feat(release): code-sign + notarize binaries (macOS notarization, Windows Authenticode) [follow-up] #408

New issue

Open

opened 2026-08-17 15:44:20 +00:00 by hexajon · 2 comments

hexajon commented

2026-08-17 15:44:20 +00:00

Owner

Sign and notarize the release binaries, so the raw download and madtea install path is friction-free on macOS and Windows (no Gatekeeper or SmartScreen wall). This is a public-launch investment. It does NOT block the epic.

Scope

Apple notarization and Windows Authenticode, both integrated into the release pipeline. Per ADR 0010 (deferred) and ADR 0012 (signing/TOFU covers the update path; this issue is first-install trust).

Acceptance Criteria

A freshly downloaded release binary runs on macOS and Windows without a Gatekeeper or SmartScreen block.

Sign and notarize the release binaries, so the raw download and `madtea install` path is friction-free on macOS and Windows (no Gatekeeper or SmartScreen wall). This is a public-launch investment. It does NOT block the epic. ## Scope Apple notarization and Windows Authenticode, both integrated into the release pipeline. Per ADR 0010 (deferred) and ADR 0012 (signing/TOFU covers the update path; this issue is first-install trust). ## Acceptance Criteria - [ ] A freshly downloaded release binary runs on macOS and Windows without a Gatekeeper or SmartScreen block.

hexajon added the

enhancement

status/blocked

labels

2026-08-17 15:44:20 +00:00

hexajon commented

2026-08-17 15:44:27 +00:00

Author

Owner

Parked, and blocked on signing identities I have to buy, not on code.

Apple notarization needs an Apple Developer account plus a Developer ID certificate. Windows Authenticode needs a code-signing certificate, ideally EV for SmartScreen reputation. Both are purchases or enrollments, so nothing here is a code problem. The integration is also publish-coupled: ADR 0010 defers it, and ADR 0012 already covers update-path trust with GPG plus TOFU. This issue is first-install trust only.

The work is ready to execute once the certificates exist. goreleaser has first-class hooks for both paths: the macOS notarize config (or codesign plus xcrun notarytool), and Windows through osslsigncode or Azure Trusted Signing. No action until I procure the identities and the launch sequence schedules the work.

Parked, and blocked on signing identities I have to buy, not on code. Apple notarization needs an Apple Developer account plus a Developer ID certificate. Windows Authenticode needs a code-signing certificate, ideally EV for SmartScreen reputation. Both are purchases or enrollments, so nothing here is a code problem. The integration is also publish-coupled: ADR 0010 defers it, and ADR 0012 already covers update-path trust with GPG plus TOFU. This issue is first-install trust only. The work is ready to execute once the certificates exist. goreleaser has first-class hooks for both paths: the macOS `notarize` config (or `codesign` plus `xcrun notarytool`), and Windows through osslsigncode or Azure Trusted Signing. No action until I procure the identities and the launch sequence schedules the work.

hexajon commented

2026-08-17 15:44:30 +00:00

Author

Owner

This is not pre-launch. The public launch ships unsigned binaries. Certificate procurement and signing happen after launch. The pre-launch gate set is whatever carries the release-prep label.

This is not pre-launch. The public launch ships unsigned binaries. Certificate procurement and signing happen after launch. The pre-launch gate set is whatever carries the `release-prep` label.

hexajon referenced this issue

2026-08-17 15:57:34 +00:00

feat(install): add a winget channel [follow-up, needs signed installer] #409

hexajon referenced this issue

2026-08-17 15:58:18 +00:00

feat(install): add a winget channel [follow-up, needs signed installer] #409

hexajon added a new dependency

2026-08-17 15:59:08 +00:00

#409 feat(install): add a winget channel [follow-up, needs signed installer]