Label notarized macOS beta downloads as notarized

scripts/connect-release-record.mjs

@@ -162,6 +162,11 @@ function websiteArtifact(assets, version, platform, detail, pattern, trust, labe
   };
 }
 
+// The release workflow marks every macOS artifact that was not Developer ID
+// signed and notarized with an -UNSIGNED filename suffix.
 function macTrust(channel) {
-  return channel === "stable" ? "Signed and notarized" : "Beta preview · not notarized";
+  return (file) => {
+    if (/-UNSIGNED\.dmg$/.test(file)) return "Beta preview · not notarized";
+    return channel === "stable" ? "Signed and notarized" : "Beta preview · notarized";
+  };
 }

scripts/connect-release-record.test.mjs

@@ -63,6 +63,15 @@ test("derives the website record from verified release evidence", () => {
   assert.equal(record.channelManifestUrl, `https://github.com/mdbase-dev/mdbase-connect/releases/download/${tag}/mdbase-connect-channel-v1.json`);
 });
 
+test("labels macOS downloads from their notarization marker", () => {
+  assert.equal(build().desktop[0].trust, "Beta preview · notarized");
+  const unsignedName = `mdbase-connect-${version}-macos-arm64-UNSIGNED.dmg`;
+  const unsigned = { ...release, assets: release.assets.map((asset) => asset.name === names[0] ? { ...asset, name: unsignedName } : asset) };
+  const record = build({ release: unsigned });
+  assert.equal(record.desktop[0].trust, "Beta preview · not notarized");
+  assert.equal(record.desktop[1].trust, "Beta preview · notarized");
+});
+
 test("rejects inconsistent release evidence and duplicate artifacts", () => {
   assert.throws(() => build({ npmVersion: "0.1.0-beta.83" }), /SDK version/);
   assert.throws(() => build({ channel: { ...channel, tag: "v0.1.0-beta.83" } }), /manifest tag/);

src/data/connect-release.json

@@ -12,7 +12,7 @@
     {
       "platform": "macOS",
       "detail": "Apple Silicon",
-      "trust": "Beta preview · not notarized",
+      "trust": "Beta preview · notarized",
       "file": "mdbase-connect-0.1.0-beta.121-macos-arm64.dmg",
       "size": 140657138,
       "sha256": "f65580e68296e44f02754113c025322f895c7007a1b947f57a44a8e337208922",
@@ -21,7 +21,7 @@
     {
       "platform": "macOS",
       "detail": "Intel",
-      "trust": "Beta preview · not notarized",
+      "trust": "Beta preview · notarized",
       "file": "mdbase-connect-0.1.0-beta.121-macos-x64.dmg",
       "size": 147641847,
       "sha256": "135dc3896aea83585faac70f46bb822e2f9f3d1bfa60487600ac1dc21ead2228",

src/pages/downloads/index.astro

@@ -8,7 +8,7 @@ const desktopDownloads = release.desktop;
 const cliDownloads = release.cli;
 const macDownloadsSigned = desktopDownloads
   .filter(({ platform }) => platform === "macOS")
-  .every(({ trust }) => trust === "Signed and notarized");
+  .every(({ trust }) => trust === "Signed and notarized" || trust === "Beta preview · notarized");
 const published = new Date(release.publishedAt);
 const releaseSize = (bytes: number) => `${Math.round(bytes / 1_000_000)} MB`;
 ---