From 88780f7701c976034a6f4cbc0d3ce6f4aabaa3cb Mon Sep 17 00:00:00 2001
From: TZGyn <spectator_brethren761@slmails.com>
Date: Thu, 8 Oct 2026 10:06:25 +0800
Subject: [PATCH] Fail the release script when notarization does not happen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A missing key or a skipped notarization used to exit 0 with a sha256,
which made an unnotarized build look publishable. Releases now fail
loudly unless spctl confirms a notarized build, and the skip flag warns
that its output must not be published.

💘 Generated with Crush

Assisted-by: Crush:kimi-k3
---
 AGENTS.md  | 27 +++++++++++++++++++--------
 release.sh | 24 ++++++++++++++++--------
 2 files changed, 35 insertions(+), 16 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 937b273..9353567 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -105,15 +105,26 @@ Bundle id is `dev.tzgyn.prompt`.
 
 ## Release process
 
-1. `./release.sh <version>` — builds, zips `Prompt.app` to `dist/Prompt.zip`,
-   and prints its sha256 (it does not tag or upload). Notarizes when the
-   `PROMPT_NOTARY_*` env vars (or the shared Kapture App Store Connect key at
-   `~/.config/kapture/AuthKey_K5KXMMSB28.p8`) are present; set
-   `PROMPT_SKIP_NOTARY=1` to skip.
+Notarization is **required**: an unnotarized build is not a release. Never
+publish one, and never suggest quarantine workarounds (`xattr -dr
+com.apple.quarantine`, `brew install --cask --no-quarantine`). `release.sh`
+enforces this — it fails if it cannot notarize, and refuses to print a sha256
+unless `spctl` reports `source=Notarized Developer ID`. `PROMPT_SKIP_NOTARY=1`
+exists only for a local dev build and prints a "NOT FOR PUBLICATION" warning.
+
+1. `./release.sh <version>` — builds, notarizes, staples, zips `Prompt.app` to
+   `dist/Prompt.zip`, and prints its sha256 (it does not tag or upload). Uses
+   the `PROMPT_NOTARY_*` env vars, defaulting to the shared Kapture App Store
+   Connect key at `~/.config/kapture/AuthKey_K5KXMMSB28.p8`.
 2. Commit and push `main`.
-3. `tea releases create --tag v<version> --asset dist/Prompt.zip --repo TZGyn/prompt --login gitea.tzgyn.dev`.
-4. Bump `version`/`sha256` in `~/.cache/homebrew-tap/Casks/prompt.rb`, push,
-   then `git -C /opt/homebrew/Library/Taps/tzgyn/homebrew-tap pull --ff-only`.
+3. `tea releases create --tag v<version> --title "Prompt <version>" --note "<what changed>" --asset dist/Prompt.zip --repo TZGyn/prompt --login gitea.tzgyn.dev`.
+4. Add/update `~/.cache/homebrew-tap/Casks/prompt.rb` (`version` + `sha256`),
+   push the tap, then
+   `git -C /opt/homebrew/Library/Taps/tzgyn/homebrew-tap pull --ff-only` and
+   `brew audit --cask tzgyn/tap/prompt`.
+5. Verify by downloading the release asset back, comparing the sha256 with the
+   cask, and unzipping with `ditto -x -k` (not `unzip`, which adds `._*` files
+   and breaks the signature check) then `spctl -a -vv Prompt.app`.
 
 **Always print the upgrade script after any release or version bump:**
 
diff --git a/release.sh b/release.sh
index 6896031..57bf480 100755
--- a/release.sh
+++ b/release.sh
@@ -23,7 +23,8 @@ ditto -c -k --keepParent Prompt.app dist/Prompt.zip
 
 if [ -n "${PROMPT_SKIP_NOTARY:-}" ]; then
     echo
-    echo "Skipping notarization (PROMPT_SKIP_NOTARY set)."
+    echo "!! NOTARIZATION SKIPPED — this zip is NOT FOR PUBLICATION."
+    echo "!! It is signed but Gatekeeper will reject it on other Macs."
     shasum -a 256 dist/Prompt.zip
     exit 0
 fi
@@ -34,15 +35,16 @@ PROMPT_NOTARY_API_KEY_ID="${PROMPT_NOTARY_API_KEY_ID:-K5KXMMSB28}"
 PROMPT_NOTARY_API_ISSUER="${PROMPT_NOTARY_API_ISSUER:-3e25e5dc-8b75-453f-a71c-c7f3feaac628}"
 
 if [ ! -f "$PROMPT_NOTARY_API_KEY_PATH" ]; then
-    echo "Notarization skipped — key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
-    shasum -a 256 dist/Prompt.zip
-    exit 0
+    echo "ERROR: notarization key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
+    echo "Notarization is required for a release; set PROMPT_SKIP_NOTARY=1 only" >&2
+    echo "for a local dev build that must not be published." >&2
+    exit 1
 fi
 
 if ! command -v xcrun >/dev/null 2>&1 || ! xcrun --find notarytool >/dev/null 2>&1; then
-    echo "Notarization skipped — xcrun notarytool not found (requires Xcode 13+)." >&2
-    shasum -a 256 dist/Prompt.zip
-    exit 0
+    echo "ERROR: xcrun notarytool not found (requires Xcode 13+)." >&2
+    echo "Notarization is required for a release." >&2
+    exit 1
 fi
 
 echo "Submitting to Apple for notarization (first run can take minutes)..."
@@ -69,6 +71,12 @@ xcrun stapler validate Prompt.app
 rm -f dist/Prompt.zip
 ditto -c -k --keepParent Prompt.app dist/Prompt.zip
 
+if ! spctl -a -vv Prompt.app 2>&1 | grep -q "source=Notarized Developer ID"; then
+    echo "ERROR: spctl does not report a notarized build — do not publish this." >&2
+    spctl -a -vv Prompt.app >&2
+    exit 1
+fi
+
 echo
-echo "Done — notarized."
+echo "Done — notarized and stapled."
 shasum -a 256 dist/Prompt.zip