build: sign and notarize releases with a Developer ID, from a local script

[hiking90]

Releases were ad-hoc signed, so Gatekeeper blocked both the .pkg and the app, and the install guide had to walk every user through overriding it — on every update. Now that a Developer ID is available, wire real signing and notarization into the build, and publish releases from a local script.

Signing stays off CI — on purpose

The Developer ID private key does not go to GitHub, and this is written into CLAUDE.md as a rule rather than left implicit.

Actions secrets are not zero-knowledge: gh secret set encrypts client-side, but GitHub holds the matching private key because it has to inject the value into runners. And storing it is not even the crux — running codesign on a GitHub-hosted runner unwraps the key into a VM we do not control, whether or not the .p12 was ever a secret. If that key leaked and Apple revoked the certificate, already-installed copies of Ongeul would be blocked by Gatekeeper on users' machines — the blast radius reaches people who never updated.

An earlier revision of this branch did wire certificates into Actions (temporary keychain, release environment, SHA-pinned actions). That is all removed. Nothing was ever uploaded — no secrets are configured on the repo.

release.yml now only deploys the versioned docs for the tag and holds no secrets.

Releasing

git tag v0.4.0-rc1 && git push origin v0.4.0-rc1   # docs deploy only
./scripts/release.sh v0.4.0-rc1                    # build → sign → notarize → publish

scripts/release.sh front-loads everything that can fail — tools, signing environment, clean tree, tag pushed and pointing at HEAD, no existing release — because signing and notarization take minutes and none of that should surface late. spctl gates publication, so a build that skipped notarization cannot ship. Tags containing - publish as pre-releases, which the old workflow did not do, so an rc no longer takes over "Latest".

scripts/package.sh and scripts/build.sh sign with ONGEUL_SIGN_ID plus hardened runtime (a notarization prerequisite) and fall back to ad-hoc when unset, so the dev loop needs no credentials. The .pkg is signed separately with ONGEUL_INSTALLER_ID — a different certificate; signing only the app still gets blocked at install time. notarytool --wait does not reliably exit non-zero on rejection, so the status is read out of the JSON and the log dumped before failing.

Also in here

• -O -wmo. swiftc had no optimization flag, so the shipped Swift layer was built at -Onone while the Rust engine used --release. The CGEventTap callback runs on every key event. A full build still takes under 10 seconds, so debug and release are not split — what you run locally is what ships.
• -file-prefix-map. A Swift runtime trap printed /Volumes/Workspace/rust/ongeul/... verbatim. That was tolerable while releases came off a CI runner; now that they are built locally it is the maintainer's home directory layout. Verified: no /Users/ or /Volumes/ strings remain in the binary.
• Info.plist 0.2.0 → 0.4.0. package.sh overwrites this from the tag but build.sh does not, so local builds were reporting a two-releases-stale version in the preferences panel.
• Docs. The Gatekeeper override procedure is gone from the install guide (along with its two now-unreferenced screenshots), replaced by a note that 0.4.0 is signed and notarized. Troubleshooting gains an entry for the one-time TCC reset: Accessibility and Input Monitoring grants are keyed to the code signature, so moving from ad-hoc to Developer ID invalidates them once — and they survive updates from 0.4.0 onward, which is an improvement over the status quo the old docs described.

Verified

End-to-end on this machine, against a real 0.4.0-rc1 package:

=== [7/7] Notarization ===
    Status: Accepted

$ spctl -a -vvv -t install build/Ongeul-0.4.0-rc1.pkg
build/Ongeul-0.4.0-rc1.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: JeongHoe Kim (5KH893KQQW)

App signature carries flags=0x10000(runtime) and a trusted timestamp; codesign --verify --strict --deep passes; the binary is x86_64 arm64. xcodebuild test (114 tests) and the ad-hoc fallback path are both green. release.sh preflight failures were exercised directly.

Not yet verified: the -O binary in an actual input session — that package was built before the flag landed. That is what rc1 is for.

🤖 Generated with Claude Code