Skip to content

Release Process

Alan Wizemann edited this page Apr 20, 2026 · 5 revisions

Release Process

Scarf releases are produced by a single local script: scripts/release.sh in the main repo. The script is the source of truth — this page is a public-facing summary; do not duplicate prerequisites or step-by-step internals here.

Modes

./scripts/release.sh <VERSION>           # full release: notarize → appcast → gh-pages → tag
./scripts/release.sh <VERSION> --draft   # builds + notarizes, but skips appcast/tag

A full release bumps the version, archives Universal (arm64 + x86_64) + ARM64-only variants, signs with Developer ID, notarizes via xcrun notarytool, staples, EdDSA-signs the appcast entry with Sparkle's key, pushes the appcast to gh-pages, and creates a GitHub release with both zips attached.

A draft release stops after the GitHub release is uploaded, so the current version stays "latest" until explicitly promoted.

Release notes

Notes go in releases/v<VERSION>/RELEASE_NOTES.md before running the script. The script auto-includes the file in the version-bump commit and uses it as the GitHub release body. If absent, a placeholder is used.

Promotion (draft → real)

After running with --draft:

  1. Edit the GitHub release → uncheck Set as draft → Publish.
  2. Push the bump commit: git push origin main.
  3. Tag and push: git tag v<VERSION> && git push origin v<VERSION>.
  4. Merge the appcast entry (releases/v<VERSION>/appcast-entry.xml) into gh-pages appcast.xml, commit, push.

Sparkle signing key

Releases are EdDSA-signed by Sparkle. The private key lives in the user's macOS Keychain under https://sparkle-project.org; the public key is embedded in Info.plist as SUPublicEDKey. If the private key is lost, no installed Scarf can ever update again. There is no recovery — every existing user would have to manually download a new build.

Where things live

After a full release


Last updated: 2026-04-20 — Scarf v2.0.1

Clone this wiki locally