Releases: deploymenttheory/go-macos-pkg
Releases · deploymenttheory/go-macos-pkg
Release list
v0.5.0
0.5.0 (2026-09-01)
Features
- staple: staple .app bundles, not only flat packages (46b4617)
Binaries are pure Go and require no runtime dependencies.
Verify a download against the signed checksum file:
cosign verify-blob \
--bundle macospkg_0.5.0_checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/deploymenttheory/go-macos-pkg/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
macospkg_0.5.0_checksums.txt
shasum -a 256 -c macospkg_0.5.0_checksums.txt --ignore-missingv0.4.3
v0.4.2
0.4.2 (2026-08-31)
Bug Fixes
- appledouble: step over an attribute record by its declared name length (1faeeb3)
- bom: build a Paths tree deeper than one branch level (19e5ef5)
- bom: count symbolic link targets in the BomInfo byte total (0048943)
- cpio: refuse odc fields too large to hold, instead of masking (3464c1b)
- flatpkg: report a payload that does not match the bill of materials (c20c3e5)
- flatpkg: skip entries written through a symlink instead of failing (9cd0994)
- flatpkg: treat a backslash as part of a name, not a separator (f6db575)
- verify: check the contents the signature covers, not just the signature (d5feeed)
- xar: bound entry data without overflowing int64 (1ac0b0a)
v0.4.1
v0.4.0
0.4.0 (2026-08-31)
Features
- 1:1 result parity with the macOS built-in tools (b46c320)
- accept the credential variable names electron-builder uses (dedb846)
- add --analyze and --component-plist for per-bundle rules (14ac113)
- add --component and --prior, pkgbuild's other two ways to build (d88190d)
- add flatten, the inverse of expand (1918e72)
- add product --product, the pre-install requirements property list (b12fc11)
- add product --scripts, --plugins and --ui (ac75675)
- add product --synthesize and --package-path, and rewrite a supplied Distribution (cfd8cd3)
- apply pkgbuild's default payload filters, and add --filter (ee92e8c)
- build the component in place with product --root, --content and --component (083580e)
- check whether the signing certificate has been revoked (7e725ca)
- narrow a listing with --only-files, --only-dirs and --regexp (559eca5)
- read a volume's receipt database (fd3e4f4)
- remember credentials under a name, and write property lists (1cb1b47)
- require macOS 12 where a product carries a large payload (c07bb76)
- store a payload uncompressed, with --compression none (71bff18)
- submit disk images and archives, upload in parts, and ask for a webhook (a06db54)
- write --large-payload packages, not only read them (1fcc1e7)
Bug Fixes
- accelerate uploads by default, as Apple's own example does (e3544ae)
- follow pkgbuild's rules for framework paths and nested bundles (6084264)
- make flatten and the receipts tests work off macOS (785c92d)
- only declare standalone on a Distribution productbuild re-serialises (324c39e)
- write PackageInfo and Distribution exactly as Apple's tools write them (45e85e3)
v0.3.2
v0.3.1
0.3.1 (2026-08-30)
Bug Fixes
- match sentinel errors by identity, not by message text (85ed68b)
Performance Improvements
- stop the LZBITMAP search sweeping history that never matches (684bb1d)
Binaries are pure Go and require no runtime dependencies.
Verify a download against the signed checksum file:
cosign verify-blob \
--bundle macospkg_0.3.1_checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/deploymenttheory/go-macos-pkg/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
macospkg_0.3.1_checksums.txt
shasum -a 256 -c macospkg_0.3.1_checksums.txt --ignore-missingv0.3.0
0.3.0 (2026-08-30)
Features
- read and write pbzb payloads with a pure-Go LZBITMAP (519e895)
- write pbze payloads, and refuse the containers macOS cannot read (a65e879)
Binaries are pure Go and require no runtime dependencies.
Verify a download against the signed checksum file:
cosign verify-blob \
--bundle macospkg_0.3.0_checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/deploymenttheory/go-macos-pkg/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
macospkg_0.3.0_checksums.txt
shasum -a 256 -c macospkg_0.3.0_checksums.txt --ignore-missingv0.2.0
0.2.0 (2026-08-30)
Features
- carry hard links and extended attributes as pkgbuild does (dd0d062)
- read the pbz* payload family and write pbzx payloads (0154bc2)
- verify: embed Apple's G2, G3 and Platform roots (b3ed4f6)
Bug Fixes
- keep extended attributes a host refuses, and let a repack override them (073f29b)
- write a kept sidecar to the checked path, not the raw archive name (9486645)
Binaries are pure Go and require no runtime dependencies.
Verify a download against the signed checksum file:
cosign verify-blob \
--bundle macospkg_0.2.0_checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/deploymenttheory/go-macos-pkg/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
macospkg_0.2.0_checksums.txt
shasum -a 256 -c macospkg_0.2.0_checksums.txt --ignore-missingv0.1.0
0.1.0 (2026-08-29)
Features
- cross-platform macOS package toolkit (inspect, build, sign, notarize, staple) (b010b4b)
Bug Fixes
- build: count a directory's children under its own name (a5a838f)
- staple: close the source before renaming over it, for in-place stapling on Windows (05f3af0)
Binaries are pure Go and require no runtime dependencies.
Verify a download against the signed checksum file:
cosign verify-blob \
--bundle macospkg_0.1.0_checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/deploymenttheory/go-macos-pkg/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
macospkg_0.1.0_checksums.txt
shasum -a 256 -c macospkg_0.1.0_checksums.txt --ignore-missing