Highlights
- Hardened cross-platform release publishing with strict hosted-artifact
validation, bounded transport behavior, and release-surface contract tests. - Added credentialed macOS publish evidence for Developer ID signing,
notarization, stapling, hardened runtime, nested target entitlements, strict
signatures, Gatekeeper assessment, and final hosted artifact auditing. - Made the macOS notarization keychain optional when the configured
general-notaryprofile is available in the user's global keychain search
list, while preserving explicit keychain support.
Thanks to @Nicoeevee for the production findings and detailed reports that
informed this work. We'd love to keep developing these improvements together
in the upstream repository; maintaining a separate fork is not necessary for
future fixes, and pull requests are always welcome.
Validated with the merged PR's full CI run and a credentialed local macOS
notarized publish smoke using the existing Developer ID identity and
general-notary profile.
Contributors
Nicoeevee