjs && node scripts/smoke-server.mjs && APPLE_KEYCHAIN_PROFILE=LH_NOTARY APPLE_TEAM_ID=JS6XN22HY6 electron-builder --mac --arm64" }, "dependencies": { "@earendil-works/pi-agent-core": "1.0.2",