feat: ship unsigned macOS app bundles via the curl installer#78
Merged
Conversation
Apply review findings from the #66 PR 6 panel: verify the destination is a real PickScribe bundle before replacement; stage, back up, and restore the previous app on failure; restrict release-asset downloads to GitHub hosts over HTTPS-only transports; validate archive members before extraction; scope workflow permissions to the release job; align artifact action versions; stop shipping stale post-fix-appimage tarballs; make installer smokes hermetic (fake sysctl) and cover Rosetta, binary replacement, and quoted home paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the final PR 6 slice of #66 (re-scoped: no Apple Developer ID — unsigned distribution). Fixes #57.
What
PickScribe.appinto~/Applicationsand an argument-forwardingpickscribe-appwrapper into~/.local/bin(no sudo, curl downloads carry no Gatekeeper quarantine; defensivexattr -drfor manually-downloaded archives). Bash-3.2/POSIX portable (fixes install.sh: bash 3.2 syntax error at line 154 (';;') #57). Hardened per review: destination identity check before replacement, transactional backup/restore with signal-safe cleanup, GitHub-host allowlist + HTTPS-only transports, pre-extraction archive member validation.build-linux+build-macos(macos-15,--bundles app, Tauri updater minisign artifactsPickScribe_<ver>_aarch64.app.tar.gz+.sig) + areleasejob generating a combinedlatest.json(linux-x86_64 + darwin-aarch64). Least-privilege permissions (contents: writeonly on the release job), aligned artifact actions, stale post-fix-appimage tarballs dropped.ShipsNow, no blockers; summary documents the unsigned posture.Review
Serious-backend panel (3 reviewers, distinct profiles) + targeted fix-verification: clean at HEAD. Deferred hardening filed as #76 (installer minisign verification) and #77 (SHA-pinned actions).
Validation
sh -nclean under /bin/sh (bash 3.2),bun run test42/42 (8 installer smoke scenarios),cargo test140 pass,cargo checkclean, shellcheck + actionlint pass. Localtauri build --bundles appproduces an ad-hoc-signedPickScribe.app; synthetic release set verified a combined two-platformlatest.json. Full updater E2E lands with the next tag.🤖 Generated with Claude Code