CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

desktop-release: never run the x86_64 slice on the build Mac (Rosetta makes macOS warn the owner that the app will not open in the next macOS); every Mach-O in the bundle checked with lipo (arm64 + x86_64), self-test and sidecar version run natively only; pitfall 34

Browse source
This commit is contained in:
CRTkafa 2026-10-13 01:59:23 +08:00
parent 7e09947e62
commit 3952716ef8
5 changed files with 64 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/desktop-release.md
View file

@ -91,8 +91,11 @@ What it does, in order:
- `codesign --verify --deep --strict`;
- the Gatekeeper expectation (signed: `spctl` accepts it as Notarized Developer ID and `stapler validate` passes;
unsigned: ad-hoc, and `spctl` rejects it);
- the self-test, run from the mounted DMG and from the unpacked updater bundle, for both CPU types (x86_64 through
Rosetta). `storebound-desktop --self-test` starts the bundled sidecar, sends `session.hello`, prints one JSON
- `lipo -archs` on every executable in the bundle (each must carry arm64 and x86_64). The x86_64 slice is never
run on the build Mac: that starts Rosetta, and macOS then warns the owner that the app "includes a component that
will not open" in the next macOS;
- the self-test (arm64, native), run from the mounted DMG and from the unpacked updater bundle.
`storebound-desktop --self-test` starts the bundled sidecar, sends `session.hello`, prints one JSON
line and exits, before Tauri starts, so no window opens;
- the privacy scan of the app, the DMG and the updater bundle.
6. Writes minisign `.sig` files with the updater key and checks them right away against tauri.conf.json's key.