feat(macos): wire Developer-ID signing + notarization; fix "app is damaged" docs (#134, #72) - #143
Conversation
…maged" docs (#134, #72) The unsigned DMG triggers macOS Gatekeeper's misleading "app is damaged" block (#134, #72). Two parts: - release.yml: pass APPLE_CERTIFICATE / _PASSWORD / APPLE_SIGNING_IDENTITY / APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID to tauri-action. It signs + notarizes the macOS bundle when these repo secrets are set, and is a no-op (today's unsigned build) when they're absent — so this is safe to merge now and "activates" the moment the maintainer adds an Apple Developer cert. - docs/install/macos.md: explain the "damaged" message is Gatekeeper (not corruption), give the `xattr -cr` + right-click→Open workarounds, and add a "For maintainers" table of the required secrets. Removed the stale "tracked for v0.4" line (versioning rule: everything's on v0.3.0). The in-app error→docs deeplink (GATEKEEPER_QUARANTINE) already targets the #gatekeeper-quarantine anchor. Refs #134, #72. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR enables macOS Developer-ID signing and notarization for the Tauri release pipeline by wiring six Apple-related secrets into the build step, and updates installation documentation to clarify Gatekeeper quarantine behavior for end users and document the maintainer setup requirements. ChangesmacOS Notarization Support
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| Filename | Overview |
|---|---|
| .github/workflows/release.yml | Adds 6 Apple signing/notarization env vars to the tauri-action step; correctly degrades to unsigned builds when secrets are absent (empty-string semantics in GH Actions), and is no-op on Windows/Linux matrix legs. |
| docs/install/macos.md | Rewrites the Gatekeeper section to clarify the "damaged" message, adds xattr + right-click workarounds, and documents the 6 required repo secrets for maintainers; carries forward an inaccurate checksum filename (*.dmg.sha256) that doesn't match what the release workflow actually uploads (SHA256SUMS-.txt). |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Tag push / workflow_dispatch] --> B[tauri-action runs on macos-14]
B --> C{APPLE_CERTIFICATE\nnon-empty?}
C -- Yes\n6 secrets configured --> D[Import .p12 to keychain\nSign .app + .dmg\nNotarize via notarytool]
C -- No\nsecrets absent / empty --> E[Build unsigned .app + .dmg\ntoday's behavior]
D --> F[Signed + notarized DMG\nOpens without quarantine warning]
E --> G[Unsigned DMG\nGatekeeper blocks launch]
G --> H[User workaround:\nxattr -cr or right-click Open]
F --> I[macOS installer smoke test\nRuns backend --health-check\nvia hdiutil attach]
E --> I
Reviews (1): Last reviewed commit: "feat(macos): wire Developer-ID signing +..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| That clears the quarantine xattr so Gatekeeper stops blocking the launch — a | ||
| one-time fix per install. Alternatively, right-click the app → **Open** → | ||
| **Open** in the dialog. The app is open source; verify the SHA-256 against the | ||
| `*.dmg.sha256` checksum on the release page first if you want belt-and-braces. |
There was a problem hiding this comment.
The release workflow uploads checksum files named SHA256SUMS-macOS Apple Silicon.txt, not *.dmg.sha256. A user following this instruction to verify their download before clearing quarantine won't find any file matching *.dmg.sha256 in the release assets.
| That clears the quarantine xattr so Gatekeeper stops blocking the launch — a | |
| one-time fix per install. Alternatively, right-click the app → **Open** → | |
| **Open** in the dialog. The app is open source; verify the SHA-256 against the | |
| `*.dmg.sha256` checksum on the release page first if you want belt-and-braces. | |
| That clears the quarantine xattr so Gatekeeper stops blocking the launch — a | |
| one-time fix per install. Alternatively, right-click the app → **Open** → | |
| **Open** in the dialog. The app is open source; verify the SHA-256 against the | |
| `SHA256SUMS-macOS Apple Silicon.txt` file on the release page first if you want belt-and-braces. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 363-368: The Apple signing secrets (APPLE_CERTIFICATE,
APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_ID, APPLE_PASSWORD,
APPLE_TEAM_ID) are currently set globally for every matrix run; move these env
entries out of the shared/global env block and scope them only to the macOS
runner by adding them to the macOS job or the matrix entry that runs on macOS
(e.g., the job with runs-on: macos-latest or the matrix item for macOS), or
conditionally attach them with a matrix/os == 'macos' conditional so only the
macOS leg receives the APPLE_* secrets.
In `@docs/install/macos.md`:
- Around line 61-62: Update the sentence that currently references the
nonexistent `*.dmg.sha256` checksum artifact to point to the actual release
asset `SHA256SUMS-*.txt` (or the exact per-platform filename), e.g. replace the
`*.dmg.sha256` token in the line containing "Open in the dialog. The app is open
source; verify the SHA-256 against the `*.dmg.sha256` checksum on the release
page first..." with `SHA256SUMS-*.txt` (or add guidance to check the
`SHA256SUMS` attachment) so readers are directed to the correct checksum file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: bd8d2407-083b-4dcb-b879-4e1b33eb9eac
📒 Files selected for processing (2)
.github/workflows/release.ymldocs/install/macos.md
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | ||
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | ||
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | ||
| APPLE_ID: ${{ secrets.APPLE_ID }} | ||
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | ||
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} |
There was a problem hiding this comment.
Scope the Apple signing secrets to the macOS leg only.
Lines 363-368 inject the Developer ID / notarization credentials into every matrix run, even though only the macOS build can use them. That unnecessarily widens secret exposure to the Windows/Linux runners and all tooling invoked on those legs.
Suggested shape
- - name: Build + release (Tauri)
+ - name: Build + release (Tauri, macOS)
+ if: runner.os == 'macOS'
uses: tauri-apps/tauri-action@v0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
APPLE_ID: ${{ secrets.APPLE_ID }}
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
APPIMAGE_EXTRACT_AND_RUN: 1
with:
projectPath: frontend
args: --target ${{ matrix.rust_target }} --bundles ${{ matrix.bundles }}
...
+ - name: Build + release (Tauri, non-macOS)
+ if: runner.os != 'macOS'
+ uses: tauri-apps/tauri-action@v0
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+ TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+ APPIMAGE_EXTRACT_AND_RUN: 1
+ with:
+ projectPath: frontend
+ args: --target ${{ matrix.rust_target }} --bundles ${{ matrix.bundles }}
+ ...🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 363 - 368, The Apple signing
secrets (APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY,
APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID) are currently set globally for every
matrix run; move these env entries out of the shared/global env block and scope
them only to the macOS runner by adding them to the macOS job or the matrix
entry that runs on macOS (e.g., the job with runs-on: macos-latest or the matrix
item for macOS), or conditionally attach them with a matrix/os == 'macos'
conditional so only the macOS leg receives the APPLE_* secrets.
| **Open** in the dialog. The app is open source; verify the SHA-256 against the | ||
| `*.dmg.sha256` checksum on the release page first if you want belt-and-braces. |
There was a problem hiding this comment.
Reference the actual checksum artifact name.
The release workflow uploads SHA256SUMS-*.txt, not *.dmg.sha256, so users following this text will look for an asset that doesn't exist. Please point them to the SHA256SUMS attachment (or the exact per-platform filename) instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/install/macos.md` around lines 61 - 62, Update the sentence that
currently references the nonexistent `*.dmg.sha256` checksum artifact to point
to the actual release asset `SHA256SUMS-*.txt` (or the exact per-platform
filename), e.g. replace the `*.dmg.sha256` token in the line containing "Open in
the dialog. The app is open source; verify the SHA-256 against the
`*.dmg.sha256` checksum on the release page first..." with `SHA256SUMS-*.txt`
(or add guidance to check the `SHA256SUMS` attachment) so readers are directed
to the correct checksum file.
1 participant
Addresses the macOS "OmniVoice Studio.app is damaged and can't be opened" reports (#134, #72) — which is Gatekeeper blocking an unsigned/un-notarised app, not actual corruption.
Two parts
release.yml— passAPPLE_CERTIFICATE,APPLE_CERTIFICATE_PASSWORD,APPLE_SIGNING_IDENTITY,APPLE_ID,APPLE_PASSWORD,APPLE_TEAM_IDtotauri-action. It code-signs + notarizes the macOS bundle only when these repo secrets are set, and is a no-op (today's unsigned build) when they're absent. → safe to merge now; it activates the moment you add an Apple Developer ID cert.docs/install/macos.md— clarify the "damaged" message is Gatekeeper (not corruption), give the immediatexattr -cr+ right-click→Open workarounds, and add a "For maintainers" table of the exact secrets to configure. Removed a stale "tracked for v0.4" line (versioning rule — everything's on v0.3.0). The in-app error→docs deeplink (GATEKEEPER_QUARANTINE) already points at the#gatekeeper-quarantineanchor.What you need to do to get signed builds
Add the 6 repo secrets listed in
docs/install/macos.md → For maintainers(needs a paid Apple Developer account, $99/yr). Until then, users on the unsigned build clear quarantine withxattr -cr.Verification note
The signing path can't be exercised in CI without a real Apple cert; this PR wires it + degrades gracefully. The next tagged release with the secrets present is the real test.
release.ymlYAML validated.Refs #134, #72.
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation