TZGyn/prompt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 20 Wiki Activity

Fail the release script when notarization does not happen

Browse Source 
A missing key or a skipped notarization used to exit 0 with a sha256,
which made an unnotarized build look publishable. Releases now fail
loudly unless spctl confirms a notarized build, and the skip flag warns
that its output must not be published.

💘 Generated with Crush

Assisted-by: Crush:kimi-k3
This commit is contained in:
TZGyn
2026-10-08 10:06:25 +08:00
parent 466c49e4b0
commit 88780f7701
2 changed files with 35 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release.sh
+16 -8
View File
@@ -23,7 +23,8 @@ ditto -c -k --keepParent Prompt.app dist/Prompt.zip
if [ -n "${PROMPT_SKIP_NOTARY:-}" ]; then
echo
echo "Skipping notarization (PROMPT_SKIP_NOTARY set)."
echo "!! NOTARIZATION SKIPPED — this zip is NOT FOR PUBLICATION."
echo "!! It is signed but Gatekeeper will reject it on other Macs."
shasum -a 256 dist/Prompt.zip
exit 0
fi
@@ -34,15 +35,16 @@ PROMPT_NOTARY_API_KEY_ID="${PROMPT_NOTARY_API_KEY_ID:-K5KXMMSB28}"
PROMPT_NOTARY_API_ISSUER="${PROMPT_NOTARY_API_ISSUER:-3e25e5dc-8b75-453f-a71c-c7f3feaac628}"
if [ ! -f "$PROMPT_NOTARY_API_KEY_PATH" ]; then
echo "Notarization skipped — key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
shasum -a 256 dist/Prompt.zip
exit 0
echo "ERROR: notarization key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
echo "Notarization is required for a release; set PROMPT_SKIP_NOTARY=1 only" >&2
echo "for a local dev build that must not be published." >&2
exit 1
fi
if ! command -v xcrun >/dev/null 2>&1 || ! xcrun --find notarytool >/dev/null 2>&1; then
echo "Notarization skipped — xcrun notarytool not found (requires Xcode 13+)." >&2
shasum -a 256 dist/Prompt.zip
exit 0
echo "ERROR: xcrun notarytool not found (requires Xcode 13+)." >&2
echo "Notarization is required for a release." >&2
exit 1
fi
echo "Submitting to Apple for notarization (first run can take minutes)..."
@@ -69,6 +71,12 @@ xcrun stapler validate Prompt.app
rm -f dist/Prompt.zip
ditto -c -k --keepParent Prompt.app dist/Prompt.zip
if ! spctl -a -vv Prompt.app 2>&1 | grep -q "source=Notarized Developer ID"; then
echo "ERROR: spctl does not report a notarized build — do not publish this." >&2
spctl -a -vv Prompt.app >&2
exit 1
fi
echo
echo "Done — notarized."
echo "Done — notarized and stapled."
shasum -a 256 dist/Prompt.zip