Skip to content

cask: preserve quarantine for notarized releases #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PathGao merged 2 commits into from
Sep 16, 2026
Merged

cask: preserve quarantine for notarized releases #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0650d61
cask: preserve quarantine for notarized releases
PathGao Sep 16, 2026
9996f5b
docs: record verified notarized release
PathGao Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 0 additions & 13 deletions Casks/nifro.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,6 @@
# brew trust --cask PathGao/tap/nifro
# brew install --cask nifro
#
# The `brew trust` line is needed because of the postflight block below: Homebrew will not load a
# cask from outside its own repositories until the user says they trust it, since a cask can run
# code after installing. Leave it out and `brew install` refuses.
#
# version and sha256 are written back by .github/workflows/release.yml after every release, as a
# pull request somebody still has to merge. Do not edit them by hand.
#
Expand Down Expand Up @@ -36,15 +32,6 @@

app "Nifro.app"

# ⚠️ This block is only needed for builds that are not notarized.
# Once the release pipeline has a Developer ID certificate and starts notarizing (path A in
# docs/RELEASE.md), delete the whole postflight block.
postflight do
system_command "/usr/bin/xattr",
args: ["-dr", "com.apple.quarantine", "#{appdir}/Nifro.app"],
must_succeed: false
end

# Sandboxed app, so user data lives in the container. The last entry is only insurance: a proper
# sandboxed build never writes there, but a build that lost its entitlements while being signed
# does, and a user may well have installed one of those.
Expand Down
4 changes: 2 additions & 2 deletions docs/RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@ Provide either notarization credential set as environment secrets:

An API key takes precedence when `NOTARY_KEY_P8` is set; an incomplete API key configuration
fails instead of silently switching methods. Do not put credentials in chat, source files or logs.
As of the 2026-09-16 setup, the signing certificate is configured but notarization credentials
are still required. No notarized release has been verified by this configuration change.
Version 0.9.1 was published on 2026-09-16. Both downloaded DMGs passed checksum, signing
certificate and stapled-ticket verification; Gatekeeper accepted both apps as `Notarized Developer ID`.

## Local builds

Expand Down
Loading