macOS: signed and notarized Revue that opens without the right-click workaround, and Homebrew #75
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Today
Revue.appisn't signed by us, so the first launch needs right-click → Open (docs/getting-started.md: "Revue isn't notarized by Apple yet"). On recent macOS versions that workaround moved into System Settings → Privacy & Security, which is worse. Homebrew is also disabling casks that fail Gatekeeper (from Homebrew 5.0, enforced since September 2026), so without notarization there's no official cask.Plan
1. Prerequisites (yours, outside the repo)
MACOS_CERT_P12(base64),MACOS_CERT_PASSWORD,APPLE_API_KEY(a JSON file made byrcodesign encode-app-store-connect-api-key).2. Sign and notarize on Linux, in the existing
macosjobThe build is cross-compiled in
cargo-zigbuildwith no Mac in CI.rcodesign(apple-codesign, one static binary) signs and notarizes from Linux:rcodesign sign --code-signature-flags runtime(hardened runtime, which notarization requires) onRevue.app, using the .p12. That signs both architectures of the universal binary.revue://handler, spawninggit/gh/language servers and the localhost OAuth callback on port 47392 all still work under the hardened runtime. Addpackaging/entitlements.plistonly if something needs it.rcodesign notary-submit --wait, then staple the ticket into the.app..zipand the.dmg(and their.sha256) from the stapled app. Reordertask package PLATFORM=macos: sign/notarize becomes a step between the bundle and the archives, and is skipped (with a note) when the secrets are missing, so local and fork builds keep working.genisoimage), which can't be signed or notarized itself. That's fine: the stapled app inside is what Gatekeeper checks. Making a real UDIF.dmgon Linux (to sign the image too) is optional.3. The in-app updater must keep the signature valid
update_now(src/update.rs:342) replaces onlyContents/MacOS/revueandInfo.plistinside the bundle. In a signed bundle, the new binary's signature seals a different_CodeResources/ticket than the one left in place, so the bundle no longer verifies (codesign --verifyfails, and anything that re-checks it, such as a quarantined copy or a later Gatekeeper assessment, rejects it).Revue.appfrom the release zip: extract it next to the bundle, rename the old one aside, rename the new one in, and delete the old one after restart.4. Homebrew
homebrew-revuewithCasks/revue.rb(auto_updates true, since the app updates itself), installed withbrew tap thatrichan/revue <git url>thenbrew install --cask revue. A task rewrites the version and sha256 at each release and pushes it fromrelease.yml.homebrew/cask. It requires notarization (this issue) and Homebrew's notability bar.5. Docs
Remove the right-click step and the NOTE from
docs/getting-started.md, update the README install table, and add the Homebrew install.Decisions for you
Order
1 → 2 → 3 (must ship in the same release as the first signed build, or the first self-update breaks the signature) → 5 → 4.
Homebrew tap, done ahead of notarization (
7a82743): the caskthatrichan/homebrew-revueis filled in frompackaging/homebrew/revue.rbat each release (auto_updates true). The repository still has to be created. Until signing lands, macOS still asks before the first launch, as with the download.