diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index 88d9e34..1fc73f7 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -3,7 +3,7 @@ name: Bundle
 on:
   push: # Choose the branch that matches the Smalltalk version below
     # branches:
-    #   - squeak-trunk
+      # - squeak-trunk
       # - squeak-5.3
       # - squeak-5.2
     paths-ignore:
@@ -53,8 +53,6 @@ jobs:
             tmp/*.sources
             tmp/*.image
             tmp/*.changes
-            tmp/version.sh
-            !tmp/Test*
 
 
   test-image:
@@ -118,35 +116,12 @@ jobs:
           # - Squeak64-5.2
           # - Etoys-trunk
           # - Etoys64-trunk
-    runs-on: macos-10.15 # macos-latest
+    runs-on: macos-10.15 # fixed for xcnotary
     name: 📦 Prepare bundles for ${{ matrix.smalltalk }}
     env:
       SMALLTALK_VERSION: ${{ matrix.smalltalk }}
-      GIT_BRANCH: ${{ github.ref }}
-      DEPLOYMENT_BRANCH: squeak-trunk
-
-      CODESIGN_KEY: ${{ secrets.CODESIGN_KEY }}
-      CODESIGN_IV: ${{ secrets.CODESIGN_IV }}
-
-      CERT_IDENTITY: ${{ secrets.SIGN_IDENTITY }}
-      CERT_PASSWORD: ${{ secrets.CERT_PASSWORD }}
-
-      NOTARIZATION_USER: ${{ secrets.NOTARIZATION_USER }}
-      NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
-
-
-
-      DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
-      DEPLOY_IV: ${{ secrets.DEPLOY_IV }}
-
-      PUBLIC_KEY: ${{ secrets.PUBLIC_KEY }}
-
-      PROXY_PORT: ${{ secrets.PROXY_PORT }}
-      PROXY_HOST: ${{ secrets.PROXY_HOST }}
-      PROXY_USER: ${{ secrets.PROXY_USER }}
-      UPSTREAM_HOST: ${{ secrets.UPSTREAM_HOST }}
-      UPSTREAM_USER: ${{ secrets.UPSTREAM_USER }}
-
+      SHOULD_DEPLOY: endsWith(github.ref, "squeak-trunk")
+      SHOULD_CODESIGN: env.SHOULD_DEPLOY
 
     steps:
       - uses: actions/checkout@v2
@@ -158,6 +133,13 @@ jobs:
           path: tmp
 
       - run: ./prepare_bundles.sh
+        env:
+          CODESIGN_KEY: ${{ secrets.CODESIGN_KEY }}
+          CODESIGN_IV: ${{ secrets.CODESIGN_IV }}
+          CERT_IDENTITY: ${{ secrets.CERT_IDENTITY }}
+          CERT_PASSWORD: ${{ secrets.CERT_PASSWORD }}
+          NOTARIZATION_USER: ${{ secrets.NOTARIZATION_USER }}
+          NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v2
@@ -166,4 +148,13 @@ jobs:
           path: product/*
 
       - run: ./deploy_bundles.sh
-        if: endsWith(github.ref, env.DEPLOYMENT_BRANCH)
+        if: env.SHOULD_DEPLOY
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          DEPLOY_IV: ${{ secrets.DEPLOY_IV }}
+          SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+          PROXY_PORT: ${{ secrets.PROXY_PORT }}
+          PROXY_HOST: ${{ secrets.PROXY_HOST }}
+          PROXY_USER: ${{ secrets.PROXY_USER }}
+          UPSTREAM_HOST: ${{ secrets.UPSTREAM_HOST }}
+          UPSTREAM_USER: ${{ secrets.UPSTREAM_USER }}
diff --git a/.gitignore b/.gitignore
index ff93a79..ba94793 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,7 @@
 *.cer
 secret*/
 .secret-*.zip
+smalltalk-ci/repository/**
+tmp/**
+build/**
+product/**
diff --git a/.secret-codesign.zip.enc b/.secret-codesign.zip.enc
new file mode 100644
index 0000000..e9d9aa7
Binary files /dev/null and b/.secret-codesign.zip.enc differ
diff --git a/deploy_bundles.sh b/deploy_bundles.sh
index 8cc8892..b86ff21 100755
--- a/deploy_bundles.sh
+++ b/deploy_bundles.sh
@@ -4,16 +4,47 @@
 #  FILE:    deploy_bundles.sh
 #  CONTENT: Upload all bundles to files.squeak.org
 #
+#  REQUIRES:
+#    SMALLTALK_VERSION ... e.g., Squeak64-trunk
+#    SHOULD_DEPLOY     ... i.e., true or false
+#    product/*.zip
+#    product/*.dmg
+#    IMAGE_NAME
+#    IMAGE_BITS
+#....BUNDLE_NAME_LIN
+#....BUNDLE_NAME_MAC
+#....BUNDLE_NAME_WIN
+#....BUNDLE_NAME_ARM   ... only on 32-bit
+#    DEPLOY_KEY        ... i.e., for unlocking secret files
+#    DEPLOY_IV         ... i.e., for unlocking secret files
+#    SSH_PUBLIC_KEY
+#    PROXY_PORT
+#    PROXY_HOST
+#    PROXY_USER
+#    UPSTREAM_HOST
+#    UPSTREAM_USER
+#  PROVIDES:
+#    -
+#
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
 #           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
 ################################################################################
 
 set -o errexit
 
-[[ -z "${PRODUCT_DIR}" ]] && exit 5
+source "env_vars"
+source "helpers.sh"
+
+[[ -z "${IMAGE_NAME}" ]] && exit 2
+[[ -z "${IMAGE_BITS}" ]] && exit 3
+
+[[ -z "${BUNDLE_NAME_LIN}" ]] && exit 4
+[[ -z "${BUNDLE_NAME_MAC}" ]] && exit 5
+[[ -z "${BUNDLE_NAME_WIN}" ]] && exit 6
 
-source env_vars
-source helpers.sh
+if is_32bit; then
+  [[ -z "${BUNDLE_NAME_ARM}" ]] && exit 7
+fi
 
 begin_group "...preparing deployment..."
 
@@ -22,8 +53,8 @@ if [[ -z "${DEPLOY_KEY}" ]]; then
   exit 1
 else
   unlock_secret "deploy" "${DEPLOY_KEY}" "${DEPLOY_IV}"
-  readonly SSH_KEY_FILEPATH="${HOME_DIR}/secret-deploy/ssh_deploy_key"
-  readonly SSH_KEY_PATH="${HOME_DIR}/secret-deploy"
+  readonly SSH_KEY_FILEPATH="${HOME_PATH}/secret-deploy/ssh_deploy_key"
+  readonly SSH_KEY_PATH="${HOME_PATH}/secret-deploy"
   chmod 600 "${SSH_KEY_FILEPATH}"
 fi
 
@@ -31,31 +62,31 @@ end_group
 
 begin_group "...uploading all files to files.squeak.org.."
 
-readonly TARGET_BASE="/var/www/files.squeak.org"
+readonly UPSTREAM_BASE="/var/www/files.squeak.org"
 
 if is_etoys; then
-  TARGET_PATH="${TARGET_BASE}/etoys/${SQUEAK_VERSION/Etoys/}"
+  UPSTREAM_PATH="${UPSTREAM_BASE}/etoys/${SQUEAK_VERSION/Etoys/}"
 else
-  TARGET_PATH="${TARGET_BASE}/${SQUEAK_VERSION/Squeak/}"
+  UPSTREAM_PATH="${UPSTREAM_BASE}/${SQUEAK_VERSION/Squeak/}"
 fi
-TARGET_PATH="${TARGET_PATH}/${IMAGE_NAME}"
+UPSTREAM_PATH="${UPSTREAM_PATH}/${IMAGE_NAME}"
 
 
 ssh-keyscan -t ecdsa-sha2-nistp256 -p "${PROXY_PORT}" "${PROXY_HOST}" 2>&1 | tee -a "${HOME}/.ssh/known_hosts" > /dev/null;
-echo "${UPSTREAM_HOST} ecdsa-sha2-nistp256 ${PUBLIC_KEY}" | tee -a "${HOME}/.ssh/known_hosts" > /dev/null;
-rsync -rvz --ignore-existing -e "ssh -o ProxyCommand='ssh -l ${PROXY_USER} -i ${SSH_KEY_FILEPATH} -p ${PROXY_PORT} -W %h:%p ${PROXY_HOST}' -l ${UPSTREAM_USER} -i ${SSH_KEY_FILEPATH}" "${PRODUCT_DIR}/" "${UPSTREAM_HOST}:${TARGET_PATH}/";
+echo "${UPSTREAM_HOST} ecdsa-sha2-nistp256 ${SSH_PUBLIC_KEY}" | tee -a "${HOME}/.ssh/known_hosts" > /dev/null;
+rsync -rvz --ignore-existing -e "ssh -o ProxyCommand='ssh -l ${PROXY_USER} -i ${SSH_KEY_FILEPATH} -p ${PROXY_PORT} -W %h:%p ${PROXY_HOST}' -l ${UPSTREAM_USER} -i ${SSH_KEY_FILEPATH}" "${PRODUCT_PATH}/" "${UPSTREAM_HOST}:${UPSTREAM_PATH}/";
 
 end_group
 
-begin_group "...updating latest symlinks on server..."
+begin_group "...updating 'latest' symlinks on server..."
 
-LATEST_PREFIX="${TARGET_BASE}/nightly/Squeak-latest-${IMAGE_BITS}bit"
-SYMS_CMD="ln -f -s ${TARGET_PATH}/${IMAGE_NAME}.zip ${LATEST_PREFIX}.zip"
-SYMS_CMD="${SYMS_CMD} && ln -f -s ${TARGET_PATH}/${BUNDLE_NAME_LIN}.zip ${LATEST_PREFIX}-Linux.zip"
-SYMS_CMD="${SYMS_CMD} && ln -f -s ${TARGET_PATH}/${BUNDLE_NAME_MAC}.dmg ${LATEST_PREFIX}-macOS.dmg"
-SYMS_CMD="${SYMS_CMD} && ln -f -s ${TARGET_PATH}/${BUNDLE_NAME_WIN}.zip ${LATEST_PREFIX}-Windows.zip"
+LATEST_PREFIX="${UPSTREAM_BASE}/nightly/Squeak-latest-${IMAGE_BITS}bit"
+SYMS_CMD="ln -f -s ${UPSTREAM_PATH}/${IMAGE_NAME}.zip ${LATEST_PREFIX}.zip"
+SYMS_CMD="${SYMS_CMD} && ln -f -s ${UPSTREAM_PATH}/${BUNDLE_NAME_LIN}.zip ${LATEST_PREFIX}-Linux.zip"
+SYMS_CMD="${SYMS_CMD} && ln -f -s ${UPSTREAM_PATH}/${BUNDLE_NAME_MAC}.dmg ${LATEST_PREFIX}-macOS.dmg"
+SYMS_CMD="${SYMS_CMD} && ln -f -s ${UPSTREAM_PATH}/${BUNDLE_NAME_WIN}.zip ${LATEST_PREFIX}-Windows.zip"
 if is_32bit; then
-  SYMS_CMD="${SYMS_CMD} && ln -f -s ${TARGET_PATH}/${BUNDLE_NAME_ARM}.zip ${LATEST_PREFIX}-ARMv6.zip"
+  SYMS_CMD="${SYMS_CMD} && ln -f -s ${UPSTREAM_PATH}/${BUNDLE_NAME_ARM}.zip ${LATEST_PREFIX}-ARMv6.zip"
 fi
 ssh -o ProxyCommand="ssh -l ${PROXY_USER} -i ${SSH_KEY_FILEPATH} -p ${PROXY_PORT} -W %h:%p ${PROXY_HOST}" \
   -l "${UPSTREAM_USER}" -i "${SSH_KEY_FILEPATH}" "${UPSTREAM_HOST}" -t "${SYMS_CMD}"
diff --git a/env_vars b/env_vars
index de1f2a0..bd54e3e 100644
--- a/env_vars
+++ b/env_vars
@@ -1,13 +1,15 @@
-readonly HOME_DIR="$(pwd)"
+readonly HOME_PATH="$(pwd)"
 
 readonly FILES_BASE="http://files.squeak.org/base"
 readonly RELEASE_URL="${FILES_BASE}/${SMALLTALK_VERSION/Etoys/Squeak}"
-readonly IMAGE_URL="${RELEASE_URL}/base.zip"
 
+readonly IMAGE_URL="${RELEASE_URL}/base.zip"
 readonly VM_BASE="${RELEASE_URL}"
 
-# version.sh file produced by image
-readonly VERSION_FILE="${TMP_DIR}/version.sh"
+readonly VM_LIN="vm-linux"
+readonly VM_MAC="vm-macos"
+readonly VM_WIN="vm-win"
+readonly VM_ARM6="vm-armv6"
 
-readonly ICONS_DIR="${HOME_DIR}/icons"
-readonly RELEASE_NOTES_DIR="${HOME_DIR}/release-notes"
+readonly ICONS_PATH="${HOME_PATH}/icons"
+readonly RELEASE_NOTES_PATH="${HOME_PATH}/release-notes"
diff --git a/helpers.sh b/helpers.sh
index 43700c6..71c2ead 100644
--- a/helpers.sh
+++ b/helpers.sh
@@ -22,8 +22,12 @@ is_dir() {
   [[ -d $1 ]]
 }
 
-is_deployment_branch() {
-  [[ "${GIT_BRANCH}" == *"${DEPLOYMENT_BRANCH}"* ]]
+should_deploy() {
+  [[ "${SHOULD_DEPLOY}" == "true" ]]
+}
+
+should_codesign() {
+  [[ "${SHOULD_CODESIGN}" == "true" ]]
 }
 
 readonly COLOR_RESET="\033[0m"
@@ -66,9 +70,9 @@ download_and_extract_vm() {
   local url=$2 # e.g., files.squeak.org/base/Squeak-trunk/vm-win.zip
   local target=$3 # e.g., tmp/vm-win
   echo "...downloading and extracting ${name} VM..."
-  curl -f -s --retry 3 -o "${TMP_DIR}/vm.zip" "${url}"
-  unzip -q "${TMP_DIR}/vm.zip" -d "${target}"
-  rm "${TMP_DIR}/vm.zip"
+  curl -f -s --retry 3 -o "${TMP_PATH}/vm.zip" "${url}"
+  unzip -q "${TMP_PATH}/vm.zip" -d "${target}"
+  rm "${TMP_PATH}/vm.zip"
 }
 
 export_variable() {
@@ -84,22 +88,22 @@ export_variable() {
 prepare_platform_vm() {
   case $RUNNER_OS in
     "Windows")
-      readonly VM_URL="${VM_BASE}/vm-win.zip"
-      readonly SMALLTALK_VM="${TMP_DIR}/vm/SqueakConsole.exe"
+      readonly VM_URL="${VM_BASE}/${VM_WIN}.zip"
+      readonly SMALLTALK_VM="${TMP_PATH}/vm/SqueakConsole.exe"
       # Add other GNU tools (e.g., wget) for third-party build scripts
       PATH=$PATH:/c/msys64/usr/bin
       ;;
     "Linux")
-      readonly VM_URL="${VM_BASE}/vm-linux.zip"
-      readonly SMALLTALK_VM="${TMP_DIR}/vm/squeak"
+      readonly VM_URL="${VM_BASE}/${VM_LIN}.zip"
+      readonly SMALLTALK_VM="${TMP_PATH}/vm/squeak"
       ;;
     "macOS")
-      readonly VM_URL="${VM_BASE}/vm-macos.zip"
-      readonly SMALLTALK_VM="${TMP_DIR}/vm/Squeak.app/Contents/MacOS/Squeak"
+      readonly VM_URL="${VM_BASE}/${VM_MAC}.zip"
+      readonly SMALLTALK_VM="${TMP_PATH}/vm/Squeak.app/Contents/MacOS/Squeak"
       ;;
   esac
 
-  download_and_extract_vm "$RUNNER_OS" "${VM_URL}" "${TMP_DIR}/vm"
+  download_and_extract_vm "$RUNNER_OS" "${VM_URL}" "${TMP_PATH}/vm"
 
   if [[ ! -f "${SMALLTALK_VM}" ]]; then
     echo "Failed to locate VM executable." && exit 1
@@ -111,14 +115,14 @@ lock_secret() {
   local key=$2
   local iv=$3
 
-  local secret_dir="${HOME_DIR}/${name}"
+  local secret_dir="${HOME_PATH}/${name}"
 
   if ! is_dir "${secret_dir}"; then
     print_error "Failed to locate files to encrypt."
     exit 1
   fi
 
-  zip -q -r "${HOME_DIR}/.${name}.zip" "${name}"
+  zip -q -r "${HOME_PATH}/.${name}.zip" "${name}"
   rm -r -d "${secret_dir}"
 
   openssl aes-256-cbc -e -in .${name}.zip -out .${name}.zip.enc \
@@ -131,7 +135,7 @@ unlock_secret() {
   local key=$2
   local iv=$3
 
-  local secret_dir="${HOME_DIR}/${name}"
+  local secret_dir="${HOME_PATH}/${name}"
 
   if ! is_file .${name}.zip.enc; then
     print_error "Failed to locate encrypted archive."
@@ -152,7 +156,25 @@ unlock_secret() {
 }
 
 # Assure the existence of all working directories
-readonly BUILD_DIR="${HOME_DIR}/build"
-readonly PRODUCT_DIR="${HOME_DIR}/product"
-readonly TMP_DIR="${HOME_DIR}/tmp"
-mkdir -p "${BUILD_DIR}" "${PRODUCT_DIR}" "${TMP_DIR}"
+readonly BUILD_PATH="${HOME_PATH}/build"
+readonly PRODUCT_PATH="${HOME_PATH}/product"
+readonly TMP_PATH="${HOME_PATH}/tmp"
+mkdir -p "${BUILD_PATH}" "${PRODUCT_PATH}" "${TMP_PATH}"
+
+# Assure $RUNNER_OS if not invoked from within GitHub Actions
+if [[ -z "${RUNNER_OS}" ]]; then
+  case $(uname -s) in
+    Darwin*)
+      export RUNNER_OS="macOS"
+      ;;
+    Linux*)
+      export RUNNER_OS="Linux"
+      ;;
+    CYGWIN*|MINGW*)
+      export RUNNER_OS="Windows"
+      ;;
+    *)
+      echo "Unsupported platform."
+      exit 1
+  esac
+fi
diff --git a/helpers_bundles.sh b/helpers_bundles.sh
index 848b322..ced6442 100644
--- a/helpers_bundles.sh
+++ b/helpers_bundles.sh
@@ -1,52 +1,81 @@
-download_and_extract_vms() {
+download_and_extract_all_vms() {
   begin_group "Downloading and extracting all VMs..."
 
   echo "...downloading and sourcing VM versions file..."
-  curl -f -s --retry 3 -o "${TMP_DIR}/vm-versions" "${VM_BASE}/${VM_VERSIONS}"
-  source "${TMP_DIR}/vm-versions"
+  curl -f -s --retry 3 -o "${TMP_PATH}/vm-versions" "${VM_BASE}/${VM_VERSIONS}"
+  source "${TMP_PATH}/vm-versions"
   if [[ -z "${VERSION_VM_ARMV6}" ]] || [[ -z "${VERSION_VM_LINUX}" ]] || \
      [[ -z "${VERSION_VM_MACOS}" ]] || [[ -z "${VERSION_VM_WIN}" ]]; then
     print_error "...could not determine all required VM versions!"
     exit 1
   fi
 
-  download_and_extract_vm "macOS" "${VM_BASE}/${VM_MAC}.zip" "${TMP_DIR}/${VM_MAC}"
-  download_and_extract_vm "Linux" "${VM_BASE}/${VM_LIN}.zip" "${TMP_DIR}/${VM_LIN}"
-  download_and_extract_vm "Windows" "${VM_BASE}/${VM_WIN}.zip" "${TMP_DIR}/${VM_WIN}"
+  download_and_extract_vm "macOS" "${VM_BASE}/${VM_MAC}.zip" "${TMP_PATH}/${VM_MAC}"
+  download_and_extract_vm "Linux" "${VM_BASE}/${VM_LIN}.zip" "${TMP_PATH}/${VM_LIN}"
+  download_and_extract_vm "Windows" "${VM_BASE}/${VM_WIN}.zip" "${TMP_PATH}/${VM_WIN}"
 
   # ARMv6 currently only supported on 32-bit
   if is_32bit; then
-    download_and_extract_vm "ARMv6" "${VM_BASE}/${VM_ARM6}.zip" "${TMP_DIR}/${VM_ARM6}"
+    download_and_extract_vm "ARMv6" "${VM_BASE}/${VM_ARM6}.zip" "${TMP_PATH}/${VM_ARM6}"
   fi
 
   end_group
 }
 
-compress() {
+compress_into_product() {
   target=$1
   echo "...compressing $target..."
-  pushd "${BUILD_DIR}" > /dev/null
-  # tar czf "${PRODUCT_DIR}/${target}.tar.gz" "./"
-  zip -q -r "${PRODUCT_DIR}/${target}.zip" "./"
+  pushd "${BUILD_PATH}" > /dev/null
+  # tar czf "${PRODUCT_PATH}/${target}.tar.gz" "./"
+  zip -q -r "${PRODUCT_PATH}/${target}.zip" "./"
   popd > /dev/null
 }
 
+compress_into_product_macOS() {
+  source_path=$1
+  target_name=$2
+  target_path="${PRODUCT_PATH}/${target_name}.dmg"
+
+  if [[ ! $(type -t hdiutil) ]]; then
+    print_warning "...Cannot compress into DMG because hdiutil not found."
+    compress_into_product $target_name
+    return
+  fi
+
+  echo "...compressing $target as DMG for macOS..."
+  TMP_DMG="temp.dmg"
+  hdiutil create -size 192m -volname "${target_name}" -srcfolder "${source_path}" \
+      -fs HFS+ -fsargs "-c c=64,a=16,e=16" -format UDRW -nospotlight "${TMP_DMG}"
+  DEVICE="$(hdiutil attach -readwrite -noautoopen -nobrowse "${TMP_DMG}" | awk 'NR==1{print$1}')"
+  VOLUME="$(mount | grep "${DEVICE}" | sed 's/^[^ ]* on //;s/ ([^)]*)$//')"
+  hdiutil detach "${DEVICE}"
+  hdiutil convert "${TMP_DMG}" -format UDBZ -imagekey bzip2-level=6 -o "${target_path}"
+  rm -f "${TMP_DMG}"
+
+if should_codesign; then
+  do_codesign "${target_path}" # *.dmg
+  if ! is_trunk; then
+    do_notarize "${target_path}" # *.dmg
+  fi
+fi
+}
+
 reset_build_dir() {
-  rm -rf "${BUILD_DIR}" && mkdir "${BUILD_DIR}"
+  rm -rf "${BUILD_PATH}" && mkdir "${BUILD_PATH}"
 }
 
 copy_resources() {
   local target=$1
   echo "...copying image files into bundle..."
-  cp "${TMP_DIR}/Squeak.image" "${target}/${IMAGE_NAME}.image"
-  cp "${TMP_DIR}/Squeak.changes" "${target}/${IMAGE_NAME}.changes"
-  cp "${TMP_DIR}/"*.sources "${target}/"
+  cp "${TMP_PATH}/Squeak.image" "${target}/${IMAGE_NAME}.image"
+  cp "${TMP_PATH}/Squeak.changes" "${target}/${IMAGE_NAME}.changes"
+  cp "${TMP_PATH}/"*.sources "${target}/"
 
-  cp -R "${RELEASE_NOTES_DIR}" "${target}/"
-  cp -R "${TMP_DIR}/locale" "${target}/"
+  cp -R "${RELEASE_NOTES_PATH}" "${target}/"
+  cp -R "${TMP_PATH}/locale" "${target}/"
 
   if is_etoys; then
-    cp "${TMP_DIR}/"*.pr "${target}/"
-    cp -R "${TMP_DIR}/ExampleEtoys" "${target}/"
+    cp "${TMP_PATH}/"*.pr "${target}/"
+    cp -R "${TMP_PATH}/ExampleEtoys" "${target}/"
   fi
 }
diff --git a/helpers_codesign.sh b/helpers_codesign.sh
index 1b220b9..e309c21 100644
--- a/helpers_codesign.sh
+++ b/helpers_codesign.sh
@@ -12,8 +12,8 @@ prepare_codesign() {
 
   begin_group "...preparing code signing..."
   unlock_secret "codesign" "${CODESIGN_KEY}" "${CODESIGN_IV}"
-  readonly CERT_FILEPATH_CER="{HOME_DIR}/secret-codesign/codesign.cer"
-  readonly CERT_FILEPATH_P12="{HOME_DIR}/secret-codesign/codesign.p12"
+  readonly CERT_FILEPATH_CER="{HOME_PATH}/secret-codesign/codesign.cer"
+  readonly CERT_FILEPATH_P12="{HOME_PATH}/secret-codesign/codesign.p12"
   prepare_codesign_$RUNNER_OS
   prepare_notarize_$RUNNER_OS
   end_group
@@ -26,10 +26,11 @@ cleanup_codesign() {
   fi
   begin_group "...cleaning up code signing..."
   cleanup_codesign_$RUNNER_OS
+  rm -r -d "{HOME_PATH}/secret-codesign"
   end_group
 }
 
-codesign() {
+do_codesign() {
   if [[ ! $(type -t codesign_$RUNNER_OS) ]]; then
     print_warning "...not code signing because platform not supported: ${RUNNER_OS}."
     return
@@ -40,10 +41,10 @@ codesign() {
     return
   fi
 
-  codesign_$RUNNER_OS $1
+  do_codesign_$RUNNER_OS $1
 }
 
-notarize() {
+do_notarize() {
   if [[ ! $(type -t notarize_$RUNNER_OS) ]]; then
     print_warning "...not notarizing because platform not supported: ${RUNNER_OS}."
     return
@@ -54,7 +55,7 @@ notarize() {
     return
   fi
 
-  notarize_$RUNNER_OS $1
+  do_notarize_$RUNNER_OS $1
 }
 
 prepare_codesign_macOS() {
@@ -66,8 +67,8 @@ prepare_codesign_macOS() {
   # removing relock timeout on keychain
   security set-keychain-settings "${KEY_CHAIN}"
   # Add certificates to keychain and allow codesign to access them
-  security import "${ENCRYPTED_DIR}/sign.cer" -k ~/Library/Keychains/"${KEY_CHAIN}" -T /usr/bin/codesign > /dev/null
-  security import "${ENCRYPTED_DIR}/sign.p12" -k ~/Library/Keychains/"${KEY_CHAIN}" -P "${CERT_PASSWORD}" -T /usr/bin/codesign > /dev/null
+  security import "${CERT_FILEPATH_CER}" -k ~/Library/Keychains/"${KEY_CHAIN}" -T /usr/bin/codesign > /dev/null
+  security import "${CERT_FILEPATH_P12}" -k ~/Library/Keychains/"${KEY_CHAIN}" -P "${CERT_PASSWORD}" -T /usr/bin/codesign > /dev/null
   # Make codesign work on macOS 10.12 or later (see https://git.io/JvE7X)
   security set-key-partition-list -S apple-tool:,apple: -s -k "${KEY_CHAIN_PASSWORD}" "${KEY_CHAIN}" > /dev/null
 
@@ -84,7 +85,7 @@ prepare_notarize_macOS() {
 
 
 
-codesign_macOS() {
+do_codesign_macOS() {
   local target=$1
 
   echo "...signing the bundle..."
@@ -94,16 +95,16 @@ codesign_macOS() {
   # Sign all plugin bundles
   for d in "${target}/Contents/Resources/"*/; do
     if [[ "${d}" == *".bundle/" ]]; then
-      codesign -s "${SIGN_IDENTITY}" --force --deep --verbose "${d}"
+      codesign -s "${CERT_IDENTITY}" --force --deep --verbose "${d}"
     fi
   done
 
   # Sign the app bundle
-  codesign -s "${SIGN_IDENTITY}" --force --deep --verbose --options=runtime \
-    --entitlements "${MAC_TEMPLATE_DIR}/entitlements.plist" "${target}"
+  codesign -s "${CERT_IDENTITY}" --force --deep --verbose --options=runtime \
+    --entitlements "${MAC_TEMPLATE_PATH}/entitlements.plist" "${target}"
 }
 
-notarize_macOS() {
+do_notarize_macOS() {
   local path=$1
 
   if ! command -v xcnotary >/dev/null 2>&1; then
@@ -122,4 +123,4 @@ notarize_macOS() {
 cleanup_codesign_macOS() {
   security delete-keychain "${KEY_CHAIN}"
   #TODO: Remove ALTOOL_PASSWORD from local key chain
-}
\ No newline at end of file
+}
diff --git a/localbuild.sh b/localbuild.sh
index 34f7e42..c233915 100755
--- a/localbuild.sh
+++ b/localbuild.sh
@@ -1,33 +1,30 @@
 #!/bin/bash
-git clean -fdx
-export HOME_DIR="$(pwd)"
-export SMALLTALK_VERSION="Squeak64-trunk"
-export RUNNER_OS="Windows"
-export GIT_BRANCH="squeak-trunk"
-export DEPLOYMENT_BRANCH="squeak-trunk"
 
-# On local runs, just disable codesigning, security, and the extracting
+export SMALLTALK_VERSION="${1:-Squeak64-trunk}"
+export SHOULD_DEPLOY="${2:-false}"
+export SHOULD_CODESIGN="${SHOULD_DEPLOY}"
+
+# On local runs, just disable code signing, security, and the extracting
 # of the signing key
-mkdir encrypted
-export UNZIPPATH=$(which unzip)
+
 function codesign() {
-    echo "No codesigning in local build"
+  echo "No code signing in local build"
 }
 function security() {
-    echo "No security in local build"
+  echo "No security in local build"
 }
 function unzip() {
-    "$(which unzip)" $@ || true
+  "$(which unzip)" $@ || true
 }
 function curl() {
-    if [ "$1" == "-T" ]; then
-	echo "No uploading locally"
-    else
-	"$(which curl)" $@
-    fi
+  if [ "$1" == "-T" ]; then
+    echo "No uploading locally"
+  else
+    "$(which curl)" $@
+  fi
 }
 function brew() {
-    sudo $(which brew) $@
+  echo "No auto-install in local build"
 }
 export -f codesign
 export -f security
@@ -35,7 +32,14 @@ export -f unzip
 export -f curl
 export -f brew
 
-exec ./prepare_image.sh
-exec ./test_image.sh
-exec ./prepare_bundles.sh
-# exec ./deploy_image.sh
+# git clean -fdx
+# exec ./prepare_image.sh
+
+# export SMALLTALK_CI_HOME="../smalltalkCI"
+# exec ./test_image.sh
+
+# source "tmp/version.sh"
+# exec ./prepare_bundles.sh
+
+# export IMAGE_NAME="Squeak6.0alpha-20639-64bit"
+# exec ./deploy_bundles.sh
diff --git a/prepare_aio.sh b/prepare_aio.sh
deleted file mode 100755
index f3f268a..0000000
--- a/prepare_aio.sh
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-################################################################################
-#  PROJECT: Squeak Bundle Generation
-#  FILE:    prepare_aio.sh
-#  CONTENT: Generate the All-in-One bundle.
-#
-#  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
-#           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
-################################################################################
-
-begin_group "Creating All-in-one bundle for ${SMALLTALK_VERSION}..."
-BUNDLE_NAME_AIO="${IMAGE_NAME}-All-in-One"
-BUNDLE_ID_AIO="org.squeak.$(echo ${SQUEAK_VERSION} | tr '[:upper:]' '[:lower:]')-aio-${IMAGE_BITS}bit"
-APP_NAME="${BUNDLE_NAME_AIO}.app"
-APP_DIR="${BUILD_DIR}/${APP_NAME}"
-CONTENTS_DIR="${APP_DIR}/Contents"
-RESOURCES_DIR="${CONTENTS_DIR}/Resources"
-
-VM_ARM_TARGET="${CONTENTS_DIR}/Linux-ARM"
-if [[ "${IMAGE_BITS}" == "64" ]]; then
-  VM_LIN_TARGET="${CONTENTS_DIR}/Linux-x86_64"
-else
-  VM_LIN_TARGET="${CONTENTS_DIR}/Linux-i686"
-fi
-VM_MAC_TARGET="${CONTENTS_DIR}/MacOS"
-VM_WIN_TARGET="${CONTENTS_DIR}/Win32"
-
-echo "...copying VMs into bundle..."
-cp -R "${TMP_DIR}/${VM_MAC}/Squeak.app" "${APP_DIR}"
-if is_32bit; then
-  cp -R "${TMP_DIR}/${VM_ARM6}" "${VM_ARM_TARGET}"
-fi
-cp -R "${TMP_DIR}/${VM_LIN}" "${VM_LIN_TARGET}"
-cp -R "${TMP_DIR}/${VM_WIN}" "${VM_WIN_TARGET}"
-
-copy_resources "${RESOURCES_DIR}"
-
-echo "...merging template..."
-cp "${AIO_TEMPLATE_DIR}/squeak.bat" "${BUILD_DIR}/"
-cp "${AIO_TEMPLATE_DIR}/squeak.sh" "${BUILD_DIR}/"
-cp "${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Info.plist" "${CONTENTS_DIR}/"
-cp "${ICONS_DIR}/${SMALLTALK_NAME}"*.icns "${RESOURCES_DIR}/"
-ENGLISH_DIR="${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Resources/English.lproj"
-cp "${ENGLISH_DIR}/Credits.rtf" "${RESOURCES_DIR}/English.lproj/"
-cp "${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Win32/Squeak.ini" "${VM_WIN_TARGET}/"
-
-echo "...setting permissions..."
-chmod +x "${VM_LIN_TARGET}/squeak" "${VM_MAC_TARGET}/Squeak" "${VM_WIN_TARGET}/Squeak.exe" \
-    "${BUILD_DIR}/squeak.sh" "${BUILD_DIR}/squeak.bat"
-
-echo "...applying various templates (squeak.sh, Info.plist, etc)..."
-# squeak.bat launcher
-sed -i ".bak" "s/%APP_NAME%/${APP_NAME}/g" "${BUILD_DIR}/squeak.bat"
-sed -i ".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${BUILD_DIR}/squeak.bat"
-rm -f "${BUILD_DIR}/squeak.bat.bak"
-# squeak.sh launcher
-sed -i ".bak" "s/%APP_NAME%/${APP_NAME}/g" "${BUILD_DIR}/squeak.sh"
-sed -i ".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${BUILD_DIR}/squeak.sh"
-sed -i ".bak" "s/%IMAGE_BITS%/${IMAGE_BITS}/g" "${BUILD_DIR}/squeak.sh"
-rm -f "${BUILD_DIR}/squeak.sh.bak"
-# Info.plist
-sed -i ".bak" "s/%SmalltalkName%/${SMALLTALK_NAME}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleGetInfoString%/${BUNDLE_NAME_AIO}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleIdentifier%/${BUNDLE_ID_AIO}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleName%/${SMALLTALK_NAME}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleShortVersionString%/${SQUEAK_VERSION_NUMBER}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleVersion%/${IMAGE_BITS} bit/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${CONTENTS_DIR}/Info.plist"
-rm -f "${CONTENTS_DIR}/Info.plist.bak"
-# Squeak.ini (consistent with contents in Info.plist)
-sed -i ".bak" "s/%WindowTitle%/${WINDOW_TITLE}/g" "${VM_WIN_TARGET}/Squeak.ini"
-rm -f "${VM_WIN_TARGET}/Squeak.ini.bak"
-# Remove .map files from $VM_WIN_TARGET
-rm -f "${VM_WIN_TARGET}/"*.map
-
-if is_deployment_branch; then
-  codesign "${APP_DIR}" # *.app
-  if ! is_trunk; then
-    notarize "${APP_DIR}" # *.app
-  fi
-fi
-
-compress "${BUNDLE_NAME_AIO}"
-
-end_group
diff --git a/prepare_bundle_aio.sh b/prepare_bundle_aio.sh
new file mode 100755
index 0000000..c4d33bc
--- /dev/null
+++ b/prepare_bundle_aio.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+################################################################################
+#  PROJECT: Squeak Bundle Generation
+#  FILE:    prepare_bundle_aio.sh
+#  CONTENT: Generate the All-in-One bundle.
+#
+#  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
+#           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
+################################################################################
+
+begin_group "Creating All-in-one bundle for ${SMALLTALK_VERSION}..."
+BUNDLE_NAME_AIO="${IMAGE_NAME}-All-in-One"
+export_variable "BUNDLE_NAME_AIO" "${BUNDLE_NAME_AIO}"
+BUNDLE_ID_AIO="org.squeak.$(echo ${SQUEAK_VERSION} | tr '[:upper:]' '[:lower:]')-aio-${IMAGE_BITS}bit"
+APP_NAME="${BUNDLE_NAME_AIO}.app"
+APP_PATH="${BUILD_PATH}/${APP_NAME}"
+CONTENTS_PATH="${APP_PATH}/Contents"
+RESOURCES_PATH="${CONTENTS_PATH}/Resources"
+
+VM_ARM_TARGET="${CONTENTS_PATH}/Linux-ARM"
+if [[ "${IMAGE_BITS}" == "64" ]]; then
+  VM_LIN_TARGET="${CONTENTS_PATH}/Linux-x86_64"
+else
+  VM_LIN_TARGET="${CONTENTS_PATH}/Linux-i686"
+fi
+VM_MAC_TARGET="${CONTENTS_PATH}/MacOS"
+VM_WIN_TARGET="${CONTENTS_PATH}/Win32"
+
+echo "...copying VMs into bundle..."
+cp -R "${TMP_PATH}/${VM_MAC}/Squeak.app" "${APP_PATH}"
+if is_32bit; then
+  cp -R "${TMP_PATH}/${VM_ARM6}" "${VM_ARM_TARGET}"
+fi
+cp -R "${TMP_PATH}/${VM_LIN}" "${VM_LIN_TARGET}"
+cp -R "${TMP_PATH}/${VM_WIN}" "${VM_WIN_TARGET}"
+
+copy_resources "${RESOURCES_PATH}"
+
+echo "...merging template..."
+cp "${AIO_TEMPLATE_PATH}/squeak.bat" "${BUILD_PATH}/"
+cp "${AIO_TEMPLATE_PATH}/squeak.sh" "${BUILD_PATH}/"
+cp "${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Info.plist" "${CONTENTS_PATH}/"
+cp "${ICONS_PATH}/${SMALLTALK_NAME}"*.icns "${RESOURCES_PATH}/"
+ENGLISH_PATH="${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Resources/English.lproj"
+cp "${ENGLISH_PATH}/Credits.rtf" "${RESOURCES_PATH}/English.lproj/"
+cp "${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Win32/Squeak.ini" "${VM_WIN_TARGET}/"
+
+echo "...setting permissions..."
+chmod +x "${VM_LIN_TARGET}/squeak" "${VM_MAC_TARGET}/Squeak" "${VM_WIN_TARGET}/Squeak.exe" \
+    "${BUILD_PATH}/squeak.sh" "${BUILD_PATH}/squeak.bat"
+
+echo "...applying various templates (squeak.sh, Info.plist, etc)..."
+# squeak.bat launcher
+sed -i".bak" "s/%APP_NAME%/${APP_NAME}/g" "${BUILD_PATH}/squeak.bat"
+sed -i".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${BUILD_PATH}/squeak.bat"
+rm -f "${BUILD_PATH}/squeak.bat.bak"
+# squeak.sh launcher
+sed -i".bak" "s/%APP_NAME%/${APP_NAME}/g" "${BUILD_PATH}/squeak.sh"
+sed -i".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${BUILD_PATH}/squeak.sh"
+sed -i".bak" "s/%IMAGE_BITS%/${IMAGE_BITS}/g" "${BUILD_PATH}/squeak.sh"
+rm -f "${BUILD_PATH}/squeak.sh.bak"
+# Info.plist
+sed -i".bak" "s/%SmalltalkName%/${SMALLTALK_NAME}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleGetInfoString%/${BUNDLE_NAME_AIO}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleIdentifier%/${BUNDLE_ID_AIO}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleName%/${SMALLTALK_NAME}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleShortVersionString%/${SQUEAK_VERSION_NUMBER}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleVersion%/${IMAGE_BITS} bit/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${CONTENTS_PATH}/Info.plist"
+rm -f "${CONTENTS_PATH}/Info.plist.bak"
+# Squeak.ini (consistent with contents in Info.plist)
+sed -i".bak" "s/%WindowTitle%/${WINDOW_TITLE}/g" "${VM_WIN_TARGET}/Squeak.ini"
+rm -f "${VM_WIN_TARGET}/Squeak.ini.bak"
+# Remove .map files from $VM_WIN_TARGET
+rm -f "${VM_WIN_TARGET}/"*.map
+
+if should_codesign; then
+  do_codesign "${APP_PATH}" # *.app
+  if ! is_trunk; then
+    do_notarize "${APP_PATH}" # *.app
+  fi
+fi
+
+compress_into_product "${BUNDLE_NAME_AIO}"
+reset_build_dir
+
+end_group
diff --git a/prepare_lin.sh b/prepare_bundle_linux.sh
similarity index 56%
rename from prepare_lin.sh
rename to prepare_bundle_linux.sh
index 9aee71a..65bb939 100755
--- a/prepare_lin.sh
+++ b/prepare_bundle_linux.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 ################################################################################
 #  PROJECT: Squeak Bundle Generation
-#  FILE:    prepare_lin.sh
+#  FILE:    prepare_bundle_linux.sh
 #  CONTENT: Generate bundle for Linux.
 #
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
@@ -10,24 +10,26 @@
 
 begin_group "Creating Linux bundle for ${SMALLTALK_VERSION}..."
 BUNDLE_NAME_LIN="${IMAGE_NAME}-${VERSION_VM_LINUX}-Linux"
-BUNDLE_DIR="${BUILD_DIR}/${BUNDLE_NAME_LIN}"
-VM_DIR="${BUNDLE_DIR}/bin"
-SHARED_DIR="${BUNDLE_DIR}/shared"
+export_variable "BUNDLE_NAME_LIN" "${BUNDLE_NAME_LIN}"
+BUNDLE_PATH="${BUILD_PATH}/${BUNDLE_NAME_LIN}"
+VM_PATH="${BUNDLE_PATH}/bin"
+SHARED_PATH="${BUNDLE_PATH}/shared"
 
 echo "...creating directories..."
-mkdir -p "${BUNDLE_DIR}" "${VM_DIR}" "${SHARED_DIR}"
+mkdir -p "${BUNDLE_PATH}" "${VM_PATH}" "${SHARED_PATH}"
 
 echo "...copying Linux VM..."
-cp -R "${TMP_DIR}/${VM_LIN}/lib/squeak/"*/ "${VM_DIR}"
+cp -R "${TMP_PATH}/${VM_LIN}/lib/squeak/"*/* "${VM_PATH}"
 
-copy_resources "${SHARED_DIR}"
+copy_resources "${SHARED_PATH}"
 
 echo "...merging template..."
-cp "${LIN_TEMPLATE_DIR}/squeak.sh" "${BUNDLE_DIR}/"
+cp "${LIN_TEMPLATE_PATH}/squeak.sh" "${BUNDLE_PATH}/"
 
 echo "...setting permissions..."
-chmod +x "${VM_DIR}/squeak" "${BUNDLE_DIR}/squeak.sh"
+chmod +x "${VM_PATH}/squeak" "${BUNDLE_PATH}/squeak.sh"
 
-compress "${BUNDLE_NAME_LIN}"
+compress_into_product "${BUNDLE_NAME_LIN}"
+reset_build_dir
 
 end_group
diff --git a/prepare_armv6.sh b/prepare_bundle_linux_armv6.sh
similarity index 57%
rename from prepare_armv6.sh
rename to prepare_bundle_linux_armv6.sh
index fccfa68..2f7ca0c 100755
--- a/prepare_armv6.sh
+++ b/prepare_bundle_linux_armv6.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 ################################################################################
 #  PROJECT: Squeak Bundle Generation
-#  FILE:    prepare_lin.sh
+#  FILE:    prepare_bundle_linux_armv6.sh
 #  CONTENT: Generate bundle for ARMv6.
 #
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
@@ -10,24 +10,26 @@
 
 begin_group "Creating ARMv6 bundle for ${SMALLTALK_VERSION}..."
 BUNDLE_NAME_ARM="${IMAGE_NAME}-${VERSION_VM_ARMV6}-ARMv6"
-BUNDLE_DIR="${BUILD_DIR}/${BUNDLE_NAME_ARM}"
-VM_DIR="${BUNDLE_DIR}/bin"
-SHARED_DIR="${BUNDLE_DIR}/shared"
+export_variable "BUNDLE_NAME_ARM" "${BUNDLE_NAME_ARM}"
+BUNDLE_PATH="${BUILD_PATH}/${BUNDLE_NAME_ARM}"
+VM_PATH="${BUNDLE_PATH}/bin"
+SHARED_PATH="${BUNDLE_PATH}/shared"
 
 echo "...creating directories..."
-mkdir -p "${BUNDLE_DIR}" "${VM_DIR}" "${SHARED_DIR}"
+mkdir -p "${BUNDLE_PATH}" "${VM_PATH}" "${SHARED_PATH}"
 
 echo "...copying ARMv6 VM..."
-cp -R "${TMP_DIR}/${VM_ARM6}/lib/squeak/"*/ "${VM_DIR}"
+cp -R "${TMP_PATH}/${VM_ARM6}/lib/squeak/"*/ "${VM_PATH}"
 
-copy_resources "${SHARED_DIR}"
+copy_resources "${SHARED_PATH}"
 
 echo "...merging template..."
-cp "${LIN_TEMPLATE_DIR}/squeak.sh" "${BUNDLE_DIR}/"
+cp "${LIN_TEMPLATE_PATH}/squeak.sh" "${BUNDLE_PATH}/"
 
 echo "...setting permissions..."
-chmod +x "${VM_DIR}/squeak"
+chmod +x "${VM_PATH}/squeak"
 
-compress "${BUNDLE_NAME_ARM}"
+compress_into_product "${BUNDLE_NAME_ARM}"
+reset_build_dir
 
 end_group
diff --git a/prepare_bundle_macos.sh b/prepare_bundle_macos.sh
new file mode 100755
index 0000000..d623ebe
--- /dev/null
+++ b/prepare_bundle_macos.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+################################################################################
+#  PROJECT: Squeak Bundle Generation
+#  FILE:    prepare_bundle_macos.sh
+#  CONTENT: Generate bundle for macOS.
+#
+#  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
+#           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
+################################################################################
+
+begin_group "Creating macOS bundle for ${SMALLTALK_VERSION}..."
+BUNDLE_NAME_MAC="${IMAGE_NAME}-${VERSION_VM_MACOS}-macOS"
+export_variable "BUNDLE_NAME_MAC" "${BUNDLE_NAME_MAC}"
+BUNDLE_ID_MAC="org.squeak.$(echo ${SQUEAK_VERSION} | tr '[:upper:]' '[:lower:]')-${IMAGE_BITS}bit"
+APP_NAME="${IMAGE_NAME}.app"
+APP_PATH="${BUILD_PATH}/${APP_NAME}"
+CONTENTS_PATH="${APP_PATH}/Contents"
+RESOURCES_PATH="${CONTENTS_PATH}/Resources"
+VM_MAC_TARGET="${CONTENTS_PATH}/MacOS"
+
+echo "...copying macOS VM ..."
+if is_dir "${TMP_PATH}/${VM_MAC}/Squeak.app"; then
+  cp -R "${TMP_PATH}/${VM_MAC}/Squeak.app" "${APP_PATH}"
+else
+  echo "Unable to locate macOS VM." && exit 1
+fi
+
+copy_resources "${RESOURCES_PATH}"
+
+echo "...merging template..."
+cp "${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Info.plist" "${CONTENTS_PATH}/"
+cp "${ICONS_PATH}/${SMALLTALK_NAME}"*.icns "${RESOURCES_PATH}/"
+ENGLISH_PATH="${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Resources/English.lproj"
+cp "${ENGLISH_PATH}/Credits.rtf" "${RESOURCES_PATH}/English.lproj/"
+
+echo "...setting permissions..."
+chmod +x "${VM_MAC_TARGET}/Squeak"
+
+echo "...patching Info.plist..."
+# Info.plist
+sed -i".bak" "s/%SmalltalkName%/${SMALLTALK_NAME}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleGetInfoString%/${BUNDLE_NAME_MAC}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleIdentifier%/${BUNDLE_ID_MAC}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleName%/${SMALLTALK_NAME}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleShortVersionString%/${SQUEAK_VERSION_NUMBER}/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%CFBundleVersion%/${IMAGE_BITS} bit/g" "${CONTENTS_PATH}/Info.plist"
+sed -i".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${CONTENTS_PATH}/Info.plist"
+rm -f "${CONTENTS_PATH}/Info.plist.bak"
+
+if should_codesign; then
+  do_codesign "${APP_PATH}" # *.app
+fi
+
+compress_into_product_macOS "${APP_PATH}" "${BUNDLE_NAME_MAC}"
+reset_build_dir
+
+end_group
diff --git a/prepare_win.sh b/prepare_bundle_windows.sh
similarity index 55%
rename from prepare_win.sh
rename to prepare_bundle_windows.sh
index cc39885..b735614 100755
--- a/prepare_win.sh
+++ b/prepare_bundle_windows.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 ################################################################################
 #  PROJECT: Squeak Bundle Generation
-#  FILE:    prepare_win.sh
+#  FILE:    prepare_bundle_windows.sh
 #  CONTENT: Generate bundle for Windows.
 #
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
@@ -10,29 +10,31 @@
 
 begin_group "Creating Windows bundle for ${SMALLTALK_VERSION}..."
 BUNDLE_NAME_WIN="${IMAGE_NAME}-${VERSION_VM_WIN}-Windows"
-BUNDLE_DIR="${BUILD_DIR}/${BUNDLE_NAME_WIN}"
+export_variable "BUNDLE_NAME_WIN" "${BUNDLE_NAME_WIN}"
+BUNDLE_PATH="${BUILD_PATH}/${BUNDLE_NAME_WIN}"
 
 echo "...creating directories..."
-mkdir -p "${BUNDLE_DIR}"
+mkdir -p "${BUNDLE_PATH}"
 
 echo "...copying Windows VM..."
-cp -R "${TMP_DIR}/${VM_WIN}/" "${BUNDLE_DIR}"
+cp -R "${TMP_PATH}/${VM_WIN}/"* "${BUNDLE_PATH}"
 
-copy_resources "${BUNDLE_DIR}"
+copy_resources "${BUNDLE_PATH}"
 
 echo "...merging template..."
-cp "${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Win32/Squeak.ini" "${BUNDLE_DIR}/"
+cp "${AIO_TEMPLATE_PATH}/Squeak.app/Contents/Win32/Squeak.ini" "${BUNDLE_PATH}/"
 
 echo "...setting permissions..."
-chmod +x "${BUNDLE_DIR}/Squeak.exe"
+chmod +x "${BUNDLE_PATH}/Squeak.exe"
 
 echo "...applying various patches..."
 # Squeak.ini
-sed -i ".bak" "s/%WindowTitle%/${WINDOW_TITLE}/g" "${BUNDLE_DIR}/Squeak.ini"
-rm -f "${BUNDLE_DIR}/Squeak.ini.bak"
-# Remove .map files from $BUNDLE_DIR
-rm -f "${BUNDLE_DIR}/"*.map
+sed -i".bak" "s/%WindowTitle%/${WINDOW_TITLE}/g" "${BUNDLE_PATH}/Squeak.ini"
+rm -f "${BUNDLE_PATH}/Squeak.ini.bak"
+# Remove .map files from $BUNDLE_PATH
+rm -f "${BUNDLE_PATH}/"*.map
 
-compress "${BUNDLE_NAME_WIN}"
+compress_into_product "${BUNDLE_NAME_WIN}"
+reset_build_dir
 
 end_group
diff --git a/prepare_bundles.sh b/prepare_bundles.sh
index a45359e..e180082 100755
--- a/prepare_bundles.sh
+++ b/prepare_bundles.sh
@@ -4,6 +4,27 @@
 #  FILE:    prepare_bundles.sh
 #  CONTENT: Generate different bundles such as the All-in-One.
 #
+#  REQUIRES:
+#    SMALLTALK_VERSION ... e.g., Squeak64-trunk or Etoys64-trunk
+#    SHOULD_CODESIGN   ... i.e., true or false
+#    tmp/Squeak.image
+#    tmp/Squeak.changes
+#    tmp/*.sources
+#    SQUEAK_VERSION    ... e.g., Squeak6.0alpha
+#    SQUEAK_UPDATE     ... e.g., 20639
+#    IMAGE_BITS        ... i.e., 64 or 32
+#  OPTIONAL:
+#    CODESIGN_KEY      ... i.e., for unlocking secret files
+#    CODESIGN_IV       ... i.e., for unlocking secret files
+#    CERT_IDENTITY     ... i.e., for signing the bundle
+#    CERT_PASSWORD     ... i.e., for signing the bundle
+#    NOTARIZATION_USER ... i.e., for distributing the bundle
+#    NOTARIZATION_PASSWORD i.e., for distributing the bundle
+#  PROVIDES:
+#    IMAGE_NAME        ... e.g., Squeak6.0alpha-20639-64bit
+#    product/*.zip
+#    product/*.dmg
+#
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
 #           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
 ################################################################################
@@ -11,25 +32,24 @@
 set -o errexit
 
 [[ -z "${SMALLTALK_VERSION}" ]] && exit 2
-[[ -z "${GIT_BRANCH}" ]] && exit 3
-[[ -z "${DEPLOYMENT_BRANCH}" ]] && exit 3
+[[ -z "${SHOULD_CODESIGN}" ]] && exit 3
+
+[[ -z "${SQUEAK_VERSION}" ]] && exit 4
+[[ -z "${SQUEAK_UPDATE}" ]] && exit 5
+[[ -z "${IMAGE_BITS}" ]] && exit 6
 
 source "env_vars"
 source "helpers.sh"
 source "helpers_bundles.sh"
 
-readonly TEMPLATE_DIR="${HOME_DIR}/templates"
-readonly AIO_TEMPLATE_DIR="${TEMPLATE_DIR}/all-in-one"
-readonly LIN_TEMPLATE_DIR="${TEMPLATE_DIR}/linux"
-readonly MAC_TEMPLATE_DIR="${TEMPLATE_DIR}/macos"
-readonly WIN_TEMPLATE_DIR="${TEMPLATE_DIR}/win"
+readonly TEMPLATE_PATH="${HOME_PATH}/templates"
+readonly AIO_TEMPLATE_PATH="${TEMPLATE_PATH}/all-in-one"
+readonly LIN_TEMPLATE_PATH="${TEMPLATE_PATH}/linux"
+readonly MAC_TEMPLATE_PATH="${TEMPLATE_PATH}/macos"
+readonly WIN_TEMPLATE_PATH="${TEMPLATE_PATH}/win"
 
-readonly LOCALE_DIR="${HOME_DIR}/locale"
+readonly LOCALE_PATH="${HOME_PATH}/locale"
 
-readonly VM_LIN="vm-linux"
-readonly VM_MAC="vm-macos"
-readonly VM_WIN="vm-win"
-readonly VM_ARM6="vm-armv6"
 readonly VM_VERSIONS="versions.txt"
 
 if is_etoys; then
@@ -39,27 +59,23 @@ else
 fi
 
 source "prepare_image_post.sh"
-download_and_extract_vms
+download_and_extract_all_vms
 
-if is_deployment_branch; then
+if should_codesign; then
   source "helpers_codesign.sh"
   prepare_codesign
 fi
 
-reset_build_dir
-source "prepare_aio.sh"
-reset_build_dir
-source "prepare_mac.sh"
-reset_build_dir
-source "prepare_lin.sh"
-reset_build_dir
-source "prepare_win.sh"
+prepare_image_bundle # Just .image and .changes in an archive
+source "prepare_bundle_aio.sh"
+source "prepare_bundle_macos.sh"
+source "prepare_bundle_linux.sh"
+source "prepare_bundle_windows.sh"
 
-reset_build_dir
 if is_32bit; then
-  source "prepare_armv6.sh"
+  source "prepare_bundle_linux_armv6.sh"
 fi
 
-if is_deployment_branch; then
+if should_codesign; then
   cleanup_codesign
 fi
diff --git a/prepare_image.sh b/prepare_image.sh
index 2f8bcc6..a6bc044 100755
--- a/prepare_image.sh
+++ b/prepare_image.sh
@@ -4,6 +4,17 @@
 #  FILE:    prepare_image.sh
 #  CONTENT: Prepare appropriate base image.
 #
+#  REQUIRES:
+#    SMALLTALK_VERSION ... e.g., Squeak64-trunk
+#  PROVIDES:
+#    SQUEAK_VERSION    ... e.g., Squeak6.0alpha
+#    SQUEAK_UPDATE     ... e.g., 20639
+#    IMAGE_BITS        ... i.e., 64 or 32
+#    IMAGE_FORMAT      ... e.g., 68021
+#    tmp/Squeak.image
+#    tmp/Squeak.changes
+#    tmp/*.sources
+#
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
 #           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
 ################################################################################
@@ -11,41 +22,52 @@
 set -o errexit
 
 [[ -z "${SMALLTALK_VERSION}" ]] && exit 2
-[[ -z "${RUNNER_OS}" ]] && exit 3
 
 source "env_vars"
 source "helpers.sh"
 
 download_and_prepare_files() {
   print_info "...downloading and extracting image, changes, and sources..."
-  curl -f -s --retry 3 -o "${TMP_DIR}/base.zip" "${IMAGE_URL}"
+  curl -f -s --retry 3 -o "${TMP_PATH}/base.zip" "${IMAGE_URL}"
 
-  if [[ ! -f "${TMP_DIR}/base.zip" ]]; then
+  if [[ ! -f "${TMP_PATH}/base.zip" ]]; then
     echo "Base image not found at ${IMAGE_URL}!"
     exit 1
   fi
 
-  unzip -q "${TMP_DIR}/base.zip" -d "${TMP_DIR}/"
-  mv "${TMP_DIR}/"*.image "${TMP_DIR}/Squeak.image"
-  mv "${TMP_DIR}/"*.changes "${TMP_DIR}/Squeak.changes"
-  cp -R "${RELEASE_NOTES_DIR}" "${TMP_DIR}/"
-  cp "${ICONS_DIR}/balloon.png" "${TMP_DIR}/"
+  unzip -q "${TMP_PATH}/base.zip" -d "${TMP_PATH}/"
+  mv "${TMP_PATH}/"*.image "${TMP_PATH}/Squeak.image"
+  mv "${TMP_PATH}/"*.changes "${TMP_PATH}/Squeak.changes"
+  cp -R "${RELEASE_NOTES_PATH}" "${TMP_PATH}/"
+  cp "${ICONS_PATH}/balloon.png" "${TMP_PATH}/"
 }
 
 prepare_image() {
   begin_group "...launching, updating, and configuring Squeak..."
   # Do not use -headless here, otherwise there is a problem with the image's initial dimensions
-  pushd "${TMP_DIR}"
+  pushd "${TMP_PATH}" > /dev/null
   "${SMALLTALK_VM}" "Squeak.image" \
       "../prepare_image.st" "${SMALLTALK_VERSION}"
-  popd
+  popd > /dev/null
   end_group
-  if ! is_file "${VERSION_FILE}"; then
+
+  readonly VERSION_FILEPATH="${TMP_PATH}/version.sh"
+  if ! is_file "${VERSION_FILEPATH}"; then
     print_error "Image preparation failed: version.sh file was not exported."
     exit 1
+  else
+    export_version_info
   fi
 }
 
+export_version_info() {
+  source "${VERSION_FILEPATH}" # version.sh file produced by image
+  export_variable "SQUEAK_VERSION" "${SQUEAK_VERSION}"
+  export_variable "SQUEAK_UPDATE" "${SQUEAK_UPDATE}"
+  export_variable "IMAGE_BITS" "${IMAGE_BITS}"
+  export_variable "IMAGE_FORMAT" "${IMAGE_FORMAT}"
+}
+
 print_info "...starting to build ${SMALLTALK_VERSION}..."
 
 prepare_platform_vm
diff --git a/prepare_image.st b/prepare_image.st
index 3e52f54..89907f0 100644
--- a/prepare_image.st
+++ b/prepare_image.st
@@ -68,10 +68,10 @@ releaseBuilder prepareEnvironment.
 FileStream stdout nextPutAll: 'Exporting version information for deployment...'; cr; flush.
 FileStream fileNamed: 'version.sh' do: [:strm |
 	strm
-		nextPutAll: ('SQUEAK_VERSION="{1}"' format: {SystemVersion current version}); lf;
-		nextPutAll: ('SQUEAK_UPDATE="{1}"' format: {SystemVersion current highestUpdate}); lf;
-		nextPutAll: ('IMAGE_BITS="{1}"' format: {Smalltalk image wordSize * 8}); lf;
-		nextPutAll: ('IMAGE_FORMAT="{1}"' format: {Smalltalk image imageFormatVersion}); lf].
+		nextPutAll: ('export SQUEAK_VERSION="{1}"' format: {SystemVersion current version}); lf;
+		nextPutAll: ('export SQUEAK_UPDATE="{1}"' format: {SystemVersion current highestUpdate}); lf;
+		nextPutAll: ('export IMAGE_BITS="{1}"' format: {Smalltalk image wordSize * 8}); lf;
+		nextPutAll: ('export IMAGE_FORMAT="{1}"' format: {Smalltalk image imageFormatVersion}); lf].
 
 FileStream stdout nextPutAll: '[DONE]'; cr; flush.
 releaseBuilder saveAndQuit.
diff --git a/prepare_image_post.sh b/prepare_image_post.sh
index be22743..fa01021 100755
--- a/prepare_image_post.sh
+++ b/prepare_image_post.sh
@@ -4,38 +4,53 @@
 #  FILE:    prepare_image_post.sh
 #  CONTENT: Prepare content around the base image.
 #
+#  REQUIRES:
+#    SMALLTALK_VERSION ... e.g., Squeak64-trunk
+#    SQUEAK_VERSION    ... e.g., Squeak6.0alpha
+#    SQUEAK_UPDATE     ... e.g., 20639
+#    IMAGE_BITS        ... i.e., 64 or 32
+#    tmp/Squeak.image
+#    tmp/Squeak.changes
+#    tmp/*.sources
+#  PROVIDES:
+#    IMAGE_NAME        ... e.g., Squeak6.0alpha-20639-64bit
+#
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
 #           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
 ################################################################################
 
 download_and_prepare_additional_files_for_etoys() {
   begin_group "...preparing Etoys main projects..."
-  for project in "${HOME_DIR}/etoys/"*.[0-9]*; do
+  for project in "${HOME_PATH}/etoys/"*.[0-9]*; do
     zip -j "${project}.zip" "${project}"/*
-    mv "${project}.zip" "${TMP_DIR}/${project##*/}.pr"
+    mv "${project}.zip" "${TMP_PATH}/${project##*/}.pr"
   done
   end_group
 
   begin_group "...preparing etoys gallery projects..."
-  mkdir -p "${TMP_DIR}/ExampleEtoys"
-  for project in "${HOME_DIR}/etoys/ExampleEtoys/"*.[0-9]*; do
+  mkdir -p "${TMP_PATH}/ExampleEtoys"
+  for project in "${HOME_PATH}/etoys/ExampleEtoys/"*.[0-9]*; do
     zip -j "${project}.zip" "${project}"/*
-    mv "${project}.zip" "${TMP_DIR}/ExampleEtoys/${project##*/}.pr"
+    mv "${project}.zip" "${TMP_PATH}/ExampleEtoys/${project##*/}.pr"
   done
   end_group
 
   echo "...copying etoys quick guides..."
-  for language in "${HOME_DIR}/etoys/QuickGuides/"*; do
-    targetdir="${TMP_DIR}/locale/${language##*/}"
+  for language in "${HOME_PATH}/etoys/QuickGuides/"*; do
+    targetdir="${TMP_PATH}/locale/${language##*/}"
     mkdir -p "${targetdir}"
     cp -R "${language}/QuickGuides" "${targetdir}/"
   done
 }
 
-rename_and_move_image() {
-  echo "...copying image files into build dir..."
-  cp "${TMP_DIR}/Squeak.image" "${BUILD_DIR}/${IMAGE_NAME}.image"
-  cp "${TMP_DIR}/Squeak.changes" "${BUILD_DIR}/${IMAGE_NAME}.changes"
+prepare_image_bundle() {
+  begin_group "Creating .image/.changes bundle for ${SMALLTALK_VERSION}..."
+  echo "...copying files into build dir..."
+  cp "${TMP_PATH}/Squeak.image" "${BUILD_PATH}/${IMAGE_NAME}.image"
+  cp "${TMP_PATH}/Squeak.changes" "${BUILD_PATH}/${IMAGE_NAME}.changes"
+  compress_into_product "${IMAGE_NAME}"
+  reset_build_dir
+  end_group
 }
 
 prepare_locales() {
@@ -45,10 +60,16 @@ prepare_locales() {
   brew link --force gettext
   end_group
 
+  if [[ ! $(type -t msgfmt) ]]; then
+    mkdir -p "${TMP_PATH}/locale" # Bundle empty locale directory
+    print_warning "Preparing locales (2/2): Cannot prepare locales because gettext not installed."
+    return
+  fi
+
   begin_group "Preparing locales (2/2): Compiling translations..."
-  for language in "${LOCALE_DIR}/"*; do
+  for language in "${LOCALE_PATH}/"*; do
     pushd "${language}"
-    targetdir="${TMP_DIR}/locale/${language##*/}/LC_MESSAGES"
+    targetdir="${TMP_PATH}/locale/${language##*/}/LC_MESSAGES"
     for f in *.po; do
       mkdir -p "${targetdir}"
       msgfmt -v -o "${targetdir}/${f%%po}mo" "${f}" || true # ignore translation problems
@@ -64,22 +85,8 @@ fi
 
 prepare_locales
 
-# Source in version.sh file produced by image
-source "${VERSION_FILE}"
 readonly IMAGE_NAME="${SQUEAK_VERSION}-${SQUEAK_UPDATE}-${IMAGE_BITS}bit"
-readonly SQUEAK_VERSION_NUMBER=$(echo "${SQUEAK_VERSION}" | sed "s/^[A-Za-z]*\(.*\)$/\1/")
-readonly WINDOW_TITLE="${SMALLTALK_NAME} ${SQUEAK_VERSION_NUMBER} (${IMAGE_BITS} bit)"
-
-export_variable "SQUEAK_VERSION" "${SQUEAK_VERSION}"
-export_variable "SQUEAK_UPDATE" "${SQUEAK_UPDATE}"
-export_variable "IMAGE_BITS" "${IMAGE_BITS}"
-export_variable "IMAGE_FORMAT" "${IMAGE_FORMAT}"
-
 export_variable "IMAGE_NAME" "${IMAGE_NAME}"
-export_variable "SQUEAK_VERSION_NUMBER" "${SQUEAK_VERSION_NUMBER}"
-export_variable "WINDOW_TITLE" "${WINDOW_TITLE}"
 
-begin_group "Finalizing image..."
-rename_and_move_image
-compress "${IMAGE_NAME}"
-end_group
+readonly SQUEAK_VERSION_NUMBER=$(echo "${SQUEAK_VERSION}" | sed "s/^[A-Za-z]*\(.*\)$/\1/")
+readonly WINDOW_TITLE="${SMALLTALK_NAME} ${SQUEAK_VERSION_NUMBER} (${IMAGE_BITS} bit)"
diff --git a/prepare_mac.sh b/prepare_mac.sh
deleted file mode 100755
index 1bb31d3..0000000
--- a/prepare_mac.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-################################################################################
-#  PROJECT: Squeak Bundle Generation
-#  FILE:    prepare_mac.sh
-#  CONTENT: Generate bundle for macOS.
-#
-#  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
-#           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
-################################################################################
-
-begin_group "Creating macOS bundle for ${SMALLTALK_VERSION}..."
-BUNDLE_NAME_MAC="${IMAGE_NAME}-${VERSION_VM_MACOS}-macOS"
-BUNDLE_ID_MAC="org.squeak.$(echo ${SQUEAK_VERSION} | tr '[:upper:]' '[:lower:]')-${IMAGE_BITS}bit"
-BUNDLE_TARGET_MAC="${PRODUCT_DIR}/${BUNDLE_NAME_MAC}.dmg"
-APP_NAME="${IMAGE_NAME}.app"
-APP_DIR="${BUILD_DIR}/${APP_NAME}"
-CONTENTS_DIR="${APP_DIR}/Contents"
-RESOURCES_DIR="${CONTENTS_DIR}/Resources"
-VM_MAC_TARGET="${CONTENTS_DIR}/MacOS"
-
-echo "...copying macOS VM ..."
-if is_dir "${TMP_DIR}/${VM_MAC}/Squeak.app"; then
-  cp -R "${TMP_DIR}/${VM_MAC}/Squeak.app" "${APP_DIR}"
-else
-  echo "Unable to locate macOS VM." && exit 1
-fi
-
-copy_resources "${RESOURCES_DIR}"
-
-echo "...merging template..."
-cp "${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Info.plist" "${CONTENTS_DIR}/"
-cp "${ICONS_DIR}/${SMALLTALK_NAME}"*.icns "${RESOURCES_DIR}/"
-ENGLISH_DIR="${AIO_TEMPLATE_DIR}/Squeak.app/Contents/Resources/English.lproj"
-cp "${ENGLISH_DIR}/Credits.rtf" "${RESOURCES_DIR}/English.lproj/"
-
-echo "...setting permissions..."
-chmod +x "${VM_MAC_TARGET}/Squeak"
-
-echo "...patching Info.plist..."
-# Info.plist
-sed -i ".bak" "s/%SmalltalkName%/${SMALLTALK_NAME}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleGetInfoString%/${BUNDLE_NAME_MAC}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleIdentifier%/${BUNDLE_ID_MAC}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleName%/${SMALLTALK_NAME}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleShortVersionString%/${SQUEAK_VERSION_NUMBER}/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%CFBundleVersion%/${IMAGE_BITS} bit/g" "${CONTENTS_DIR}/Info.plist"
-sed -i ".bak" "s/%SqueakImageName%/${IMAGE_NAME}.image/g" "${CONTENTS_DIR}/Info.plist"
-rm -f "${CONTENTS_DIR}/Info.plist.bak"
-
-if is_deployment_branch; then
-  codesign "${APP_DIR}" # *.app
-fi
-
-echo "...compressing the bundle for macOS..."
-TMP_DMG="temp.dmg"
-hdiutil create -size 192m -volname "${BUNDLE_NAME_MAC}" -srcfolder "${APP_DIR}" \
-    -fs HFS+ -fsargs "-c c=64,a=16,e=16" -format UDRW -nospotlight "${TMP_DMG}"
-DEVICE="$(hdiutil attach -readwrite -noautoopen -nobrowse "${TMP_DMG}" | awk 'NR==1{print$1}')"
-VOLUME="$(mount | grep "${DEVICE}" | sed 's/^[^ ]* on //;s/ ([^)]*)$//')"
-hdiutil detach "${DEVICE}"
-hdiutil convert "${TMP_DMG}" -format UDBZ -imagekey bzip2-level=6 -o "${BUNDLE_TARGET_MAC}"
-rm -f "${TMP_DMG}"
-
-if is_deployment_branch; then
-  codesign "${BUNDLE_TARGET_MAC}" # *.dmg
-  if ! is_trunk; then
-    notarize "${BUNDLE_TARGET_MAC}" # *.dmg
-  fi
-fi
-
-end_group
diff --git a/secret.sh b/secret.sh
new file mode 100755
index 0000000..18fc575
--- /dev/null
+++ b/secret.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+################################################################################
+#  PROJECT: Lock and unlock secrets
+#  FILE:    secret.sh
+#  CONTENT: Encrypt and decrypt files in/to "./secret-*" directories
+#           to/from ".secret-*.zip.enc" archive
+#
+#  AUTHORS: Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
+################################################################################
+
+set -o errexit
+
+source env_vars
+source helpers.sh
+
+readonly OP=$1 # lock or unlock
+readonly NAME=$2
+readonly KEY=$3
+readonly IV=$4
+
+# For example, you can generate KEY and IV in Squeak as follows:
+#   ((1 to: 128) collect: [:ea |
+#     (16 atRandom - 1) printStringBase: 16]) join
+
+case $OP in
+  lock)
+    lock_secret $NAME $KEY $IV
+    ;;
+  unlock)
+    unlock_secret $NAME $KEY $IV
+    ;;
+  *)
+    echo "Unknown operation. Use 'lock' or 'unlock'."
+    exit 1
+    ;;
+esac
diff --git a/templates/all-in-one/squeak.sh b/templates/all-in-one/squeak.sh
index 623b0aa..476e8b7 100644
--- a/templates/all-in-one/squeak.sh
+++ b/templates/all-in-one/squeak.sh
@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
 # File:        squeak.sh (All-in-One version)
 # Authors:     Bert Freudenberg, Paul DeBruicker, Craig Latta, Chris Muller,
-#              Fabio Niephaus
-# Version:     2.2
-# Date:        2020/03/31
+#              Fabio Niephaus, Marcel Taeumel
+# Version:     2.2.1
+# Date:        2021/09/25
 # Description: Script to run Squeak from the all-in-one app structure
 #              (based on Etoys-To-Go)
 
-APP_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/%APP_NAME%" && pwd )"
-IMAGE="${APP_DIR}/Contents/Resources/%SqueakImageName%"
+APP_PATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )/%APP_NAME%" && pwd )"
+IMAGE="${APP_PATH}/Contents/Resources/%SqueakImageName%"
 IMAGE_BITS="%IMAGE_BITS%"
 CPU="$(uname -m)"
-CONF_FILE="/etc/security/limits.d/squeak.conf"
+CONF_FILEPATH="/etc/security/limits.d/squeak.conf"
 
 showerror() {
   if [[ -n "${DISPLAY}" ]] && [[ -x "$(which kdialog 2>/dev/null)" ]]; then
@@ -56,21 +56,21 @@ ensure_kernel() {
     exit 1
   fi
 
-  # Check for $CONF_FILE on systems with Linux kernel earlier than 4.x.x
+  # Check for $CONF_FILEPATH on systems with Linux kernel earlier than 4.x.x
   if [[ "${major}" -lt "4" ]]; then
     ensure_conf_file
   fi
 }
 
-# Ensure that the $CONF_FILE configuration file exists and help to create one
+# Ensure that the $CONF_FILEPATH configuration file exists and help to create one
 ensure_conf_file() {
   local user_input
-  if ! [[ -f "${CONF_FILE}" ]]; then
-    read -p "${CONF_FILE} is missing. Do you want to create one?
+  if ! [[ -f "${CONF_FILEPATH}" ]]; then
+    read -p "${CONF_FILEPATH} is missing. Do you want to create one?
 This operation requires sudo permissions. (y/N): " user_input
     if [[ "${user_input}" = "y" ]]; then
       echo "You may be asked to enter your password..."
-      sudo tee -a "${CONF_FILE}" > /dev/null <<END
+      sudo tee -a "${CONF_FILEPATH}" > /dev/null <<END
 *       hard    rtprio  2
 *       soft    rtprio  2
 END
@@ -109,7 +109,7 @@ ensure_image() {
 
 ensure_kernel
 check_cpu
-VM="${APP_DIR}/Contents/Linux-${CPU}/bin/squeak"
+VM="${APP_PATH}/Contents/Linux-${CPU}/bin/squeak"
 ensure_vm
 ensure_image
 
diff --git a/templates/linux/squeak.sh b/templates/linux/squeak.sh
index 7bbcb69..4320591 100755
--- a/templates/linux/squeak.sh
+++ b/templates/linux/squeak.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # File:        squeak.sh
-# Author:      Fabio Niephaus, K K Subramaniam
-# Version:     2.5
-# Date:        2020/04/22
+# Author:      Fabio Niephaus, K K Subramaniam, Marcel Taeumel
+# Version:     2.5.1
+# Date:        2021/09/25
 # Description: Script to launch Squeak executable from a bundle
 # usage:
 #    squeak [<vmargs>] [ *.image [ <stargs> ... ]]
@@ -12,7 +12,7 @@ ROOT=$(cd -P $(dirname "$0"); pwd)
 APP=$(basename "$0" .sh)
 readonly APP_NAME=${APP^}  # first letter uppercase
 
-CONF_FILE="/etc/security/limits.d/${APP}.conf"
+CONF_FILEPATH="/etc/security/limits.d/${APP}.conf"
 OS=$(uname -s)
 CPU=$(uname -m)
 case "${CPU}" in
@@ -80,21 +80,21 @@ ensure_linux_kernel() {
     exit 1
   fi
 
-  # Check for $CONF_FILE on systems with Linux kernel earlier than 4.x.x
+  # Check for $CONF_FILEPATH on systems with Linux kernel earlier than 4.x.x
   if [[ "${major}" -lt "4" ]]; then
     ensure_conf_file
   fi
 }
 
-# Ensure that the $CONF_FILE configuration file exists and help to create one
+# Ensure that the $CONF_FILEPATH configuration file exists and help to create one
 ensure_conf_file() {
   local user_input
-  if ! [[ -f "${CONF_FILE}" ]]; then
-    read -p "${CONF_FILE} is missing. Do you want to create one?
+  if ! [[ -f "${CONF_FILEPATH}" ]]; then
+    read -p "${CONF_FILEPATH} is missing. Do you want to create one?
 This operation requires sudo permissions. (y/N): " user_input
     if [[ "${user_input}" = "y" ]]; then
       echo "You may be asked to enter your password..."
-      sudo tee -a "${CONF_FILE}" > /dev/null <<END
+      sudo tee -a "${CONF_FILEPATH}" > /dev/null <<END
 *       hard    rtprio  2
 *       soft    rtprio  2
 END
diff --git a/test_image.sh b/test_image.sh
index 9312b74..03aba28 100755
--- a/test_image.sh
+++ b/test_image.sh
@@ -4,6 +4,15 @@
 #  FILE:    test_image.sh
 #  CONTENT: Use smalltalkCI to run all tests in the prepared image.
 #
+#  REQUIRES:
+#    SMALLTALK_VERSION ... e.g., Squeak64-trunk
+#    SMALLTALK_CI_HOME ... i.e., the path to smalltalkCI sources
+#    tmp/Squeak.image
+#    tmp/Squeak.changes
+#    tmp/*.sources
+#  PROVIDES:
+#    tmp/*.xml             i.e., the test results
+#
 #  AUTHORS: Fabio Niephaus, Hasso Plattner Institute, Potsdam, Germany
 #           Marcel Taeumel, Hasso Plattner Institute, Potsdam, Germany
 ################################################################################
@@ -11,38 +20,35 @@
 set -o errexit
 
 [[ -z "${SMALLTALK_VERSION}" ]] && exit 2
-[[ -z "${RUNNER_OS}" ]] && exit 3
-[[ -z "${SMALLTALK_CI_HOME}" ]] && exit 4
+[[ -z "${SMALLTALK_CI_HOME}" ]] && exit 3
 
 source "env_vars"
 source "helpers.sh"
 
-mkdir -p "${TMP_DIR}"
-
-readonly SCI_DIR="${HOME_DIR}/smalltalk-ci"
+readonly SCI_PATH="${HOME_PATH}/smalltalk-ci"
 
 test_image() {
   local ston_config="default.ston"
 
-  if [[ -f "${SCI_DIR}/${SMALLTALK_VERSION}.ston" ]]; then
+  if [[ -f "${SCI_PATH}/${SMALLTALK_VERSION}.ston" ]]; then
     ston_config="${SMALLTALK_VERSION}.ston"
   fi
 
-  cp "${TMP_DIR}/Squeak.image" "${TMP_DIR}/Test.image"
-  cp "${TMP_DIR}/Squeak.changes" "${TMP_DIR}/Test.changes"
+  cp "${TMP_PATH}/Squeak.image" "${TMP_PATH}/Test.image"
+  cp "${TMP_PATH}/Squeak.changes" "${TMP_PATH}/Test.changes"
 
-  # Improve compatibility with Windows ... *sigh*
-  cp "${SCI_DIR}/${ston_config}" "${TMP_DIR}/${ston_config}"
-  cp -r "${SMALLTALK_CI_HOME}/repository" "${HOME_DIR}/smalltalk-ci"
+  # Prepare usage of relative paths to improve compatibility with Windows
+  cp "${SCI_PATH}/${ston_config}" "${TMP_PATH}/${ston_config}"
+  cp -r "${SMALLTALK_CI_HOME}/repository" "${HOME_PATH}/smalltalk-ci"
 
   begin_group "Testing Squeak via smalltalkCI using ${ston_config}..."
   export SCIII_COLORFUL="true"
-  pushd "${TMP_DIR}"
+  pushd "${TMP_PATH}" > /dev/null
   "${SMALLTALK_VM}" -headless "Test.image" \
        "../test_image.st" "${SMALLTALK_VERSION}" \
        "../smalltalk-ci" "${ston_config}" \
          || true # Ignore crashes/failures
-  popd
+  popd > /dev/null
   check_test_status
   end_group
 }
@@ -51,11 +57,11 @@ check_test_status() {
   local test_status_file="build_status.txt"
   local build_status
 
-  if ! is_file "${TMP_DIR}/${test_status_file}"; then
+  if ! is_file "${TMP_PATH}/${test_status_file}"; then
     print_error "...build failed before tests were performed correctly!"
     exit 1
   fi
-  build_status=$(cat "${TMP_DIR}/${test_status_file}")
+  build_status=$(cat "${TMP_PATH}/${test_status_file}")
   if [[ ! -z "${build_status}" ]]; then
     # Note that build_status is not expected to be "[successful]" but empty on success
     print_warning "...all tests were performed correctly but they did not all pass."