Release Guide

This guide covers the local release build, optional Developer ID signing, and optional notarization flow.

Local Validation

Run:

./scripts/check.sh

This runs the unit test suite, builds build/ClipBored.app, applies an ad-hoc hardened-runtime signature, enforces the 2 MiB executable and bundle size gates, and verifies the app signature.

Local Archive

Run:

./scripts/release-macos-app.sh

Without signing credentials, this creates:

build/ClipBored.app
build/ClipBored.zip

The app remains ad-hoc signed and is suitable for local validation only.

Developer ID Signing

Set a Developer ID Application identity:

export DEVELOPER_ID_APPLICATION="Developer ID Application: Example, Inc. (TEAMID)"
./scripts/release-macos-app.sh

The script rebuilds the app, re-signs it with hardened runtime and timestamping, verifies the signature, and writes build/ClipBored.zip.

iCloud Sync Entitlements

The default local and release scripts do not add iCloud entitlements. Sync history with iCloud will report unavailable in those builds. To ship iCloud Sync, sign with an entitlement file that grants the app's ubiquity container, then repeat the signature, smoke, and notarization checks.

Notarization

Preferred: configure a notarytool keychain profile once:

xcrun notarytool store-credentials "clipbored-notary" \
  --apple-id "developer@example.com" \
  --team-id "TEAMID" \
  --password "app-specific-password"

Then run:

export DEVELOPER_ID_APPLICATION="Developer ID Application: Example, Inc. (TEAMID)"
export NOTARYTOOL_PROFILE="clipbored-notary"
./scripts/release-macos-app.sh

Alternative environment-only notarization:

export DEVELOPER_ID_APPLICATION="Developer ID Application: Example, Inc. (TEAMID)"
export APPLE_ID="developer@example.com"
export APPLE_TEAM_ID="TEAMID"
export APPLE_APP_SPECIFIC_PASSWORD="app-specific-password"
./scripts/release-macos-app.sh

When notarization succeeds, the script staples the ticket to build/ClipBored.app, validates the staple, and recreates build/ClipBored.zip.

Final Manual Checks

Before publishing, run the checklist in SMOKE_TEST.md, then confirm:

codesign --verify --deep --strict --verbose=2 build/ClipBored.app
xcrun stapler validate build/ClipBored.app
spctl --assess --type execute --verbose=4 build/ClipBored.app

2.4 KiB Raw Blame History