Skip to content

docs(release): state that macOS artifacts ship unsigned by default #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xiaoou-waou wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(release): state that macOS artifacts ship unsigned by default #173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,8 +305,22 @@ Ubuntu 20.04, Debian 11, Fedora 35, and older releases cannot load the bundled h

### macOS

The tagged-release workflow signs, notarizes, and staples macOS artifacts with
Developer ID credentials before publication.
Tagged releases publish macOS artifacts **unsigned by default**. The Release
workflow signs, notarizes, and staples with Developer ID credentials only when a
maintainer manually dispatches it with `sign_macos: true`; see the
[release runbook](docs/spec/06-delivery/06-release-runbook.md).

For an unsigned build, macOS may report that **PI-Desktop.app** is damaged and
cannot be opened. Move the app to `/Applications`, then clear the quarantine
attribute:

```bash
xattr -cr /Applications/PI-Desktop.app
```

Every DMG also ships `PI-Desktop-macOS-opening-help.txt` with the same steps.
Use them only for an app obtained from a trusted PI-Desktop source; signed and
notarized builds do not need this command.

---

Expand Down
10 changes: 9 additions & 1 deletion README.zh-CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,7 +305,15 @@ Ubuntu 20.04、Debian 11、Fedora 35 及更旧的发行版无法加载自带的

### macOS

带标签发布工作流程会在发布前使用 Developer ID 凭据完成 macOS 工件的签名、公证和装订。
带标签发布默认产出**未签名**的 macOS 工件。只有维护者以 `sign_macos: true` 手动触发 Release 工作流时，才会使用 Developer ID 凭据完成签名、公证和装订；详见[发布运行手册](docs/zh-CN/spec/06-delivery/06-release-runbook.md)。

对未签名的构建，macOS 可能提示 **PI-Desktop.app** 已损坏、无法打开。把应用移动到 `/Applications`，再清除隔离属性：

```bash
xattr -cr /Applications/PI-Desktop.app
```

每个 DMG 也附带写有相同步骤的 `PI-Desktop-macOS-opening-help.txt`。仅对你从可信 PI-Desktop 来源获取的应用使用该命令；已签名并公证的构建不需要它。

---

Expand Down